When writing Trellix Enterprise Security Manager - Application Data Monitor rules, use dictionaries that translate keys captured from the network into a defined value. Or, list keys without a value that defaults to Boolean true when the keys are present.
Trellix Enterprise Security Manager - Application Data Monitor dictionaries allow you to specify a file's keys quickly instead of having to write an individual rule for each word. For example, set up a rule to select email with specific words, compile a dictionary with naughty words, and import that dictionary. You can create a rule like the following to check for emails with content that includes a word in the dictionary:
protocol == email && naughtyWords[objcontent]When writing rules with the Trellix Application Data Monitor rule editor, you can select the dictionary you want the rule to reference.
Note
Dictionaries support up to millions of entries.
Adding a dictionary to a rule involves the following steps:
Setting up and saving a dictionary that lists the keys and, when needed, the values.
Managing the dictionary on the Trellix ESM.
Assigning the dictionary to a rule.