# MPS

MPS: Appliance for detecting and blocking advanced threats through inline malware inspection. 

To onboard such a source to Axoflow, complete the [generic appliance onboarding steps](../../../../docs/axoflow/data-sources/appliances/index.md).

## Labels

Axoflow automatically adds the following labels to data collected from this source:

Analytics label | Message field | value  
---|---|---  
`vendor` | [`meta.vendor`](../../../../docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `trellix`  
`product` | [`meta.product`](../../../../docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `mps`  
  
You can use the labels as:

  * **Filter labels** on the [Analytics page](../../../../docs/axoflow/metrics/analytics/index.md),
  * in the **Filter By Label** field during [log tapping](../../../../docs/axoflow/onboard-hosts/log-tapping/index.md).



You can use the message fields

  * in [Flow Processing steps](../../../../docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
  * in AQL expressions in the search bars.



## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

sourcetype | source | index  
---|---|---  
`trellix:mps` | `trellix:mps` | `netops`