This task list summarizes the steps for viewing SmartVision alerts.
Prerequisites
Completion of Task list for deploying SmartVision.
Log in to the SmartVision Web UI.
Check the dashboard What's Happening panel.
On a SmartVision Edition appliance, this panel shows the number of Malware Guard alerts, Malware Object alerts, and alerts detected. On a SmartVision-enabled Network Security sensor or integrated appliance, additional alert categories are included. For details, see What’s happening panel.
Check the dashboard Critical Malware Detection panel.
The pie chart shows the number of hosts that triggered critical malware alerts:
On a SmartVision Edition appliance, the panel shows the number of hosts that triggered Malware Object alerts. On a SmartVision-enabled Network Security sensor or integrated appliance, the panel shows the number of hosts that triggered Malware Object, Web Infection, and Malware Callback alerts. You can pivot from a pie chart section to the corresponding filtered alerts list. For details, see Critical malware detection panel.
Go to the SmartVision alerts list.
Select Alerts > SmartVision. For detailed information about this page, see About the SmartVision alerts list and Viewing the SmartVision alerts list.
(If no alerts are seen on a SmartVision Classic edition appliance) Measure the average EPS load.
If the average EPS measured on your Classic edition appliance exceeds the recommended maximum EPS for that model, the appliance may fail to detect some post-exploitation attacker activities. Contact Trellix Technical Support.
Expand the entry for a alert you want to investigate.
Expand the entry for a SmartVision event you want to investigate.
View other events that involve the post-exploitation attacker.
(Optional) To reduce noisy SmartVision alerts, you can whitelist the alerts by traffic destination, traffic source, or rule.
For a summary of the configuration steps, see Task list for whitelisting noisy alerts.
(Recommended) Configure support for appliance system event notifications and distribution of scheduled SmartVision reports.
For a summary of the configuration steps, see Task list for configuring system event notifications and scheduled reports.
(Recommended) Configure the appliance to distribute SmartVision alerts.