Malware Guard is a machine-learning mechanism integrated through security content on the Network Security appliance. Malware Guard labels and scores third-party binaries (.exe, .DLL and .sys files) as malware, goodware, PUPs (Potentially Unwanted Programs), or unknown. When a score is calculated with a malicious verdict, a Malware Guard alert is displayed on the appliance. The Network Security appliance also uploads the alert to the Trellix Dynamic Threat Intelligence (DTI) cloud for further threat analysis.
Malware Guard is enabled on the Network Security appliance by default.
Prerequisites
Administrator, Operator, Monitor, or Analyst access to the Network Security appliance.