Last Updated: February 14, 2024

Overview

Trellix Policy Auditor automates the process required to conduct system compliance audits. It measures compliance by comparing the actual configuration of a system to the wanted state of a system.

This guide provides system requirements for Trellix Policy Auditor software, and information about installing it as a managed product, as well as changing, repairing, removing, and reinstalling the software.

Pre-Installation

Before installing Trellix Policy Auditor, you need to make sure your system is ready and meets the minimum system and database storage requirements.

Preparation for installing the software

You must complete these tasks before installing the Trellix Policy Auditor software.

1. Get the Trellix Policy Auditor software and documentation from Trellix download site.

2. Review the release notes to identify last minute changes or known issues.

3. Verify that you have local administrator rights for the computer where you plan to install Trellix Policy Auditor.

4. Verify that your server or workstation meets the system requirements before you start the installation process. Refer to System requirements for details.

5. If you are installing a licensed version over an evaluation version of Trellix Policy Auditor, you must upgrade the license. The license is not automatically upgraded from an evaluation version.

System requirements

Most of the system requirements for Trellix Policy Auditor are the same as ePolicy Orchestrator - On-prem system requirements.

The difference for Trellix Policy Auditor is the storage requirement for the database. The amount of storage required depends on the amount of data you plan on retaining, how frequently you collect that data, and how long you need to keep that data.

Note

Unless otherwise specified, these are minimum requirements and are not optimal for performance. They apply only to Trellix Policy Auditor.

Supported Trellix ePolicy Orchestrator - On-prem software versions

Trellix ePO - On-prem software versions 5.9, 5.9.1 or 5.10 must be installed and working before you can install Trellix Policy Auditor.

Domain controller requirements

The server must have a trust relationship with the Primary Domain Controller (PDC) on the network. For instructions, see the Microsoft product documentation.

Supported operating systems

Trellix Policy Auditor is installed as an extension of Trellix ePO - On-prem software and runs on operating systems supported by that product.

For the most current information about supported operating systems, see KB51569.

Important

If you are using older versions of Trellix products on macOS, make sure to install or upgrade to the latest rebranded version for all the products to function normally. Upgrading any one of the products, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed. For more information about installing or upgrading Trellix products on macOS, see KB96485.

Browsers supported

Trellix ePO - On-prem runs on the most commonly used browsers and can be accessed from anywhere on the network.

For the most current information about Trellix ePO - On-prem browser, see KB51569.

Proxy servers

If you are using a proxy, bypass the proxy server:

1. From the Internet Explorer Tools menu, select Internet Options.

2. Select the Connections tab and click LAN Settings.

3. Select Use a proxy server for your LAN, then select Bypass proxy server for local addresses.

4. Click OK, then click OK again.

Ports needed by Trellix ePO - On-prem for communication through a firewall

Trellix ePO - On-prem uses ports to communicate with web browsers, SQL Server, managed systems, the network, and other portions of the software. For the most current information about ports use by Trellix ePO - On-prem, see KB66797.

This table shows the ports needed by Trellix ePO - On-prem for communication through a firewall.

Supported virtual infrastructure software

Trellix ePO - On-prem runs on the most commonly used virtual infrastructure software.

For the most current information about Trellix ePO - On-prem virtual infrastructure support, see KB51569.

Distributed repository requirements

Distributed repositories host copies of your master repository’s contents. Consider using distributed repositories and strategically placing them throughout your network to ensure that managed systems are updated and to minimize network traffic.

As you update your main repository, the Trellix ePO - On-prem replicates the contents to the distributed repositories. For more information on distributed repositories, see the Trellix ePO - On-prem product guide. Replication can occur:

• Automatically when specified package types are checked in to the main repository, as long as global updating is enabled.

• On a recurring schedule with replication tasks.

• Manually, by running a Replicate Now task.

Trellix Agent and Trellix ePO - On-prem support

Trellix Policy Auditor software supports Trellix Agent versions 4.5, 4.6, and 5.0. The available features depend upon the agent version and the Trellix ePO - On-prem software version.

Trellix Policy Auditor agent platforms and support

    The Trellix Policy Auditor agent supports many versions of Windows, Linux, and UNIX-based operating systems.

Note

The Trellix Policy Auditor agent requires the Trellix Agent to be installed on the same system.

    For the most current information about supported operating systems, see KB72961.

Hardware and network requirements for Windows systems

These are the minimum requirements for Trellix Policy Auditor agent support on Windows systems:

Database considerations and support

Trellix Policy Auditor uses the Trellix ePO - On-prem server database. Before installing Trellix Policy Auditor, calculate how much database space you need based on your auditing requirements.

Using Trellix Policy Auditor software with a database

For the most current information about supported SQL database versions, see KB51569.

