Trellix Insights Software - 1 Year Subscription + Support - 1 User

Trellix Insights provides the latest global intelligence on the top campaigns that threat actors are using to target business sectors and organizations around the world. You can view metrics for your business sector and geo-location and prevalence data for both targeted campaigns and specific security threats that might impact your organization. With this information, you can take preventive action to protect your organization.

Security Posture Score — View your current score based on these four attributes:
- Content verifies that the AMCore Content versions are sufficient to protect against known campaigns.
- Zero-day looks at Threat Intelligence Exchange and Real Protect related configuration and content.
- Configuration considers On Access Scan, Global Threat Intelligence, Access Protection, and Exploit Prevention.
- Detection Prevalence denotes the presence of unresolved campaign-related events on devices. It also considers the severity of those campaigns. For example, an unresolved event originated due to a HIGH Severity campaign leads to a lower Posture Score compared to an unresolved event originated due to a LOW Severity campaign.
Campaigns By Severity- View the number of campaigns detected based on the severity of each campaign — High, Medium, Low.

Campaign Detections -View the number of campaign-related detections in the last 10 days. Campaigns are detected in Insights Cloud using Campaign Intelligence from ATR/COAT for the incoming telemetry from your devices. Click the number of detections to view details about the Devices and Events page.

Devices- View the number of devices in your environment that are exposed and those that have insufficient AMCore content coverage for known campaigns. Click the number of systems affected to view details about the Devices and Events page.

The Campaigns trending globally pane has been replaced by a Defensive playbook pane on the vital metrics dashboard. This pane provides an overview on the defensive playbooks available in Trellix Insights and their recommended actions.
Campaigns -View detailed information about specific campaigns, your environment, and Indicators of Compromise (IoCs).
Threats -View detailed information about specific non-campaign threats and your network and environment.
Profiles- View detailed information about threat actors and tools profiled by Trellix.
Suspicious correlations- Highlight artifacts found in your environment which are not classified as either clean or malicious, but might be indirectly related to known threats or campaigns.
Defensive playbooks - View sets of tactics and methods that model your behaviors before, during, and after an attack.
Reports -Generate reports in PDF or CSV format that provide information about security posture score, number of campaign detections, devices with insufficient content and coverage, excluded devices, and the most prevalent campaigns across different sectors and countries.

LICENSE: Trellix Insights is licensed on a Per User basis, based on number of ENS endpoints being monitored. There is no license code required, as verification of usage is done through the Cloud connection. In other words, Trellix can measure, on the backend, exactly how many users are being monitored by the Insights extension.
DELIVERABLE: Enablement via cloud delivery or extension for ePO - On–prem or ePO - IaaS customers. Updates to Insights can be either through a new extension binary or can be Cloud – only, based on the capabilities being delivered.
REQUIREMENTS: Requires telemetry from ENS10.7 with Trellix Agent 5.6.x and management through ePO - On–prem (V5.10 CU7) or ePO - SaaS.
MANAGEMENT: Trellix Insights is managed via EPO ( ePO - SaaS, ePO - On–prem, ePO - IaaS ). Entitlement to EPO management component IS NOT included with this Subscription.
FEATURES: Trellix Insights PRIORITIZES threats that matter to you by PREDICTING if your countermeasures can detect & PRESCRIBING changes if countermeasures have insufficient coverage. It includes comprehensive Curated Cyber Intelligence Attack information on over 4 years’ worth of Campaigns, provided by Trellix Threat Research).
It also includes global detection comparisons among industry sectors and geographies, Trellix Technology detection information for all Campaigns, Security Posture Scoring for endpoints, Comparative Protection Efficacy Reports, as well as guidance on how to improve protection for endpoints. Guidance is provided through KB articles and ePO policy adjustments done by the users.
Trellix Insights requires Endpoint Security telemetry to function properly. If you do not want to provide this telemetry, you should not choose this product as you will not be able to receive full value. If you have questions, please contact your Trellix Account Team.
HIGHLY RECOMMENDED: Trellix EDR - due to available integration between Trellix Insights and the EDR. Premium Support and/or Services (e.g. Trellix Thrive Advanced or Elite)