Sending alerts and health stats directly from appliances

If appliances are connected to a Trellix Helix-enabled Central Management System appliance, you should prevent the Central Management System appliance from streaming their alerts to Trellix Helix and instead allow streaming directly from the connected appliances. This is recommended for all connected appliances, but is required for appliances with the HelixConnect Client enabled. Otherwise, you will be unable to take alert remediation actions for those appliances from the Trellix Helix Web UI (described in the Trellix Helix Product Guide).

Both the Central Management System appliance and connected appliances stream health statistics to Trellix Helix. The Central Management System appliance should stream health statistics for itself, but health statistics for connected appliances should be streamed directly from those appliances and not through the Central Management System appliance.

Note
Alert and health statistics streaming is disabled by default on the Central Management System appliance and connected appliances, but is enabled after Trellix Helix mode is enabled on them. This topic shows how to verify the configuration and modify it as necessary to stream directly from the connected appliances.

To stop alert streaming from the Central Management System appliance:

Log into the Central Management System CLI.

Go to CLI configuration mode:

cm-hostname > enable
cm-hostname # configure terminal

Verify that streaming is disabled on the Central Management System appliance:
```
cm-hostname (config) # show fenotify integ helix
```
If the enable field is yes, disable streaming from the Central Management System appliance:
```
cm-hostname (config) # no fenotify integ helix
```

To enable alert and health statistics streaming from a connected appliance:

Log into the connected appliance CLI.

Go to CLI configuration mode:

appl-hostname > enable
appl-hostname # configure terminal

Verify that alert streaming is enabled on the connected appliance:
```
appl-hostname (config) # show datastreaming helix
```
If the Helix datastreaming enabled field is no, enable streaming from the appliance:
```
appl-hostname (config) # datastreaming helix alert-metadata enable
```
Verify that health statistics streaming is enabled on the connected appliance:
```
appl-hostname (config) # show helix health-stats status
```
If the enabled field is no, enable streaming from the appliance:
```
appl-hostname (config) # helix health-stats enable
```
Prevent the Central Management System appliance from uploading health statistics on behalf of the connected appliance:
```
appl-hostname (config) # no fenet dti helix service override enable
```
Verify that the Trellix Helix service setting is DTI (xxx) - Managed by Appliance (not CMS).
```
appl-hostname (config) # show fenet dti configuration
```
Optional: Verify whether OS changes are included in the alerts:
```
hostname (config) # show datastreaming helix
```

If the include os-changes field is no, enable the inclusion of OS changes:

hostname (config) # datastreaming helix alert-metadata include-oschanges