Database storage requirements

When determining hardware needs for your organization, it is important to estimate the amount of database storage required to use Trellix Policy Auditor software.

has designed the software so that audit results consume the minimum amount of disk space. The amount of database storage you require depends on these factors:

• How frequently benchmark audits are performed

• The number of systems audited

• How long you want to retain audit results

The tables used to calculate server and database requirements are based on tests of the software in the following distributed environment:

Trellix Policy Auditor server

Database server

Effect of differential auditing results on database size

Trellix Policy Auditor increases database size by an average of 760 KB of space per new system audited. The differential audits feature causes the increase in database size to decrease significantly after the first audit.

The Index Configuration server setting also affects the size of the database. If you use the Minimal Indexing option, the database will be smaller than if you use one of the other options.

The ultimate database size cannot be calculated accurately prior to deploying Trellix Policy Auditor, but can be estimated approximately three months after beginning a phased rollout. Use the database storage sizing estimates to determine the initial database size for new systems and new audits.

Estimate database storage requirements

You can estimate the average amount of hard disk space needed to store new Trellix audit results.

1. Determine the auditing requirements for your organization, including:

   • The number of audits you will be performing

   • The frequency of each audit (for example, 20 audits once per quarter, five audits once per month, or one audit once per week)

   • The number of systems covered by each audit

2. Use the example and the table in Database storage example and requirements table to estimate the database space required for each audit.

3. Add the values for each audit. The sum is equal to the size of the database that is required to store the audit results for one year.

4. Determine the length of time you want to store the audits and adjust the database accordingly. For example, if you intend to store the audit results for two years, double the database size obtained in step 3. If you intend to store the audit results for six months, divide the database size by two.

Database storage example and requirements table

The requirements table for database sizing can help you calculate the approximate disk space needed for your Trellix Policy Auditor database.

Requirements table for database sizing

Use this table to estimate the required size of your database. These estimates are based upon the average size of benchmark audit results. Your needs might vary.

Calculating database storage requirements

A corporation follows this policy for running audits:

• The company retains audit results for one year.

• One audit runs every three days on 2,000 systems. The table does not include this value, so we approximate this to two audits per week running on 2,000 systems.

• Five monthly audits run on 5,000 systems.

• One yearly audit runs on 150,000 systems. The table does not include this value, but it is equivalent to three yearly audits on 50,000 systems.

• Two quarterly audits run on 10,000 systems.

Calculate the approximate database size:

1. Look up the corresponding values in the table under Requirements table for database sizing, and note these results:

2. Calculate the total amount of space needed:

284 + 410 + 204 + 109 = 1,007 GB

Database storage requirements for File Integrity Monitoring

File Integrity Monitoring (FIM) allows you to designate a set of files to monitor for changes. Trellix Policy Auditor software monitors the MD5 and SHA-1 hashes of a file as well as the file attributes and permissions information. When a file changes, the Trellix Policy Auditor agent notes the change and sends an event back to the server.

The number of FIM events depends upon the number of files monitored and the frequency of changes to monitored files. The number of events is difficult to predict, but the impact to database storage is minimal.

Each FIM event adds approximately 3 KB to the database. If your organization generates one million events per month, the annual database growth is:

3 KB/event × 1,000,000 events/month × 12 months/year × 0.000001 GB/KB = 36 GB/year

Database storage requirements for file versioning

The File Integrity Monitoring feature of Trellix Policy Auditor software allows you to store up to six versions, including the file baseline, of text files from managed systems. The software does not support versioning for non-text files.

Version database sizing chart

This chart helps you calculate the database storage requirements for versioned files. The Monitored file size column is the size of the file, in megabytes, for which you are storing version text. The Versions row is the number of file versions that you are storing.

Calculating versioning database storage requirements

A corporation follows this policy for maintaining file versions:

• Maintains file text for 5 versions of 2 MB files on 200,000 systems.

• Maintains file text for 4 versions of 1 MB files on 20,000 systems.

• Maintains file text for 3 versions of 4 MB files on 140,000 systems.

• Maintains file text for 6 versions of 3 MB files on 100,000 systems.

Calculate the approximate database size:

1. Look up the corresponding values in the table under Version database sizing chart, and note these results:

2 | Introducing Trellix Policy Auditor

2. To determine the database size, multiply the number of systems (in thousands) by the value that you obtained from the Version database sizing chart.

3. Calculate the total amount of space needed:

59.80 + 3.44 + 38.64 + 49.20 = 151 GB

Installing Trellix Policy Auditor

Installing Trellix Policy Auditor includes several components. The installation process also includes updating the Trellix Policy Auditor content and installing the Trellix Policy Auditor agent.

After you install the Trellix Policy Auditor product, update the Trellix Policy Auditor content to ensure you have the latest content before you start auditing systems.

