In ESM, you can download and implement Content Packs that Trellix creates and distributes. This article describes how to implement Content Packs.
NOTES:
- Content Packs are compatible with ESM 11.x and later. Not all Content Packs are compatible with all ESM versions though. Always check the Content Pack documentation and confirm that it can be used with your SIEM installation.
- For a list of frequently asked questions about Content Packs, see KB84036 - FAQs for SIEM Content Packs.
Content Packs allow you to easily select, download, and deploy critical SIEM configuration settings. These settings are focused on monitoring use cases such as insider threat, data leakage, email content, firewall, malicious activity, malware, policy, reconnaissance, suspicious activity, web filtering, and authentication. These Content Packs are preconfigured to offer users fast access to advanced threat or compliance management capabilities.
A single Content Pack might contain combinations of one or more of the following components:
- Alarms
- Correlation Rules
- Reports and Report Layouts
- Variables
- Views
- Watchlists
To install Content Packs
Content Packs are automatically downloaded as part of the rules update process. If your ESM doesn't have external internet access, see the section below titled "To locate and install Content Packs from the Knowledge Base" for installation instructions.
- From the main ESM dashboard, click the System Properties icon in the upper-right corner.
- In the System Properties window, click the Content Packs tab on the left. All installed Content Packs are displayed here.
- Click Browse to see all available Content Packs.
- In the Browse Content Packs window, select any Content Packs that you want to install, and then click Install.
NOTES:
- You're asked what you want to do. You can roll out the policy with the Content Pack installations or install the Content Packs without a policy roll-out. You can also cancel at this point.
- When the Content Packs are installed, a status of Installed is shown in the Status column.
- After you review the information in the Install Complete window, click Close, and then Close again on the Browse Content Packs window.
- Installed Content Packs can be managed from the Installed Content Packs window.
To locate and install Content Packs from the Knowledge Base
When new Content Packs are released, a separate article for each Content Pack is added to the Knowledge Base. These articles contain the Content Pack in a .zip file, and detailed usage information in PDF form.
NOTE: The SIEM Content Pack articles are available only to registered ServicePortal users. You must log on to the ServicePortal to access them.
New Content Pack articles are added regularly. Follow the steps below to manually search for and install a Content Pack:
- To search for and download the Content Pack:
- Go to Trellix Support.
- On the Knowledge Center tab of the ServicePortal, type siem content pack in the Search Term field, and in the Match drop-down list, select Exactly.
- In the Product field, select SIEM - All Products.
- Click Search. The Content Packs are listed as REGISTERED – SIEM Content Pack for <product name>.
- Click a Content Pack link. This action opens the relevant article.
- In the "Attachment" section toward the bottom of the article, download the .zip file for the Content Pack.
- To add the Content Pack to the ESM:
- From the main ESM dashboard, click the System Properties icon in the upper-right corner.
- In the System Properties window, click the Content Packs tab on the left. All installed Content Packs are displayed here.
- Click Browse; then, on the Browse Content Packs window, click Import.
- Click Choose File, and browse to select the downloaded Content Pack .zip file.
- Click Upload.
- In the Browse Content Packs window, select the option any Content Packs that you want to install, and then click Install.
NOTES:
- You're asked what you want to do. You can roll out the policy with the Content Pack installations or install the Content Packs without a policy roll-out. You can also cancel at this point.
- When the Content Packs are installed, a status of Installed is shown in the Status column.
- After you review the information in the Install Complete window, click Close, and then Close again on the Browse Content Packs window.
- Installed Content Packs can be managed from the Installed Content Packs window.
How to change alarm components
You can change alarms within Content Packs to take more actions. For example, to send emails to recipients, tag systems within ePO, and execute remote commands. To change these settings:
- In the ESM system navigation tree, click System Properties, Alarms.
- Highlight the alarm that you want to change, and then click Edit.
- Make the necessary changes and Save your settings.
NOTE: Additional configurations made to alarms from Content Packs aren't carried over if the content pack is updated.
For more information about alarms, see the "Working with Alarms" section in the ESM online Help. To access online Help from within the ESM, click the help icon in the upper-right corner of the ESM windows, or click the Help menu on the ESM console.
How to change Correlation Rule parameters
To change Correlation Rules:
- Click the Policy Editor icon, and select Correlation under Rule Types.
- Highlight the Correlation Rule that you want to change, click Edit, and then click Modify. You can then change the logic or the parameters of the Correlation Rule.
- Save your settings after you make your changes.
For more information about Correlation Rules, see the "Correlation Rules" and "Example of custom correlation rule or component" sections in the ESM online Help. To access online Help from within the ESM, click the help icon in the upper-right corner of ESM windows, or click the Help menu on the ESM console.
How to change reports and report layouts
Content Packs can contain reports and report layouts. Report layouts are the templates for reports. You can change the look and content of the report by changing the layout to better suit your needs. For example, you can change a report to automatically run at a specific time, be sent to specific recipients, or be stored to specified/alternate locations.
To change the report:
- In the ESM user interface, click the Report icon.
- Select the report that you want to change and then click Edit. You can change the condition, time zone, date format, language, report format, and filters used in the report.
- To change the report layout, click the report name, and then click Edit.
NOTE: If a report doesn't exist, click Add in the Reports section. Select the report layout that you require under section 5 and then click Edit. (You can choose an existing report layout or create one to include with this report.)
- Save your settings after you make your changes.
For more information about reports and report layouts, see the following topics in the ESM online Help:
- Managing Reports
- Add a Report Condition
- Add a Report Layout
To access online Help from within the ESM, click the help icon in the upper-right corner of ESM windows, or click the Help menu on the ESM console.
How to change variables
Variables added through Content Packs can be changed to fit your organization's needs. To change a variable:
- Click the Policy Editor icon, and then select Variable.
- Locate the variable that you want to change, click Edit, and then click Modify.
- Save your settings after you make your changes.
For more information about how to manage variables and how to use them, see the "Variables" section in the ESM online Help. To access online Help from within the ESM, click the help icon in the upper-right corner of ESM windows, or click the Help menu on the ESM console.
How to change Views
You can change Views provided by Content Packs to change their appearance or the filters used with them. Any changes you make to the Views are reverted to default during an update to a Content Pack. You can create a version of the View to save your customizations. Views can be further filtered through the Filter pane on the right side of the screen. To change the view:
- Select the view, and then click Edit Current View.
- Select the component that you want to change, and click Edit Query.
- Save your settings after you make your changes.
For more information about how to manage views, see the "Manage views" section in the ESM online Help. For information about how to use filters, see the "Filtering views" section of the ESM online Help. To access online Help from within the ESM, click the help icon in the upper-right corner of ESM windows, or click the Help menu on the ESM console.
How to change Watchlists
You can add values to the lists of Static Watchlists provided by Content Packs. If a Content Pack is updated, values that you've appended to the Watchlist aren't carried over. To add more items to a Watchlist:
- Click the Watchlist icon, select the Watchlist that you want to change, and then click Edit.
- Click the Values tab, scroll to the bottom of the list, and add values at the end of the Watchlist.
NOTE: Specify only one entry per line.
- Save your settings after you make your changes.
For more information about Watchlists, see the "Watchlists" section in the ESM online Help. To access online Help from within the ESM, click the help icon in the upper-right corner of ESM windows, or click the Help menu on the ESM console.
