--- title: "Default settings" slug: "default-settings-3" tags: ["ENS 10.7.x", "Install and Get Started"] updated: 2026-10-06T16:11:09Z published: 2026-10-06T16:11:09Z canonical: "docs.trellix.com/default-settings-3" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Default settings Once installed, Trellix Endpoint Security (ENS) for Mac starts protecting the Mac immediately with the default configurations defined. Review each settings and configure the protection features for your environment. ### General | Feature | Default settings | | --- | --- | | **Threat Prevention** | Enabled | | **Firewall** | Enabled | | **Web Control** | Enabled | Depending upon the modules you selected during the installation, the features are displayed. For example, if you selected only Threat Prevention module, you can see only **Threat Prevention** in the General tab. ### Threat Prevention | Feature | Default settings | | --- | --- | | **Threat Prevention** **On-access Scan** tab settings: | - **Maximum scan time (in seconds)** — 45 seconds for a file - **Trellix GTI** — Enable - **Sensitivity level** — Medium - **Process Settings** — Use Standard settings for all processes **Standard** tab: - **When to scan:** - **When writing to disk** — Enabled - **When reading from disk** — Disabled - **When reading/writing** — Disabled - **Let Trellix decide** — Disabled - **What to Scan:** - **On network drives** — Disabled - **Compressed archive files** — Disabled - **Compressed MIME-encoded files** — Disabled - **Additional scan options:** - **Detect unwanted programs** — Enabled - **Detect unknown program threats** — Enabled - **Detect unknown macro threats** — Enabled - **Actions:** - **Threat detection first response** — Clean files - **If first response fails** — Delete files - **Unwanted program first response** — Clean files - **If first response fails** — Delete files | | **Threat Prevention** **On-demand Scan** tab settings: | **Local ODS** tab: - **What to scan:** - **Archives & Compressed Files** — Enabled - **Apple Mail Messages** — Enabled - **Network Volumes** — Disabled - **Trellix GTI:** - **Enable Trellix GTI** — Enabled - **Sensitivity level** — Medium - **Actions:** - **Threat detection first response** — Clean files - **If first response fails** — Delete files - **Unwanted program first response** — Clean files - **If first response fails** — Delete files - **Scheduled Scan Options:** - **Scan only when the system is idle** — Enabled - **Scan anytime** — Disabled - **Do not scan when the system is on battery power** — Enabled | ### Firewall | Feature | Default settings | | --- | --- | | **Firewall** | - **Regular Mode** — Enabled | **Trellix core networking rules** | Trellix-Allow Bootp | Trellix-Allow DNS Resolution | | --- | --- | | - **Status** — Enabled - **Action** — Allow - **Direction** — Either - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — UDP - **Local Port(s)** — 68 - **Remote Port(s)** — 67 - **Application** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Outgoing - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — UDP - **Local Port(s)** — Any - **Remote Port(s)** — 53 - **Application** — All - **Logging** — Disabled | **Trellix core networking rules contd..** | Trellix-Allow Dat update http | Trellix-Allow Loopback | | --- | --- | | - **Status** — Enabled - **Action** — Allow - **Direction** — Outgoing - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — update.nai.com - **Transport Protocol** — TCP - **Local Port(s)** — Any - **Remote Port(s)** — 80 - **Application** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Either - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — 127.0.0.1 - **Remote IP(s)** — Any - **Transport Protocol** — Any - **Application** — All - **Logging** — Disabled | **Additional Firewall core networking rules on systems managed by Trellix ePO - On-prem** | Trellix-Allow ePO by Name | Trellix-Allow ePO by Address | Trellix-Allow Agent Wakeup | | --- | --- | --- | | - **Status** — Enabled - **Action** — Allow - **Direction** — Outgoing - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — - **Transport Protocol** — TCP - **Local Port(s)** — Any - **Remote Port(s)** — 443 - **Application** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Outgoing - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — - **Transport Protocol** — TCP - **Local Port(s)** — Any - **Remote Port(s)** — 443 - **Application** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Incoming - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — - **Transport Protocol** — TCP - **Local Port(s)** — 8081 (or port configured in ePO) - **Remote Port(s)** — Any - **Application** — All - **Logging** — Disabled | **Default Client Rules** | Block incoming pings | Allow all ICMP | Allow all high UDP | | --- | --- | --- | | - **Status** — Enabled - **Action** — Block - **Direction** — Incoming - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — ICMP - **Message Type** — Echo Request - **Applications** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Either - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — ICMP - **Message Type** — Any ICMP - **Application** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Either - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — UDP - **Local Port(s)** — (1024 - 65535) - **Remote Port(s)** — (1024 - 65535) - **Application** — All - **Logging** — Disabled | **Default Client Rules contd..** | Allow all outgoing traffic | Allow Loopback | | --- | --- | | - **Status** — Enabled - **Action** — Allow - **Direction** — Outgoing - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — Any - **Remote IP(s)** — Any - **Transport Protocol** — Any - **Applications** — All - **Logging** — Disabled | - **Status** — Enabled - **Action** — Allow - **Direction** — Either - **Interface(s)** — All - **Network Protocol** — IP - **Local IP(s)** — 127.0.0.1 - **Remote IP(s)** — Any - **Transport Protocol** — Any - **Applications** — All - **Logging** — Disabled | ### Web Control | Feature | Default settings | | --- | --- | | **Web Control** | - **Rating Actions for Sites** - **Red** — Block - **Yellow** — Warn - **Unrated** — Allow - **Unverified** — Allow - **Enable Web Category Blocking** — Enabled - **Block and Allow List** — None | ### Update | Feature | Default settings | | --- | --- | | **Update** | In **Schedule** - **Schedule** — Daily at 4:45 PM (local time) | ### Logging | Feature | Default settings | | --- | --- | | **Logging** | In **Enable Debug Logging** - **Threat Prevention** — Disabled - **Firewall** — Disabled - **Web Control** — Disabled |