Trellix Agent must be installed before you install the Trellix Policy Auditor agent. See the Trellix ePO - On-prem product guide for information about installing the Trellix Agent.

If you need agents for other operating systems, see Check in additional agent packages.

Install the Trellix Policy Auditor extension

Install the software on Trellix ePO - On-prem as an extension.

You must have local administrator rights for the computer where you plan to install Trellix Policy Auditor.

1. Download the product zip file from the Trellix download site, then uncompress the zip file.

2. Select Menu → Software → Extensions.

3. Click Install Extension, then click Browse.

4. Select the PAPackage.zip file, click Open, then click OK.

5. If earlier versions of Trellix Policy Auditor software are installed, a dialog box asks whether you want to perform an upgrade of Trellix Policy Auditor. Click Yes, then click OK.

6. Review the Install Package information, then click OK.

7. Before rebooting or using Trellix Policy Auditor, update the benchmark and check content.

See Update Trellix Policy Auditor content for instructions.

Trellix Policy Auditor appears in the Managed Products list under extensions, and all the extensions installed for the software appear in the right pane.

Update Trellix Policy Auditor content

After installing Trellix Policy Auditor on Trellix ePO - On-prem, you must update the content before using the software or rebooting the system.

Note

The content check-in requires about 30 minutes.

1. Select Menu → Automation → Server Tasks.

2. Next to Update Main Repository, click Run.        

   • Do not restart your system or use Trellix Policy Auditor or Trellix Benchmark Editor while Trellix ePO - On-prem is adding content.

   • Click Menu → Reporting → Server Task Log to verify that the new content has been checked in.

Note

In , you can also update the benchmark and editor content using Schedule Pull. Go to Menu → Software → Main Repository, then clicking Actions → Schedule Pull and following the Server Task Builder wizard. For more information, see the latest Trellix ePO - On-prem Product Guide.

Check in additional agent packages

When you install Trellix Policy Auditor, you need to separately check in agent packages for Windows, Mac OSX, and Linux to the Main Repository. Also for Solaris, AIX, or HP-UX systems, you need to separately check in these packages to the Main Repository.

For information on deploying the agent to systems in the System Tree, refer to Install the Trellix Policy Auditor agent in the Trellix Policy Auditor Product Guide.

For option definitions, click ? in the interface.

1. Download the appropriate agent zip files from Trellix download site.

2. Select Menu → Software → Main Repository, then click Actions → Check In Package.

3. For Package type, select Product or Update (.ZIP), browse to and select the package file, then click Open.

4. Click Next.

5. Confirm or configure the following:        

   • Package info — Confirm this is the correct package.

   • Branch — Select the branch you want. If there are requirements in your environment to test new packages before deploying them throughout the production environment, recommends using the Evaluation branch whenever checking in packages. Once you finish testing the packages, you can move them to the Current branch by selecting Menu → Software → Main Repository, then click Change Branch.

   • Move the existing package to the Previous branch — Moves packages in the Main Repository from the Current branch to the Previous branch when a newer package of the same type is checked in. Available only when you select Current in Branch.

   • Package signing — Specify if the package is signed by or is a third-party package.

   • Conflicting Packages that will be removed — Displays any conflicting packages. These packages are removed when you check in the selected package.

6. Click Save, then wait while the package is checked in.

The new package appears in the Packages in Main Repository list on the Main Repository tab.

Uninstall Trellix Policy Auditor

You can remove the Trellix Policy Auditor program files to re-install another version of the program or to completely remove the program.

Note

If you plan to re-install the software, Trellix strongly recommends that you restart your computer after you remove the files.

1. Select Menu → Software → Extensions, select Trellix Policy Auditor in the Managed Products list.

2. In the right pane, click the Remove link of each extension component.

It is important to remove the components in the following order:

• PA Rollup extension

• Trellix Policy Auditor extension

• Advanced Host Assessment

• Advanced Host Assessment Content Distributor

• Findings extension

• Benchmark Editor Content Distributor extension

• Benchmark Editor extension

• PA Core extension

3. Select Menu → Software → Main Repository.

4. In the Actions column of the Audit Engine Content row, click Delete to remove the benchmark and check content.

5. To uninstall any remaining Trellix Policy Auditor agent packages:

6. Select Menu → Software → Main Repository.

7. Under the Name column, search for packages named Trellix Policy Auditor agent for <operating system>, such as Trellix Policy Auditor Agent for Windows.

8. Under the Actions column, click Delete for each package.

Install and uninstall the agent

Managed systems under Trellix Policy Auditor must have the Trellix Agent and the Trellix Policy Auditor agent plug-in.

For information about installing and working with the Trellix Agent, see the Trellix ePO - On-prem documentation.

Install the Trellix Policy Auditor agent

Install the Trellix Policy Auditor agent before you run audits on managed systems.

