Varonis DatAlert configuration

Select Configuration from the menu on the left.

Enter the IP address of the Trellix Comm Broker in the "Syslog server IP address" field.

Select Alert Templates from the menu on the left.

Click Edit Alert Template and select “External system default template”.

Select "Syslog message" from the “Apply to alert methods” menu.

Select Rules from the menu on the left.

Select “Syslog message” from the alert methods for any threat models you want to feed into Trellix Helix. This can be done individually, or in bulk. This setting also applies to predefined models and user-created models.

Click OK.