Trellix

Importer Data Types

• Asset Details Enrichment and Create New in Vantage

  Trellix ePO supplies records including managed system hostname, IP and MAC addresses, OS type and version, agent product list, agent version, last-communication timestamp and managed status — to enrich existing Vantage assets and create new asset records for endpoints not yet observed on the OT network.

Joint Use Cases

• Correlating Trellix signals with OT network alerts

  When Nozomi Vantage raises an anomaly alert for a device inside an OT segment, the analyst can pivot to the same asset's Trellix ePO record in Vantage to review agent policy state, managed product version and recent compliance events, all without leaving the Vantage investigation workflow. This cross-layer correlation surfaces whether a network-layer anomaly coincides with activity observed by Trellix, reducing the time needed to confirm or dismiss an incident.

• Closing asset inventory gaps across IT and OT

  Devices recorded by Trellix ePO but not yet observed by Nozomi network sensors are automatically created as new asset records in Vantage, populated with hostname, OS, installed agent products and managed status drawn from the Trellix management plane. OT operations teams can audit the resulting unified inventory to identify unmonitored or underprotected assets in industrial and critical infrastructure zones, then prioritize sensor deployment accordingly.

• Validating endpoint-security agent coverage on OT-adjacent hosts

  Devices managed by Trellix ePO are joined with Vantage's network-observed inventory, surfacing endpoints that are network-active in OT-adjacent zones but are missing the Trellix agent.

Integration Prerequesites