Self-Protection is a critical security layer that prevents malware from disabling your security software during an attack. By locking the product's infrastructure, it ensures defense remains active even during targeted attempts to stop Trellix processes.
Self-Protection ensures the following:
Stops malware from deleting binaries or configuration files.
Prevents unauthorized stoppage of Trellix processes.
Only an ePO administrator can change Self-Protection settings when the client interface is restricted.
Once enabled, Self-Protection secures the following components:
Files and folders: Prevents unauthorized changes to ENS for Mac binaries, databases, and configuration files.
Processes: Prevents the stoppage or termination of Trellix-related services.
Note
On the managed Mac system, these settings are controlled through policy. On a standalone Mac system, these settings can be changed locally through the ENS for Mac console. For standalone installations, Self-Protection is enabled by default. For managed systems, this feature is controlled through ePO workflows.
Make sure that the interface mode for the Trellix Endpoint Security (ENS) Client is set to Full access or log on to the Trellix Endpoint Security (ENS) Client as administrator.
Administrators can manage Self Protection settings through the Endpoint Security Common policy.
Log on to the Trellix ePO server as an administrator.
Select Menu → Policy → Policy Catalog.
Select Endpoint Security Common as the product and Options as the category.
Click the name of an editable policy and select Show Advanced.
In the Self Protection section, select Enable Self Protection.
Select the desired Action for Files and folders and Processes:
Block and Report: Prevents changes and sends an event to the Trellix ePO server.
Block only: Prevents changes without generating an ePO event.
Report only: Allows the change but logs the activity for auditing.
Click Save.
In the System Tree, select the target systems and click Wake Up Agents.
Select Force complete policy and task update to enforce the policy immediately.