In addition to providing properties that are common across most protocols, Trellix Application Data Monitor also provides protocol-specific properties that can be used with Trellix Application Data Monitor rules.
Examples of protocol-specific properties
These properties apply to these tables:
* Detection only
** No decryption, captures X.509 certificates and encrypted data
*** Via RFC822 moduleFile transfer protocol modules
FTP | HTTP | SMB* | SSL** |
|---|---|---|---|
Display Name File Name Host Name URL | Display Name File Name Host Name Referrer URL All HTTP headers | Display Name File Name Host Name | Display Name File Name Host Name |
Email protocol modules
DeltaSync | MAPI | NNTP | POP3 | SMTP |
|---|---|---|---|---|
Bcc*** Cc*** Display Name From*** Host Name Subject*** To*** | Bcc Cc Display Name From Host Name Subject To User Name | Bcc*** Cc*** Display Name From*** Host Name Subject*** To*** | Bcc*** Cc*** Display Name From*** Host Name Subject*** To*** User Name | Bcc*** Cc*** Display Name From*** Host Name To*** Subject*** |
Webmail protocol modules
AOL | Gmail | Hotmail | Yahoo |
|---|---|---|---|
Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** |
Webmail protocol modules
AOL | Gmail | Hotmail | Yahoo |
|---|---|---|---|
Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** | Attachment Name Bcc*** Cc*** Display Name File Name Host Name From*** Subject*** To*** |