Frequently asked questions

Here are answers to frequently asked questions.

What features are enabled with which license?

What are these features?

What is the execution decision flow of Application Control?

For more information about execution decision flow of Application Control, see KB85695.

Which one takes precedence in monitoring (file, user, or folder)?

The order of precedence is considered as listed:

Why do I get an error when I try to save changes in ePO - On-prem to my policy?

ePO - On-prem currently does not limit but alerts the user if large number of policies are selected to be applied. An error is displayed when saving the policy if larger than the set limit.

By default, ePO - On-prem in the server.xml tomcat is limited to take http post req of maxi size 2 MB.

If you need to increase this size, perform the following steps:

Do we have any best practices for deploying Application Control in a Cluster Shared Volumes (CSV) environment?

Before deploying Application Control in a CSV environment, review the guidelines listed in KB84258.

How to handle Memory Leak from scsrvc.exe (User-mode)

Before you start collecting traces, you need to define how long it takes for the Application Control process to consume all available RAM from the Operating System, so you can divide the time and use it to capture 4 traces. Also, enable the advanced debugging for scsrvc.exe in Gflags tool (Global Flags Editor).

Gflags tool is included in Debugging Tools for Microsoft Windows. For more information, see Download Debugging Tools for Windows.

Once the debugging kit is installed, the tool (gflags.exe) is saved in: C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 for Systems running 64 bits Windows or C:\Program Files (x86)\Windows Kits\10\Debuggers\x86 running 32-bits version of Windows.

In addition, you need poolmon.exe which is also part of the debugging tools, and procdump.exe which can be downloaded from Microsoft Sysinternals tool website. For details, click here.

Note

If the debugging package is installed while the product is in Update mode, all tools are solidified. But, if you are copying the tool from another system or downloading while the product is in Enabled Mode, solidify the tools or change the product to Update Mode. Otherwise the execution is denied.

Instructions to start the advance trace for scsrvc.exe:

Scenario for data collection: If scsrvc.exe takes 48 hours to reach 4-GB RAM (all available RAM), you can reduce the trace time, because the 0-GB trace does not have enough info and 4-GB RAM trace might be hard to capture as the system might be in a crash state. So, in case, you remove 8 hours, in total we have 40 workable hours to capture 4 traces.

Every 10 hours, you must capture: poolmon and process dump (procdump) at the same time, using these commands:

How to handle memory Leak from Solidcore Tags (Kernel Mode)

In kernel mode, Solidcore tags name start with: Q*.

This issue is exhibited when these tags don't release allocated memory, which leads to system crash and the only way to recover is by rebooting it.

Before collecting any trace, you need to configure your system to generate full memory dump, and this is due to the nature of the issue, no User-mode processes exhibit high consumption generally.

Following instructions to force a system crash by pressing a combination of keys. For instructions, click here.

When configuring the dump options in Control Panel > System and Security > System. Click Advanced system settings. Under Startup and Recovery, click Settings. Select Complete Memory Dump in Write Debugging Information.

Like the user-mode scenario, you can define a time frame to capture 4 poolmon, and a full memory dump (forced through keyboard) when the system crashes or is unresponsive.

How to manually Purge data from ePO - On-prem?

Application Control and Change Control collects and store information from all endpoints. This information can be categorized as: events, inventory, and Policy Discovery. Trellix Recommends that after all data is reviewed by the Solidcore Administrator, it needs to be purged to avoid data redundancy and performance degradation on the database caused by the product extension.

Before you purge any data related to Application Control and Change Control, you need to know-how much space this data would occupy and grow on your database. For that, Trellix has created a database sizing guide which helps you to identify the amount of data the product stores. For details about ePO - On-prem database sizing recommendations to manage Application Control 6.2 and later, see KB83754.

From ePO - On-prem, all purging tasks can be created and scheduled from Server Tasks:

The following schedule frequencies need to be adapted in compliance with your company auditing and data restore policies:

How to delete data directly on ePO - On-prem database

Events — Solidcore client normally generates two events, and one is forwarded to EPOEvents table and the other one to SCOR_EVENTS table. Hence events need to be clean from both tables:

For example, today is 24 May 2020, and I want to remove events 90 days old, then both queries should be:

Alerts:

For example, today is 24 May 2020, and I want to remove events 90 days old, then the query should be:

Content tracking:

For example, today is 24 May 2020, and I want to remove events 90 days old, then the query should be:

Policy Discovery — The Policy Discovery information is stored in 4 different tables on the database:

To delete the data — DELETE from SCOR_VW_SCOR_SA_REQUEST where '2020-05-25T09:35:10.367' > SCOR_VW_SCOR_SA_REQUEST.DETECTED_UTC.