1. On the Trellix ePO - On-prem console, select Menu → Systems → System Tree, then click the Assigned Client Tasks tab.

2. Select the System Tree group with the systems where you want to install the Trellix Policy Auditor agent.

3. Click Actions → New Client Task Assignment.

4.         Select the following Task to Schedule options.        

   • For Product, select Trellix Agent.

   • For Task Type, select Product Deployment.

   • For Task Name, click Create New Task.

5.         Fill in the client task settings, then click Save.        

   • Type a name and an optional description for this task.

   • Select the Target Platforms.

   •                 Select a Trellix Policy Auditor agent from the Product and components list, then select options from the drop-down lists.                

     • Trellix Policy Auditor for Windows 6.4.0

     • Action — Install

     • Language — Language neutral

     • Branch — Current

   • Optionally, select Run at every policy enforcement (Windows only) to reinstall the Trellix Policy Auditor agent if a user has removed the product or component. This is done at the next policy enforcement interval.

   • Optionally, select Allow end users to postpone this deployment, then select the settings.

6. Fill in the rest of the Task to Schedule settings, then click Next.

• For Lock task inheritance, select Unlocked or Locked.

• For Tags, select Send this task to all computers or Send this task to only computers which have the following criteria. If you send based on criteria, click Edit to select the criteria.

7. Configure the schedule, then click Next.

8. Review the task settings, then click Save. The task is added to the list of client tasks for the selected group and any group that inherits the task.

9. Send a manual wake-up call to the systems to run the client task immediately.

Uninstall the Trellix Policy Auditor agent

Uninstall the Trellix Policy Auditor agent from systems on your network if you do not want them to be managed by Trellix Policy Auditor content.

This is useful when you want to convert a managed system to an unmanaged system and reduce the load on system resources.

1. On the Trellix ePO - On-prem console, select Menu → Systems → System Tree, then click the Assigned Client Tasks tab.

2. Select the System Tree group with the systems where you want to install the Trellix Policy Auditor agent.

3. Click Actions → New Client Task Assignment.

4. Select the following Task to Schedule options.        

   • For Product, select Trellix Agent.

   • For Task Type, select Product Deployment.

   • For Task Name, click Create New Task.

5. Fill in the client task settings, then click Save.        

   • Type a name and an optional description for this task.

   • Select the Target Platforms.

   • From the Product and components list, select a Trellix Policy Auditor agent.

   • From the Action list, select Remove.

   • Optionally, select Run at every policy enforcement (Windows only) to reinstall the Trellix Policy Auditor agent if a user has removed the product or component. This is done at the next policy enforcement interval.

   • Optionally, select Allow end users to postpone this deployment, then select the settings.

6. Fill in the rest of the Task to Schedule settings, then click Next.

• For Lock task inheritance, select Unlocked or Locked.

• For Tags, select Send this task to all computers or Send this task to only computers which have the following criteria. If you send based on criteria, click Edit to select the criteria.

1. Configure the schedule, then click Next.

2. Review the task settings, then click Save. The task is added to the list of client tasks for the selected group and any group that inherits the task.

3. Send a manual wake-up call to the systems to run the client task immediately.

Send a manual wake-up call to a group of systems

Send manual wake-up calls to a System Tree group to verify that the Trellix Agent and Trellix ePO - On-prem server are communicating. This is useful when you make policy changes and want agents to download the update.

1. On the Trellix ePO - On-prem console, select Menu → Systems → System Tree, then select the group.

2. Select a group, select the systems from the list, then click Wake Up Agents.

3. Verify that the systems appear next to Target systems.

4. Next to Wake-up call type, select whether to send an Agent Wake-Up Call or a SuperAgent Wake-Up Call.

5. Accept the default Randomization (0–60 minutes) or type a different value.

6. By default, Get full product properties is selected. This causes the Trellix Policy Auditor agent to send complete system properties to Trellix Policy Auditor. Deselect this option to send only properties that have changed since the last agent-server communication.

7. Click OK to send the wake-up call.

8. Verify that the Trellix Policy Auditor agent and Trellix ePO - On-prem server are communicating. Go to Reporting → Audit Log and search the log for an entry: Wake Up Agents | Succeeded.

Display the system tray icon on Windows systems

You can configure Trellix Policy Auditor to display a system tray icon on Windows systems. The icon is not available for non-Windows systems. The icon allows the user to see the status of audits, including whether an audit is running, scheduled, not scheduled, or disabled.

1. On the Trellix ePO - On-prem console, select Menu → Systems → System Tree, then click the Assigned Policies tab.

2. From the Product drop-down list, select Policy Auditor Agent.

3. Under the Policy column, click My Default to open the whiteout/blackout page.

4. Next to General Options, select Show the Policy Auditor system tray icon (Windows only), then click Save.