Trellix Network Security

Additional features

Extended Network Visibility

Provides comprehensive, 100% visibility into all network traffic, protocols, and applications across data centers, hybrid clouds, branch offices, and corporate campuses, generating rich Layer 7 metadata.

Multi-layered Threat Detection

Employs a robust combination of machine learning, AI, behavioral analytics (e.g., for lateral movement, beaconing, phishing credential theft, ICMP tunneling, similar URLs), signature-based technologies (Snort, YARA), and dynamic analysis (sandboxing) to detect known and unknown threats, including zero-days and advanced persistent threats (APTs).

MITRE ATT&CK Alignment

Maps all detected attacker tactics and techniques to the MITRE ATT&CK framework, providing invaluable context for understanding and responding to threats.

Automated Alert Enrichment

Automatically enriches security alerts with crucial context such as MITRE ATT&CK mappings, CVE correlations, and threat intelligence, reducing manual investigation efforts.

Accelerated Investigation & Response

Speeds up security operations with intelligent risk prioritization (considering asset criticality and vulnerability exposure), AI-powered alert summaries, recommended remediation steps, and intuitive dashboards (e.g., conversation graphs).

Full Packet Capture (via Network Forensics/PX)

Offers 24x7 network traffic recording for deep incident investigation and the ability to capture specific packets around alerts, aiding in data exfiltration capture and forensic analysis.

SSL/TLS Decryption

Capable of decrypting and analyzing encrypted network traffic (SSL/TLS) to uncover hidden threats that might bypass traditional inspection.

Integration with Trellix Ecosystem

Seamlessly integrates with other Trellix products like Endpoint Security (for endpoint containment), Network Forensics, and IPS, enabling multi-sensor correlation and unified security management (via Trellix ePO, SIEM/SOAR).

AI-Powered Analyst Workflows

Leverages Generative AI (via Trellix Wise) to automatically generate alert summaries, identify top affected entities, and suggest specific remediation steps, streamlining analyst tasks and reducing alert fatigue.

Vulnerability Context Integration

Enriches alerts and asset details with vulnerability scan findings from platforms like Tenable Security Center, providing a holistic risk profile.

Flexible Deployment

Supports various deployment models including on-premises, virtual, private, and public cloud, with different sensor options (Trellix Network Security (NX), Packet Capture (PX), Intrusion Prevention System (IPS)) to scale with network demands.

Threat Intelligence Correlation

Leverages global threat intelligence (e.g., Trellix DTI Cloud) for file, IP, and URL reputation, continuously adapting to the evolving threat landscape.

Intrusion Prevention Capabilities

Often includes or integrates with next-generation Intrusion Prevention System (IPS) functionality to detect and block sophisticated malware and attacks across the network in real-time.

User & Asset Context

Integrates with systems like Trellix Logon Collector (TLC) and Critical Asset Discovery (CAD) to provide user login context and critical asset classification, enhancing risk assessment.