Solidification FAQs

What files do we solidify?

How to view scripts that can be solidified?

Run the following command to view scripts:

Sadmin Scripts list

How to determine if something is Solidified (on the allow list)?

Run the following command to list solidified items:

Sadmin ls

Run the following command to list unsolidified items:

Sadmin lu

Run the following command to get advanced details about a file:

Sadmin ls - lax

What hashes are collected in inventory?

Hashes collected for Solidcore version 7.x or earlier:

Hashes collected for Solidcore version 8.x or later:

What is collected in Solidcore inventory file?

Inventory file contains details such as hash, reputation, and location.

Where can you view your client inventory?

On the ePO - On-prem console, select Menu → Application Control → Inventory.

What is the function and specific use cases for each skiplist?

You can add skip rules using the sadmin skiplist add command and specify the needed arguments to skip path components from several features such as monitoring, write protection, file operations and script-auth, allow list, and Application Control.

Monitoring

Skiplist -c is used predominately in the Update mode to disable monitoring on files. This can be used to quiet events from showing up in TACC events. Think of a more powerful filter built into operate while in the Update mode.

Write protection

Skiplist -d is used to deny write passthrough attribute. This skiplist removes write protection from a file allowing it to be changed by any source.

Skiplist -r creates a registry path passthrough attribute. This process allows an application to modify the registry.

File operations and script-auth

Skiplist -f is used to create file operations passthrough. This rule allows you to create, modify, and delete files regardless of solidification. It will not allow you to overwrite links and rename files.

Skiplist -i or ignore passthrough attribute, ignores path, and works similar to a skiplist -f.

Allow list

Skiplist -s is a process used to bypass the solidification status of a file. This process also unsolidifies files.

Application Control

Skiplist -v is used to exclude a volume or drive from being allow listed.

What is an Alternate Data Stream (ADS)? Does Change Control monitor changes to ADS?

On the Microsoft NTFS file system, a file consists of multiple data streams. One stream holds the file contents and another contains security information. You can create alternate data streams (ADS) for a file to associate information or other files with the existing file. In effect, alternate data streams allow you to embed information or files in existing files. The ADSs associated with a file do not affect its contents or attributes and are not visible in Windows Explorer. So, for practical purposes, the ADSs associated with a file are hidden. Malicious users can misuse the ADS feature to associate malicious files with other files without the malicious files being detected.

Change Control monitors changes to any ADS associated with files on Windows platforms. For a monitored file, ADS-related changes, including stream creation, modification, update, deletion, and attribute changes are reported as events. If you are also using Application Control, the base file name is retrieved and permissions for the base file are checked when an ADS is invoked. The ADS is allowed or denied execution based on the permissions of the base file and current mode of Application Control. Also, any executable programs (associated as an ADS with an existing file) are prevented from running. To disable ADS monitoring, execute the SC: Run Commands client task to run the sadmin features disable mon-ads command on the endpoint.

Why am I not receiving the events for user account activity for an endpoint?

User account activity is not tracked by default for endpoints. To track operations for user accounts, you must enable this feature specifically on endpoints where Change Control is deployed and enabled. To enable this feature, execute the SC: Run Commands client task to run the sadmin features enable mon‑uat command on the endpoint.

In addition, you must make sure that the Audit Policy is configured on the Windows operating system to allow generation of user activity events.

To successfully track user account activity for an endpoint, verify the Audit Policy configuration for the endpoint.

What are the implications of recovering the local CLI access for an endpoint?

To troubleshoot or debug issues, you might need to recover the local CLI access for an endpoint. Recovering the local CLI for an endpoint prevents the enforcement of policies from ePO - On-prem to the endpoint. This implies that when the CLI is recovered for an endpoint, no existing or new policies (created on the ePO - On-prem server) are applied to that endpoint.

What is the significance of the label specified in a policy while configuring updater processes, installers, and users?

The specified labels help you correlate the generated events with the actions performed by the trusted resources. For example, when an event is generated for an action performed by a trusted user, the Workflow ID attribute for the event includes the label specified for the trusted user.

How do I unsolidify a file, directory, or volume?

To unsolidify a file, directory, or volume, run the SC: Run Commands client task with the sadmin unso <resource name> command.

Note

As a best practice, do not unsolidify a system drive or volume.

I recently fetched inventory for an endpoint but can't review GTI ratings for the inventory items. What can I do?

If GTI ratings are unavailable for inventory items after you fetched inventory, review the logs generated by the Fetch File Details from Trellix GTI Server and Fetch Certificate Reputation from Trellix GTI Server server tasks on the Server Task Log page. Log entries are added atypically for the Fetch File Details from Trellix GTI Server server task to the Server Task Log page.

