Trace policy configuration

You can use the Trace policy tab to configure the Trace plug-in on managed devices. Event information is sent to Trellix EDR and displayed on the Historical Search and Device Search dashboards. This information helps you determine how threats and potential threats move through your environment.

(Linux only) For the Linux kernel version 3.15 or earlier, the Linux trace functionality can't co-exist with auditd:

If auditd is running, enabling the Linux trace functionality stops the audit service.
To start the auditd service, the trace functionality must be disabled before restarting the auditd service.

The audit system must not be in immutable mode to use trace functionality. Otherwise, trace process will not be able to add the audit rules.

Note
The audit flag to set failure must not be set to "2" (2=panic). If set, it can cause the kernel panic once the backlog limit exceeds.

Trace Scanner option definitions

Option	Definition
Enable the Trace	This option is enabled by default. Enables the Trace plug-in on the endpoints.
Log Level	Specify the level of information to include in the Trace log file. Selecting an option includes that information and all options under it. For example, selecting the Trace log level includes trace, info, warning, and error information. Use the lowest log level when possible, or disable this feature if you do not need log information. Debug — Detailed debug information. Trace — Contains most variable value dumps. This can be too verbose to debug problems on production systems. Info — Logs messages that highlight the progress of the Trace plug-in. Warning — Information about potentially harmful situations. Error — Error events that might prevent the Trace plug-in from running. The Trace log file is located at the following location: Windows — `%PROGRAMDATA%\McAfee\Mar\data\trace.log` Linux — `/var/McAfee/mvedr/data` mac — `/var/McAfee/mvedr/data/trace.log`
Report internal reputation failures to ePO - On-prem or ePO - SaaS	This option is disabled by default. When enabled, the Trellix EDR client reports a ePO - On-prem or ePO - SaaS threat event due to internal connection issues for the Trace plug-in.
Enable deep inspection of Windows API calls	This option is enabled by default. Deep inspection of Windows API Calls' enables the code injection detection plug-in of the Trellix EDR agent. Enabling this feature in the Trellix EDR client extension UI turns the feature On at the agent and allows it to monitor 3rd party code injection into processes and inspect the application usage of windows APIs. This provides further telemetry information to be collected and used for threat detection.
Maximum size (MB) of the device storage that can be used by the Traces	The size limit for the Trace database on the device. When this limit is reached, oldest records are discarded from the database. The default value set is 80 MB. The minimum and maximum value you can set is between 0 MB and 8192 MB. Note Click Show advanced to display other policy options.
Interval (in seconds) to send trace events to Trellix EDR cloud	Specifies how often (in seconds) to send trace event notifications. The default value set is 30 seconds. The minimum and maximum value you can set is between 30 and 1800 seconds.
Include all ImageLoad events on Windows	This option is disabled by default. When enabled, this feature provides DLL load events only for CLI (Command-Line Interface) processes. The list of monitored processes and DLLs is updated internally by Trellix with each release.
Disabled trace rules on Windows (Use ';' as separator) (max: 3072 characters)	Enter configuration code that can enable or disable trace rules by ID. We recommend that you enter information in this text box only when working with a Technical Support representative.
Exclude process(es) by full path on Windows (Use ';' as separator) (max: 3072 characters)	Excludes a list of full paths (using folder id). If the path matches the one on a binary, the binary being executed will not be traced. The supported paths are the following: Full path FOLDERID_* style paths Paths with System environment variables. User environment variables are not supported. Wildcards are also supported. <Folder>* would include all processes within the folder and all its subdirectories.
Exclude file(s) on Linux (Use ';' as separator) (max: 3072 characters)	Excludes files and processes from being traced. Example — `/var/spool/cron/testfile.txt` The supported paths are following: Full path Wildcards are not supported
Exclude folder(s) on Linux (Use ';' as separator) (max: 3072 characters)	Excludes folders from being traced. Example — `/var/spool/cron/testdir1;/var/spool/cron/testdir2/dir3` The supported paths are following: Full path Wildcards are not supported
Disabled trace rules on Mac (Use ';' as separator) (max: 3072 characters)	Enter configuration code that can enable or disable trace rules by ID. We recommend that you enter information in this text box only when working with a Technical Support representative.
Exclude process(es) by full path on Mac (Use ';' as separator) (max: 3072 characters)	Excludes a list of full paths (using folder id). If the path matches the one on a binary, the binary being executed will not be traced. The supported paths are the following: Full path FOLDERID_* style paths Paths with System environment variables. User environment variables are not supported. Wildcards are also supported. <Folder>* would include all processes within the folder and all its subdirectories.

AWS S3 option definitions

Option	Definition
Send traces to Trellix EDR cloud	This option is enabled by default. Sends traces collected on the endpoint to Trellix EDR cloud. This feature is enabled by default.
Send traces to AWS S3 bucket	This option is disabled by default. When enabled, sends traces collected on the Windows endpoint to an external Amazon Web Services S3 bucket. When enabled, make sure to add valid details in the fields displayed: AWS Access Key ID — Enter AWS S3 bucket access key ID. AWS S3 bucket Secret Access Key— Enter AWS S3 bucket secret access key. AWS S3 default Region Name — Enter a region name of S3 bucket created. AWS S3 bucket Name — Enter S3 bucket name. Interval (in seconds) to send trace events to AWS S3 bucket — Specifies how often (in seconds) to send trace event notifications. The default value set is 30 seconds. The minimum and maximum value you can set is between 10 and 1800 seconds.

Option

Definition

Send traces to Trellix EDR cloud

This option is enabled by default. Sends traces collected on the endpoint to Trellix EDR cloud. This feature is enabled by default.

Send traces to AWS S3 bucket

This option is disabled by default. When enabled, sends traces collected on the Windows endpoint to an external Amazon Web Services S3 bucket.

When enabled, make sure to add valid details in the fields displayed:

AWS Access Key ID — Enter AWS S3 bucket access key ID.
AWS S3 bucket Secret Access Key— Enter AWS S3 bucket secret access key.
AWS S3 default Region Name — Enter a region name of S3 bucket created.
AWS S3 bucket Name — Enter S3 bucket name.
Interval (in seconds) to send trace events to AWS S3 bucket — Specifies how often (in seconds) to send trace event notifications. The default value set is 30 seconds. The minimum and maximum value you can set is between 10 and 1800 seconds.