Viewing notification services enabled for alert types using the CLI

Follow these steps to view the mapping of network event types to Trellix event notification services using CLI commands.

Prerequisites

Admin or Operator access to the SmartVision appliance.

To view alert distribution settings using the CLI:

Log in to the appliance CLI and go to enable mode:
```
hostname > enable
```
Determine whether the appliance is in Helix mode. When a network event is detected by a SmartVision appliance in a Helix environment, the appliance makes the alert information available to Helix.
In this example, the appliamce is deployed in a Helix environment.
```
hostname # show helix
Helix Configurations:
Enabled : yes
Single Sign-On : allowed
Console URL : https://apps.fireeye.com/helix/id/abcdef123
Alert Sync Enabled : yes
Alert Sync From : 0 days old
Alert Sync Max Count : 10000
```

View the mapping of network event types to Trellix event notification services.

The following example shows the default alert distribution settings for a SmartVision-enabled Network Security sensor or integrated appliance. The ips‑event alert type is not used by SmartVision Edition appliances.

hostname (config) # show fenotify alerts
 
FireEye Notification Enabled: yes

FireEye Alerts:

                         email  http    rsyslog snmp    
                         --------------------------------
                 Global  yes    yes     yes     yes     
                         ----   ----    ----    ----    
domain-match        yes |yes    yes     yes     yes     
infection-match     yes |yes    yes     yes     yes     
ips-event           yes |no     no      yes     no     
malware-callback    yes |yes    yes     yes     yes     
malware-object      yes |yes    yes     yes     yes     
riskware-callback   yes |no     no      yes     no      
riskware-infection  yes |no     no      yes     no      
riskware-object     yes |no     no      yes     no      
smartvision-event   yes |no     no      no      no      
web-infection       yes |yes    yes     yes     yes     

   Digest notification:
                Time    : 12:00
                Enabled : yes

To determine which Trellix event notification services are enabled, check the values displayed in the Global row for the four notification protocol columns (email, http, rsyslog, and snmp).
In this example, all of the Trellix event notification services are enabled (set to yes).
A no value in a field means that the notification service is disabled and does not send notifications for any event type.
Note
When a network event is detected by a SmartVisionappliance in a Helix environment, the appliance makes the alert information available to Helix.