A device class is a collection of devices that have similar characteristics and that can be managed in a similar manner.
Device classes name and identify the devices used by the system. Each device class definition includes a name and one or more globally unique identifiers (GUIDs). For example, the Intel® PRO/1000 PL Network Connection and Dell wireless 1490 Dual Band WLAN Mini-Card are two devices that belong to the Network Adapter device class.
Note
Device classes are not applicable to macOS devices.
How device classes are organized
The DLP Policy Manager lists predefined (built-in) device classes on the Definitions tab under Device Control. Device classes are categorized by status:
Managed devices are specific plug-and-play or removable storage devices that Trellix Device Control manages.
Unmanaged devices are devices Trellix Device Control doesn't manage in the default configuration.
Excluded devices are devices that Trellix Device Control doesn't try to control, such as battery devices or processors.
To avoid potential system or operating system malfunction, the device classes can't be edited. They can be duplicated and changed to add user-defined classes to the list.
Tip
Do not add a device class to the list without first testing the consequences. In the Policy Catalog, use the DLP policy → Device Classes → Settings tab to create temporary device class overrides to device class status and filter type settings.
Overrides can be used for testing user-defined changes before creating a permanent class, and troubleshooting Trellix Device Control problems.
Trellix Device Control uses device definitions and plug-and-play Trellix Device Control rules to control the behavior of managed device classes and specific devices belonging to a managed device class. Removable storage device rules, do not require a managed device class. The reason is related to the different way the two types of device rules use device classes:
Plug-and-play device rules are triggered when the hardware device is plugged into the computer. Since the reaction is to a device driver, the device class must be managed for the device to be recognized.
Removable storage device rules are triggered when a new file system is mounted. When this occurs, the Trellix Device Control client associates the drive letter with the specific hardware device and verifies the device properties. Since the reaction is to a file system operation (that is, when the file system is mounted) the device class does not need to be managed.