It is required to integrate the Trellix DLP Network Monitor – SaaS appliance into your network using a SPAN port or network tap.
Enable the promiscuous mode on a portgroup or virtual switch to allow the appliance to passively inspect copies of all network packets that pass through the network.
On physical appliance, the capture port can be connected to a SPAN port or a network tap.
On a virtual appliance, the capture port is connected to a standard virtual switch or a portgroup on a distributed switch with the promiscuous mode enabled.