Trellix DLP implementation

Trellix^® Data Loss Prevention is a suite of products deployable and manageable through ePolicy Orchestrator^TM - On-prem, which enables sharing of common policies and provides incident and case management for network and endpoint data loss prevention products.

The Trellix DLP extension is installed on the ePO - On-prem server. It manages the policies and data analysis for all Trellix DLP applications. It is the starting point for all deployments.

Trellix DLP extension

1	ePO - On-prem server — Hosts the embedded Trellix DLP software and the DLP Classification, DLP Incident Manager, DLP Operations, and DLP Case Management.
1a	Administrator workstation — Accesses ePO - On-prem and the Trellix DLP module consoles in a browser.
1b	ePO - On-prem database.
1c	Evidence storage — Stores an encrypted copy of the content that was blocked or monitored.

Optional components

2	Managed endpoints — Apply the security policies using the Trellix Data Loss Prevention Endpoint client software.
3	Trellix Data Loss Prevention Discover servers (physical or virtual) — Scan network repositories and databases, classify data, and apply security policies (remediation).
3a	Trellix DLP Discover local or cloud repositories.
4	Trellix Data Loss Prevention Network Prevent appliance (physical or virtual) — Analyzes email and web traffic and applies security policies.
4a	Email gateway and web gateway.
5	Trellix DLP Network Monitor appliance (physical or virtual) — Acquires network packets through a network tap, monitors network traffic, and applies security policies.

Basic Trellix DLP deployment with options