Investigation policy

The Investigation policy configures data collectors used for real-time searches in the EDR workspace. You can enable and manage plug-ins for system information, network flow, and file hashing on managed devices.

Real-Time Search

System Information

Option	Definition
Maximum number of results returned by Real-time Search	Sets the maximum number of results for a Real-time Search. Default: 512
Enable process history	Enables the Process History collector. This is enabled by default. Note To gather information using the Process History collector on Real-time Search, make sure Enable Process History is selected on the System info policy page. If the Enable Process History option is disabled in policy, it affects only Real-time Search, not the Historical Search and Device Search trace visibility.

Option

Definition

Maximum number of results returned by Real-time Search

Sets the maximum number of results for a Real-time Search.

Default: 512

Enable process history

Enables the Process History collector. This is enabled by default.

Note
To gather information using the Process History collector on Real-time Search, make sure Enable Process History is selected on the System info policy page. If the Enable Process History option is disabled in policy, it affects only Real-time Search, not the Historical Search and Device Search trace visibility.

Network Flow

Option	Definition
Enable Network Flow collector	Enables the Network Flow collector on the device. This is enabled by default.
Enable Network Sniffer	Configures granular network activity monitoring. This is disabled by default. When disabled, this also disables network triggers and collectors. This setting only affects real-time searches. Note Click Show advanced to display other policy options.
Collect TCP/UDP system process information (Windows Only)	Collects only the data from user space application connections. This is disabled by default. When enabled, it collects TCP/UDP connection data from system processes on Windows endpoints.
Maximum size of device storage that can be used by the Network Flow collector	Sets the size limit for the Network Flow collector database. When this limit is reached, older records are removed. Default: 120 MB Range: 0—8192 MB Note The specified maximum database size (MB) setting can take up to 7 days.
Maximum percentage of device storage that can be used by the Network Flow collector database	Sets the percentage of device storage the Network Flow collector database can use. Default: 2 percent Range: 1—100 percent
Maximum number of results returned by the Network Flow collector	Sets the maximum number of result rows returned by the Network Flow collector. Default: 512 Range: 64—8192

File Hashing

Option	Definition
Enable File Hashing on the device (enables the Files collector and trigger)	Enables the Files collector and trigger. This is disabled by default
Maximum size (MB) of the device storage that can be used by the File Hashing collector	Sets the database size limit for the Files collector. When the Max database size (MB) is exceeded, data about deleted files is removed. Default: 60 MB Range: 0—8192 MB
Maximum percentage of the device storage used by the File Hashing collector database	Sets the maximum storage percentage for the File Hashing plug-in database. When the Max database size % is exceeded, data about deleted files is removed. Default: 2 percent Range: 1—100 percent
Maximum number of results returned by the File Hashing collector	Sets the maximum number of rows returned by the the Files collector. Default: 512 Range: 64—8192
Hash strategy	Selects the priority of the file hashing process to manage device resource usage. Low — This is the recommended setting. Uses the least device resources. Normal — The operating system alone decides priority. Medium — Incremented priority. High — Top priority. Auto — Switches between Low and Normal strategies depending on device usage.
Pause File Hashing when the device is running out of battery life	Pauses file hashing when a device is on battery power to preserve battery life. This is enabled by default.
Delay File Hashing process after booting the device (seconds)	Sets a delay for the file hashing process after a system boot. Default: 120 seconds Range: 0—8192 seconds
Max file size for hashing (MB)	Sets the maximum size of files that will be hashed. Files larger than this are excluded. Default: 100 MB Range: 0—8192 MB

Exclusions

Configure exclusions for processes, files, and paths. Use a semicolon (';') to separate items, with a maximum limit of 3072 characters.

