Setting up Trellix Application Data Monitor dictionaries

A dictionary is a plain text file that consists of one entry per line. There are single column and double column dictionaries. Double columns include a key and a value.

Keys can be IPv4, MAC, number, regular expression, and string. Value types are Boolean, IPv4, IPv6, MAC, number, and string. A value is optional and defaults to Boolean true if not present.

Values in a single or double column dictionary must be one of the supported Trellix Application Data Monitor types: String, Regular Expression, Number, IPv4, IPv6, or MAC. Trellix Application Data Monitor dictionaries must follow these formatting guidelines:

Type	Syntax Rules	Examples	Content Matched
String	Strings must be enclosed in double quotes Double quotes found in a String must be escaped using the backslash character before each quotation mark	“Bad Content” “He said, \”Bad Content\””	Bad Content He said, “Bad Content”
Regular Expression	Regular expressions are enclosed with single forward slashes Forward slashes and reserved regular expression characters in the regular expression must be escaped with the backslash character	/[Aa]pple/ /apple/i / [0–9]{1,3}\.[0–9]{1,3}\.[0–9]\.[0–9]/ /1\/2 of all/	Apple or apple Apple or apple IP addresses: 1.1.1.1 127.0.0.1 1/2 of all
Numbers	Decimal Values (0–9) Hexadecimal Values (0x0-9a-f) Octal Values (0–7)	Decimal Value Hexadecimal Value Octal Value	123 0x12ab 0127
Booleans	Can be true or false All lowercase	Boolean Literals	true false
IPv4	Can be written in standard dotted-quad notation Can be written in CIDR notation Can be written in long format with full masks	192.168.1.1 192.168.1.0/24 192.168.1.0/255.255.255.0	192.168.1.1 192.168.1.[0–255] 192.168.1.[0–255]

The following is true about dictionaries:

Lists (multiple values separated by commas enclosed in brackets) are not allowed in dictionaries.
A column can only consist of a single supported Trellix Application Data Monitor type. This means that different types (string, regex, IPv4) cannot be mixed and matched in a single Trellix Application Data Monitor dictionary file.
They can contain comments. All lines starting with the pound character (#) are considered a comment in a Trellix Application Data Monitor dictionary.
Names can only consist of alphanumeric characters and underscores, and be of a total length less than or equal to 20 characters.
Lists are not supported in them.
They must be edited or created outside of Trellix ESM with a text editor of your choice. They can be imported or exported from Trellix ESM to facilitate changing or creating Trellix Application Data Monitor dictionaries.