What's new

This release of Trellix Intrusion Prevention System includes the following new features:

Introduction to Trellix Virtual Intrusion Prevention System Sensor - IPS-VM5000 and support on Kernel-based Virtual Machine (KVM)

This release of 11.1 introduces Trellix Virtual IPS Sensor IPS-VM5000. This Sensor operates at 5 Gbps throughput.

The Sensors are flexible enough to adapt to the security needs of any enterprise environment. When deployed at key network access points, they provide real-time monitoring on high traffic loads to detect malicious activity and respond to the malicious activity as configured by the administrator.

The IPS-VM5000 Sensor supports all the features supported by IPS-VM600. This release also introduces support for Trellix vIPS Sensor deployments (IPS-VM600 and IPS-VM5000) on KVM.

The table describes the hardware and server requirements for the vIPS deployments in the ESXi server and KVM:

You can deploy the Sensor in the following modes:

To know the list of features supported by IPS-VM5000/IPS-VM600, refer to the section Features supported by a Virtual Sensor.

For information on IPS-VM5000 Sensor capacity, refer to the section Virtual IPS Sensor capacity by model number.

To achieve expected performance on IPS-VM5000 and IPS-VM600 in KVM, you need to install and configure Open Virtual Switch (OVS) with Data Plane Development Kit (DPDK) on the host machine and assign the OVS-DPDK ports to the Trellix vIPS Sensor ports. To do, refer to the section Install and configure OVS with DPDK on host machine.

For more information, refer to Trellix Virtual Intrusion Prevention System 11.1.x Product Guide and Trellix Intrusion Prevention System 11.1.x Product Guide.

Integrating Trellix vIPS with AWS Gateway Load Balancer

This release of 11.1 introduces integration of Trellix vIPS with AWS Gateway Load Balancer. The Gateway Load Balancer (GWLB) enables you to deploy, scale, and manage virtual appliances, such as firewall, intrusion prevention systems, and deep packet inspection systems. The GWLB and its registered virtual appliance instances exchange application traffic using the GENEVE protocol on port 6081.

GWLB uses Gateway Load Balancer endpoint (GWLBe) to securely exchange traffic across VPC boundaries. A GWLBe is a VPC endpoint that provides private connectivity between virtual appliances in the service provider VPC and application servers in the service consumer VPC. You can deploy GWLB in the same VPC as the Trellix vIPS appliances. You must register the Trellix vIPS appliances with a target group for the GWLB. Traffic to and from a GWLBe is configured using route tables.

The following table lists the requirements of different vIPS solution components for the integration of Trellix vIPS with AWS GWLB.

You can find the cost estimates for your deployments from My Estimate.

The following section lists the requirements to deploy AWS GWLB.

The following table lists the ports for security group settings required to integrate Trellix vIPS with AWS GWLB.

The following commands are added to facilitate Trellix vIPS integration with AWS GWLB:

For more information, see Integrating Trellix vIPS with AWS Gateway Load Balancer in Trellix Virtual Intrusion Prevention System 11.1.x Product Guide.

vIPS license enhancements

Starting with this release of 11.1, the Manager supports licensing of both VM5000 and VM600 Sensors. Virtual Sensors require a software license to activate the baseline throughput of 5 Gbps and 1 Gbps on VM5000 and VM600 Sensors respectively. The license is provided as a .zip or .jar file. The procured license contains the details of the Sensor's throughput. The Manager checks the compliance periodically to check the number of licenses against the Sensor's throughput.

In case of the VM5000 Sensor, 5 active licenses each of 1 Gbps is required to achieve the throughput of the Sensor. For VM600 Sensor, only 1 active 1 Gbps license is required.

You can upload the license from the Licenses page in the Manager. In the Manager, go to Manager → <Admin Domain Name> → Setup → Licenses and click Virtual Sensors tab. Here, you can add a license in the Manager, assign a license to the Sensor, unassign a license from the Sensor, and remove a license from the Manager.

You can assign/unassign licenses through the following nodes in the Manager:

For more information, see Managing licenses for Virtual Sensors in Trellix Virtual Intrusion Prevention System 11.1.x Product Guide.

Integration with Trellix Investigation Analysis

Trellix Investigation Analysis (IA) is a security analytics solution that allows the analysis of alerts and network metadata gathered from all devices connected to it. IA provides a high-level view of the network metadata gathered over customizable dashboards supporting multiple configurations. It thus enables users to have a metadata-based view of network activities and search indexed metadata from various network protocols, which allows them to zero down on threat information critical for performing further investigation.

Starting with this release of 11.1, Trellix IPS offers integration capability with IA appliances or IA cluster, and exports netflow records and Layer 7 metadata from IPS Sensors, and alert data from IPS Manager to IA as per the configuration and filter parameters set on the IA. The alert data, L7 metadata information, and flow records exported by Trellix IPS are displayed on the Dashboard of IA's Web UI which you can review and analyze further for the detection and analysis of network threats.

You need to perform the following steps to enable integration with Trellix IA:

The following tabs are available for enabling IA integration in the Manager:

Following is the list of Sensor CLI commands that have been added in support of Trellix IA integration:

For more information on Trellix IA integration, refer to the section Integration with Trellix Investigation Analysis in Trellix Intrusion Prevention System 11.1.x Integration Guide.

This release of Trellix Intrusion Prevention System includes the following enhancements:

Syslog and SNMP server configuration

Previously, SNMP and Syslog notification profiles were configured separately through the IPS Events, Faults, and User Activity sections. Starting with this release, a Server Configuration page has been added under Manager → <Admin Domain Name> → Setup → Notification in the Manager and Central Manager. This page acts as a standard location to configure the server profiles. These server profiles can be used to configure the Syslog and SNMP notification profiles under IPS Events/Faults/User Activity.

For more information, refer to the section Configure SNMP and Syslog servers in Trellix Intrusion Prevention System 11.1.x Product Guide.

Signature set version validation during its download or manual import

The signature set's major version (i.e, its first two digits) should be equal to or higher than the IPS Manager's major version (i.e, its first two digits) for it to be compatible with the Manager. Starting with this release of 11.1, the Manager performs validation based on the signature set file's major version being equal to or higher than its major version and prevents the download or manual import of any incompatible signature set version that does not match the validation criteria. For example, any Manager running on version 11.1 Update 2 supports the download and deployment of signature set version 11.9.x.x, but not signature set version 10.8.x.x or 9.8.x.x.

For more information, refer to the section Signature sets in Trellix Intrusion Prevention System 11.1.x Product Guide.

This release provides the following enhancements related to platforms, environments, or operating systems:

MariaDB upgrade

Starting with this release of 11.1, the IPS Manager uses MariaDB version 10.6.12 that includes additional security against new vulnerabilities.

JDK upgrade

Starting with this release of 11.1, the IPS Manager uses JDK version 8u362 that includes additional security against new vulnerabilities.