The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Detect TCP protocol anomalies and session hijacking

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

You can detect and alert on TCP protocol anomalies and check to TCP session hijacking using the Stream5 preprocessor variable.

  1. On the Trellix ESM console, click the Policy Editor icon GUID-D5AACD7D-9544-4011-8E37-D57FED1D7387-low.png.

  2. In the Rule Types pane, click Variable.

  3. In the Variables pane, expand the preprocessor group, then double-click STREAM5_TCP_PARAMS.

  4. On the Modify Variable page, add one of the following in the Value field:

    • To detect and alert on TCP protocol anomalies, add detect_anomalies after policy first.

    • To check for TCP session hijacking, add detect_anomalies check_session_hijacking after policy first.

Related articles
  • Detect TCP protocol anomalies and session hijacking
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > Defining policies and rules > Policies > Variables
  • Streaming policy
    Endpoint Detection and Response with Forensics (EDRF) > Configure EDRF policies
  • Protocol anomalies
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Trellix Enterprise Security Manager - Application Data Monitor
  • Protocol anomalies
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Trellix Enterprise Security Manager - Application Data Monitor