The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Manage Trellix Application Data Monitor selection rules

  • Published on Sep 12, 2026
  • 1 minute(s) read
Prev Next

The system uses selection rules as filters to determine which packets a virtual device processes. You can add, edit, and delete selection rules.

Note

Place rules that will match the most packets first in the order. This reduces the average number of times a packet is parsed and therefor reduces CPU usage.

  1. From the Trellix ESM dashboard, click menu.png and select More Settings.

  2. On the system navigation tree, select the device and click Settings.png.

  3. Click Virtual Devices, then click Add.

  4. Add, edit, remove, or change the order of the selection rules in the table.

    Note

    There can be up to 4 Trellix Application Data Monitor interface filters. Each filter can only be applied to one Trellix Application Data Monitor virtual device at a time.

:
Related articles
  • Manage Trellix Application Data Monitor selection rules
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > Defining policies and rules > Rules > Trellix ESM rule types > Trellix Application Data Monitor rules
  • Add virtual devices
    Enterprise Security Manager > Enterprise Security Manager 11.7.x > ESM 11.7.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Virtual devices
  • Add virtual devices
    Enterprise Security Manager > Enterprise Security Manager 11.6.x > ESM 11.6.x Product Guide > PG - ESM - Tuning McAfee ESM > Tuning your ESM configuration > Virtual devices