Trellix Network Security

Provides comprehensive, 100% visibility into all network traffic, protocols, and applications across data centers, hybrid clouds, branch offices, and corporate campuses, generating rich Layer 7 metadata.

Employs a robust combination of machine learning, AI, behavioral analytics (e.g., for lateral movement, beaconing, phishing credential theft, ICMP tunneling, similar URLs), signature-based technologies (Snort, YARA), and dynamic analysis (sandboxing) to detect known and unknown threats, including zero-days and advanced persistent threats (APTs).

Maps all detected attacker tactics and techniques to the MITRE ATT&CK framework, providing invaluable context for understanding and responding to threats.

Automatically enriches security alerts with crucial context such as MITRE ATT&CK mappings, CVE correlations, and threat intelligence, reducing manual investigation efforts.

Speeds up security operations with intelligent risk prioritization (considering asset criticality and vulnerability exposure), AI-powered alert summaries, recommended remediation steps, and intuitive dashboards (e.g., conversation graphs).

Offers 24x7 network traffic recording for deep incident investigation and the ability to capture specific packets around alerts, aiding in data exfiltration capture and forensic analysis.

Capable of decrypting and analyzing encrypted network traffic (SSL/TLS) to uncover hidden threats that might bypass traditional inspection.

Seamlessly integrates with other Trellix products like Endpoint Security (for endpoint containment), Network Forensics, and IPS, enabling multi-sensor correlation and unified security management (via Trellix ePO, SIEM/SOAR).

Leverages Generative AI (via Trellix Wise) to automatically generate alert summaries, identify top affected entities, and suggest specific remediation steps, streamlining analyst tasks and reducing alert fatigue.

Enriches alerts and asset details with vulnerability scan findings from platforms like Tenable Security Center, providing a holistic risk profile.

Supports various deployment models including on-premises, virtual, private, and public cloud, with different sensor options (Trellix Network Security (NX), Packet Capture (PX), Intrusion Prevention System (IPS)) to scale with network demands.

Leverages global threat intelligence (e.g., Trellix DTI Cloud) for file, IP, and URL reputation, continuously adapting to the evolving threat landscape.

Often includes or integrates with next-generation Intrusion Prevention System (IPS) functionality to detect and block sophisticated malware and attacks across the network in real-time.

Integrates with systems like Trellix Logon Collector (TLC) and Critical Asset Discovery (CAD) to provide user login context and critical asset classification, enhancing risk assessment.