FIPS mode in Trellix EDR with Forensics

Trellix EDR with Forensics provides a Federal Information Processing Standard (FIPS) mode for environments requiring high-level security. This mode follows the security guidelines detailed in FIPS 140-2 for Trellix EDR and Endpoint Security (HX).

In FIPS mode, Trellix EDR with Forensics:

Enforces constraints on allowed security methods.
Performs integrity tests on startup.
Restricts connections to FIPS-validated devices only.

The cryptographic boundary

FIPS validation requires an explicitly defined continuous perimeter that establishes the physical bounds of a cryptographic module.

The cryptographic boundary defines this perimeter and contains the set of hardware, software, and firmware that implements valid security functions. Only the approved set of interfaces can access the cryptographic modules inside the cryptographic boundary. No other mechanism is allowed or provided when in FIPS mode.

Modules in the boundary perform these processes:

FIPS-validated security methods performing cryptography, hashing, and related services running in Trellix EDR
Startup and verification testing needed by FIPS
Extension and executable signature verification
TLS connection management
Cryptographic API wrapping

Trellix EDR with Forensics feature status in FIPS mode

Feature status	Description
Features not available in FIPS mode	When FIPS mode is enabled on the Windows endpoints, Trellix EDR with Forensics disables or ignores the MD5 hash usage. The following dashboards show the behavior of the MD5 hash value: Real-time Search Collectors return a blank MD5 hash value. Reaction KillProcessByHash ignores the MD5 hash argument. You can use SHA-1 and SHA-256 hash arguments if they are set. If the query contains a condition using an MD5 hash value, it is ignored and returns all results. For example — in the search query, if you run `HostInfo hostname and Files where Files full_name starts with "C:\programData" and Files md5 equals "CD72F833324EB756ED7594DC3C177B29"`, the condition `files md5 equals "CD72F833324EB756ED7594DC3C177B29"` is ignored and returns all files full name that starts with "C:\programData". Monitoring and Investigating — MD5 hash displays no value. Device Search — on the MD5/SHA-256 column, SHA-256 is displayed on priority. If SHA-256 hash is not available, MD5 hash returns a blank value. Historical Search — MD5 hash returns a blank value.

Feature status

Description

Features not available in FIPS mode

When FIPS mode is enabled on the Windows endpoints, Trellix EDR with Forensics disables or ignores the MD5 hash usage. The following dashboards show the behavior of the MD5 hash value:

Real-time Search
- Collectors return a blank MD5 hash value.
- Reaction KillProcessByHash ignores the MD5 hash argument.
  You can use SHA-1 and SHA-256 hash arguments if they are set.
- If the query contains a condition using an MD5 hash value, it is ignored and returns all results.
  For example — in the search query, if you run HostInfo hostname and Files where Files full_name starts with "C:\programData" and Files md5 equals "CD72F833324EB756ED7594DC3C177B29", the condition files md5 equals "CD72F833324EB756ED7594DC3C177B29" is ignored and returns all files full name that starts with "C:\programData".

Monitoring and Investigating — MD5 hash displays no value.
Device Search — on the MD5/SHA-256 column, SHA-256 is displayed on priority. If SHA-256 hash is not available, MD5 hash returns a blank value.
Historical Search — MD5 hash returns a blank value.

For more information, see Deploy EDRF in FIPS mode.