What's new

This release of the Trellix Intrusion Prevention System includes the following enhancement:

Attack being mapped to multiple tactics, techniques, and sub techniques in Attack Log

Starting with this release of 11.1, if an attack matches with multiple tactics, techniques, and/or sub-techniques, their names along with applicable technique/sub-technique IDs are shown in the respective fields under the Mitre Attack Details column in the Analysis → <Admin Domain Name> → Attack Log page. You can also view the same details by double-clicking an attack.

When an attack is mapped to multiple tactics, techniques, and/or sub-techniques, there is one-to-one correspondence among the tactics, techniques, sub-techniques, and technique/sub-technique IDs. For example, the first tactic corresponds to the first technique, sub-technique, technique/sub-technique ID, and so on.

For more information, refer to the section Filter, sort, and refresh alerts in Trellix Intrusion Prevention System 11.1.x Product Guide

Syslog notification format update

Till 11.1 Update 4 release, all Syslog notifications generated from the Manager UI were prefixed with the timestamp format MMM DD HH:MM:SS. From this release of 11.1, along with this timestamp, additional timestamp with format [MMM DD, YYYY HH:MM:SS] is appended to each Syslog notification from the Manager for auditing purposes. This timestamp update is independent of the syslog variables (default or customized) used to configure syslog notifications.

Refer to the table below to understand the difference in syslog notification format:

This change applies to all syslog notifications that are forwarded via the Manager, which includes syslog notifications configured for IPS Events, Faults, and User Activities in the Manager → <Admin Domain Name> → Setup → Notification page. As a user, you need to update the Syslog parsing logic in the third-party Syslog application(s) in use to avoid any timestamp conflicts in the Syslog notifications.

IPS Security Vulnerability updates

This release contains the fixes for the following security vulnerabilities in the IPS Manager. You must upgrade both the IPS Manager and IPS Central Manager to the 11.1.7.84 version.