What's new

This release of the Trellix Intrusion Prevention System includes the following new features:

Integrating Trellix vIPS with AWS Gateway Load Balancer Traffic Mirroring

This release of 11.1 introduces the integration of Trellix vIPS with AWS Gateway Load Balancer (GWLB) Traffic Mirroring. The Gateway Load Balancer (GWLB) with traffic mirroring enables you to deploy, scale, and manage virtual appliances, such as firewalls, intrusion prevention systems, and deep packet inspection systems. It is capable of inspecting traffic flowing into and out of protected AWS instances.

The GWLB with traffic mirroring and its registered virtual appliance instances exchange application traffic using the GENEVE protocol on port 6081. The solution has been designed to adapt to a public cloud environment and to scale with the requirements of your organization's subnets.

The following table lists the requirements of different vIPS solution components for the integration of Trellix vIPS with AWS GWLB traffic mirroring.

You can find the cost estimates for your deployments from My Estimate.

The following section lists the other component requirements to integrate Trellix vIPS with AWS GWLB traffic mirroring.

The following table lists the ports for security group settings required to integrate Trellix vIPS with AWS GWLB traffic mirroring.

For more information, see Integrating AWS with GWLB Traffic Mirroring in Trellix Virtual Intrusion Prevention System 11.1.x Product Guide.

This release of the Trellix Intrusion Prevention System includes the following enhancements:

Support for RSA 4096-bit key self-signed and CA-signed certificates

Starting with this release of 11.1, trust between the Manager and Sensor could also be established by using self-signed and CA-signed certificates with a 4096-bit key.

For more information, see Managing Certificates for Manager and Sensor in Trellix Intrusion Prevention System 11.1.x Product Guide

Support for DNS response fields for layer 7 data collection

In 11.1 Minor 6 release, Trellix IPS provided support for the collection of layer 7 data for DNS request fields. In this release of 11.1, Trellix IPS extends its support for the collection layer 7 data for DNS response fields as well, and the export of DNS response based L7 metadata to other Trellix products, such as Trellix Network Investigator (NI).

You can navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Setup → Advanced → L7 Data Collection page and enable L7 data collection for DNS request and response fields per interface or sub-interface of selected Sensors.

For more information, Enable Layer 7 Data Collection for an interface or sub-interface in Trellix Intrusion Prevention System 11.1.x Product Guide.

Introduction of SmartVision attacks

Trellix IPS now includes SmartVision attacks, a new set of native IPS attack definitions. These attacks generate base events that allow for more comprehensive and effective detection and correlation of network activities and potential threats, particularly for the lateral movement, when the integration between Trellix IPS and Trellix NI is enabled.

SmartVision attack definitions are included in the IPS signature set and automatically added into the default IPS policies (except Default DoS and Reconnaissance Only policy) with severity levels set to Low and higher, when a compatible signature set is in use.

When a SmartVision alert/attack is detected in any customer network environment, Manager sends the relevant alert data in JSON format to Trellix NI. NI consumes and utilizes these base events that enable it to perform more effective threat detection and correlation.

Note the following when you start working with SmartVision attacks:

For more information, see Harnessing SmartVision attacks for effective threat detection and response in Trellix Intrusion Prevention System 11.1.x Product Guide.