So, on the Server Task Log page, you might see fewer entries indicating task success and multiple entries indicating failure for this task.

Do Change Control and Application Control work in Network Address Translation (NAT) environments?

If the ePO - On-prem server can communicate with the Trellix Agent in a NAT environment, Change Control and Application Control work.

How can I trust applications developed for use in my organization?

Sign the applications with a self-generated certificate, then trust the certificate.

Can I script sadmin commands?

Yes, you can script sadmin commands. While recovering the CLI, you are prompted to enter to password. To achieve this in a script, suffix the sadmin recover command with -z <password>.

How can I resolve discrepancies and inconsistencies in the Solidcore rule groups after upgrading the Solidcore extension? When I access the Rule Groups page, an Internal Server Error is displayed.

Run the Rule Group Sanity Check server task from the ePO - On-prem console to fix the inconsistencies in the rule groups. This server task reports and corrects (if possible) discrepancies and inconsistencies in the Solidcore rule groups and policies.

How do I manage the predefined rules available with Change Control and Application Control?

Revisit the predefined rules available with Change Control and Application Control when you install or upgrade the Solidcore extension. Because the software installed on the endpoints in your enterprise might change (is added or removed), you must revise the rules periodically. Based on the software installed on the endpoints in your setup, revise the rules and remove unwanted or irrelevant rules.

How can I enable or disable selected features on endpoints from the ePO - On-prem console?

Use the Application Control Options (Windows) policy to enable or disable selected features on endpoints from the ePO - On-prem console.

How can I implement change reconciliation and ticket-based enforcement in my setup?

Change reconciliation correlates change events from monitored systems with tickets in your change management system (CMS). This correlation categorizes events as authorized or unauthorized based on whether the change was made during an update window. This information is used for change tracking and compliance reporting. Ticket-based enforcement allows you to automatically open update windows on systems protected with Application Control and Change Control by integrating with your CMS. Based on tickets created in the CMS, update windows open on the protected systems to allow modification of protected files and registry keys. Implementing ticket-based enforcement reduces system outages and improves uptime by allowing only approved changes to the systems.

Perform these steps to configure and implement change reconciliation and ticket‑based enforcement.

After I deploy Application Control, how can I check the status of the memory protection techniques, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), provided by the Windows operating system?

Here are the possible values for DEP and ASLR.

The software is allowing the execution of a banned file. What could be the reason?

When defined rules are applied, the software combines or aggregates the rules defined for a file. When applying the rules, it uses the following order to determine whether the file execution is allowed or blocked. The order in which the methods are listed indicates the precedence the software applies to the method.

If none of the above apply for a file, the software blocks the execution of the file.

The ePO - On-prem interface is slow or unresponsive and count of observations on the Predominant Observations page is high. What is the cause and how can I resolve this problem?

Application Control includes predefined rules to filter non-relevant and unnecessary observations you receive from endpoints. The rules are included in the Observation Filter Rules (Deprecated) rule group (shipped with the product). By default, these rules are applied to the global root in the System Tree and hence are inherited by all ePO - On-prem-managed endpoints.

If you remove this rule group, you might receive many observations that cause the ePO - On-prem interface to be slow or unresponsive. Review your setup and make sure that this rule group is applied to the endpoints.

How can I check the solidification or allow listing status for an endpoint?

Perform these steps to review the solidification or allow listing status for an endpoint.

How can I apply multiple policies to one node in the System Tree?

Perform these steps to apply multi-slot policies to a group or specific endpoints.

I am trying to fetch the software inventory for an endpoint, but the SC: Pull Inventory client task fails and I receive a message that the inventory cannot be fetched. What is the reason and how can I fetch the inventory successfully?

By default, you can fetch the inventory for an endpoint once in seven days. This value is set as the minimum interval between consecutive inventory runs. But, if needed, you can configure this value for your enterprise. See Configure settings for fetching the inventory.

What is the difference between custom action and taking global actions for a request?

For selected endpoints, to define custom rules to allow, ban, or allow by certificate an application or executable file, use the Create Custom Policy action. You can also define custom rules to allow a network path for selected endpoints. But, to allow, ban, allow by certificate an application or executable file globally (on all endpoints in your enterprise), or to allow a network path globally, take global actions.

I am using the Number of Systems where Throttling Initiated in Last 7 days monitor on the Health Monitoring dashboard. Why is no data visible when I select List events that initiated throttling for a system link?

When you select the List events that initiated throttling for a system link, the Events page lists events that resulted in the generation of the Data Throttled or Data Dropped events. The list includes all events that were generated in the 7-days period before receiving the Data Throttled or Data Dropped events.

