Trellix Enterprise Security Manager - Application Data Monitor tracks use of sensitive data on the network, analyzing underlying protocols, session integrity, and application contents.
When Trellix Application Data Monitor detects a violation, it preserves all details of that application session for use in incident response and forensics or for compliance audit requirements. At the same time, Trellix Application Data Monitor provides visibility into threats that masquerade as legitimate applications.
Trellix Application Data Monitor can detect when sensitive information is transmitted inside email attachments, instant messages, file transfers, HTTP posts, or other applications. Customize Trellix Application Data Monitor detection capabilities by defining your own dictionaries of sensitive and confidential information. Trellix Application Data Monitor can then detect these sensitive data types, alert appropriate personnel, and log the transgression to maintain an audit trail.
Trellix Application Data Monitor monitors, decodes, and detects anomalies in the following application protocols:
File transfer: FTP, HTTP, SSL (setup and certificates only)
Email: SMTP, POP3, NNTP, MAPI
Chat: MSN, AIM/Oscar, Yahoo, Jabber, IRC
Webmail: Hotmail, Hotmail DeltaSync, Yahoo mail, AOL Mail, Gmail
P2P: Gnutella, bitTorrent
Shell: SSH (detection only), Telnet
Trellix Application Data Monitor accepts rule expressions and tests them against monitored traffic, inserting records into the database event table for each triggered rule. It stores the packet that triggered the rule in the event table's packet field. It also adds application level metadata to the dbsession and the database query tables for every triggered rule. It stores a text representation of the protocol stack in the query table's packet field.
Trellix Application Data Monitor can generate the following types of event:
Metadata - Trellix Application Data Monitor generates one metadata event for each network transaction, with details such as addresses, protocol, file type, file name. Trellix Application Data Monitor places the metadata events in the query table and groups the events through the session table. For example, if one FTP session transfers three files, Trellix Application Data Monitor groups them together.
Protocol anomaly - Protocol anomalies are hard-coded into the protocol modules and include events, such as a Transmission Control Protocol (TCP) packet being too short to contain a valid header and a Simple Mail Transfer Protocol (SMTP) server returning an invalid response code. Protocol anomaly events are rare; Trellix Application Data Monitor places them in the event table.
Rule trigger - Rule expressions generate rule trigger events, detecting anomalies in the metadata generated by the Internet Communications Engine (ICE). These events might include anomalies such as protocols used outside of normal hours or an SMTP server unexpectedly talking FTP. Rule trigger events are rare; Trellix Application Data Monitor places them in the event table.
The event table contains one record for each detected protocol anomaly or rule trigger event. The event records link to the session and query tables through the sessionid, where more detail about the network transfers (metadata events) that triggered the event is available. Each event also links to the packet table where the raw packet data for the packet that triggered the event is available.
The session table contains one record for each group of related network transfers (such as, a group of FTP file transfers on the same session). The session records link to the query table through the sessionid where more details about the individual network transfers (metadata events) are found. In addition, if a transfer in the session causes a protocol anomaly or triggers a rule, there is a link to the event table.
The query table contains one record for each metadata event (content transfers that take place on the network). The query records link to the session table with the sessionid. If the network transfer represented by the record triggers a protocol anomaly or rule, there is a link to the event table. There is also a link to the packet table using the text field where a textual representation of the full protocol or content stack is found.