Option	Definition
Exclude process(es) by fullpath from collecting TCP/UDP information from Network Collection (Windows only)	Excludes processes from the Network Flow monitoring to reduce resource consumption and performance impact in systems that are web servers. The process name should be the full path of the executable. FOLDERID_* paths are supported. System Environment variables are not supported. Wildcards are not supported.
Exclude file(s) from File Hashing on Windows	Excludes a list of file paths. You can include complete file paths or use wildcards. Note All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity. For example: Full path C:\PAGEFILE.SYS Wildcards () C:\Windows\Temp\etilqs C:\Windows\Temp\etilqs** Note The asterisk () and double asterisk () wildcards are used to represent one or more characters and do not cross folder boundaries. You can use these system variables to specify the ignored files and paths: %systemdrive% %profilesdirectory% %windir% %commonprogramfiles% %commonprogramfiles(x86)% %comspec% %homedrive% %programdata% %programfiles% %programfiles(x86)% %public% %systemroot% %temp% %tmp% Trellix EDR only expands system user variables. The use of variables that point to user paths is not recommended. Avoid using the following variables: %allusersprofile% %appdata% %homepath% %localappdata% %userprofile% Under certain circumstances, endpoint users with administrator-level access can change the destination folders of system variables. Note If you must use system variables, you can create a Trellix EDR trigger that catches changes to system variables in the Windows Registry*. The trigger must be of WinRegistry type and watch for changes on this registry key: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment`.
Exclude file extension(s) from File Hashing on Windows	Excludes a list of file extensions. Place a '.' before each extension, separated by semicolons. Note All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity. For example, `.swap;.o;.temp;` Note Unless there is a reason to ignore a specific extension, only ignore those extensions that are repeatedly opened and modified.
Exclude path(s) from File Hashing on Windows	Excludes paths and folder names. You can specify folder paths in full or partially, using '' to replace the beginning of a path, or entering '' to ignore a folder regardless of the location. Note All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity. For example: `bar` excludes folders `bar` and `foobar` anywhere in the file system. `foo\bar` excludes the `bar` folder inside the `foo` and `snafoo` directories, anywhere in the file system. `C:\foo\bar\` excludes only the folder `bar` inside `C:\foo` directory. `C:\*\bar\` excludes one or more subdirectories where `bar` is found. For example, ignores `c:\foo\bar`, `c:\snafoo\bar`, and `c:\snafoo\foo\bar`. Warning When entering absolute paths, the trailing '\' is mandatory. Removing a path from the ignored list makes the path available for file hashing only after the device system is restarted. Until then, only newly created files are hashed at previously ignored paths. Windows operating system exclusions must start with a Microsoft "FOLDERID_" prefix. For more information, see Microsoft documentation "knownfolderid" for the the complete supported list. Directory paths are case-sensitive in the Ignore paths on Windows. Important When entering full paths, trailing slash is not mandatory. When a full path is provided, all files within the directory and all its directories are excluded.
Exclude file(s) from File Hashing on Linux	Excludes a list of file paths. File paths must be complete, indicating full path, file name, and extension. For example, `/etc/cma.d/lpc.conf;` You can use the following system variables to specify the ignored files and paths: `$BASH_VERSION` `$HOSTNAME` `$CDPATH` `$HISTFILE` `$HISTFILESIZE` `$HISTSIZE` `$HOME` `$IFS` `$LANG` `$PATH` `$PS1` `$TMOUT` `$TERM` `$SHELL` `$DISPLAY` `$EDITOR`
Exclude file extension(s) from File Hashing on Linux	Excludes a list of file extensions. Place a '.' before each extension, separated by semicolons. For example, `.swp;.o;.temp;`
Exclude path(s) from File Hashing on Linux	Excludes paths and folder name. You can specify folder paths in full or partially, using '' to replace the beginning of a path. For example: `bar` excludes folders `bar` and `foobar` anywhere in the file system. `*/bar` excludes the `bar` folder anywhere in the file system. `/foo/bar` excludes only the folder `bar` inside the `/foo` directory. Removing a path from the ignored list makes the path available for file hashing only after the device system is restarted. Until then, only newly created files are hashed at previously ignored paths.
Exclude file(s) from File Hashing on macOS	Excludes a list of file paths. You can use ';' as a separator.
Exclude files extension(s) from File Hashing on macOS	Excludes a list of file extensions. You can use ';' as a separator.
Exclude path(s) from File Hashing on macOS	Excludes paths and folder names. You can use ';' as a separator.