In these two scenarios, the Events page does not list any data.

Also, the same scenario can occur for policy discovery requests (observations) and inventory updates.

I want to change the value of a configuration parameter for a managed endpoint. I cannot find a policy or method to complete this from the ePO - On-prem console. How can I complete tasks for which no method is available on the ePO - On-prem console?

From the ePO - On-prem console, you can use the SC: Run Commands client task to run any CLI commands remotely on one or more endpoints. The commands can include tasks that can or cannot be completed using ePO - On-prem, such as enable or disable the product, change the value for configuration parameters, or fetch the software inventory.

How can I lock down or recover the local CLI for managed endpoints?

By default, the local CLI is locked down for ePO - On-prem-managed endpoints. But, you can recover the CLI for one or more endpoints, if needed.

Important

When you recover the CLI, any changes to configuration, policies, tasks pushed from the ePO - On-prem server are not enforced on the endpoint. So, the CLI status must be set to Restrict to enforce any changes to the endpoint.

I seem to have run into issues while applying a content update package in my setup. How can I resolve this?

If the ePO - On-prem server is temporarily unavailable when a content update is being applied, you might run into issues. We recommend that you wait until the update is applied. Review the Content update for Application Control and Change Control entry on the Server Task Log page to verify if the content update was applied successfully. If the issue isn't resolved or the update status is failed, contact Trellix Support for assistance.

I am trying to access a page and it displays the Content update is in progress warning message. Why is this happening?

We can now automatically push content updates for Application Control and Change Control through the ePO - On-prem console. This eliminates the need for customers to apply hotfixes for configuration changes, such as rules, policies, or Trellix GTI settings. For example, any changes to the Trellix GTI settings or certificate are automatically applied in your setup.

When a content update is being applied, you should not make any changes to existing rules and configuration. The warning message is displayed while the content update is being applied and disappears after the update is complete. For every content update that is applied, a corresponding Content update for Application Control and Change Control entry is added to the Server Task Log page. You can review the entry for details of the changes made.

How can I view the reputation for a specific file on an endpoint?

To view the reputation for a specific file on an endpoint, fetch the file reputation from a source (TIE server, Trellix GTI, or Intelligent Sandbox), as applicable. But, make sure that the reputation setting is enabled in Application Control (Options)policy applied to the endpoint. For more information about how to enable reputation settings, see Configure reputation settings.

Use the SC: Run Commands client task to run this command on the endpoint.

sadmin getreputation [ -v | -b ] -f <filename> -m <md5> -h <sha-1> -s <reputation-source>

You must specify MD5 and SHA-1 value for a file to fetch its reputation. But, if you also specify the file name with its MD5 and SHA-1 value, the file name is considered for fetching the reputation.

This table lists the supported arguments and their description.

How can I recover the CLI for an endpoint if the CLI is disabled after multiple incorrect password attempts?

If the CLI is disabled after multiple incorrect password attempts, there are two methods to recover the CLI:

When the CLI is recovered, the Recovered Local CLI event is sent to the ePO - On-prem console to notify the administrator.

I am reviewing inventory items and can see the Inventory for one or more systems could not be processed. Increase memory allocated for Java Virtual Machine. message. How can I resolve this?

Starting with the 8.0.0 release, Application Control can process large volume of inventory items. If inventory cannot be fetched from an endpoint due to lack of Java Virtual Machine memory on the server, the Inventory for one or more systems could not be processed. Increase memory allocated for Java Virtual Machine. message is displayed on the By Applications and By Systems pages. To resolve this, complete these steps:

When using Application Control and Change Control, which features and workflow support SHA-1 and SHA-256?

Starting with the 8.0.0 release, we have added support for file SHA-256 values (for the Windows platform). This table lists how existing features and workflows use SHA-1 and SHA-256 values.

Except when stated, all other Application Control and Change Control workflows are based on file SHA-1 values. In other words, the linking between events (on Solidcore Events page), file details (on Inventory pages), and requests (Policy Discovery page) are based on the file's SHA-1 values.

I recently fetched inventory for an endpoint and need to fetch inventory for it again. How can I do this?

For Application Control, the minimum interval between consecutive inventory runs (when the inventory information is fetched from the endpoints) is set to seven days. This is the default value and implies that for an endpoint you can pull inventory once a week. But, if needed, you can configure this value for your enterprise. See Configure settings for fetching the inventory.

One of these happen when you fetch inventory for an endpoint:

I received the Unable to Recover Inventory event for an endpoint. What can I do?

The Inventory Corrupted event is generated for an endpoint if the internal inventory for the endpoint is corrupt. Application Control maintains inventory backup for the endpoint and recovers the inventory for the endpoint from the backup copy.