Because log data within an environment varies widely, Trellix Helix imposes a high-level standardized view of events and normalizes the data. This allows you to craft queries and to interact with the data in a more predictable, standardized way, such as searching and creating rules.
The Trellix Helix taxonomy serves as the “dictionary” for the Trellix Helix parsers that normalize the event data. Trellix Helix parses event data so that it is more easily compared and available to use as a pivot in searches.
This section covers the following topics: