Add an Advanced Malware policy

File Type

The file types to be scanned. For information about the supported file types, refer to the table Advanced malware file extension support below.

Maximum File Size (KB) Scanned

The maximum size currently supported for the corresponding file type. Files that exceed the specified size are not analyzed for malware by any of the engines, including the block and allow lists.

The default values are displayed in the Default Malware Policy as well as when you create a policy. The default values are the optimum sizes recommended by Trellix Labs based on their research on malware.

You can set the maximum file size value up to (25*1024) KB/25 MB for all file types. However, the Trellix IPS Anlysis engine and Trellix Cloud engine have a file-size limit. The limits for each Sensor model are as follows:

• NS-series Sensors - (50*1024) KB/50 MB

• Virtual IPS Sensors- (5*1024) KB/5 MB

Malware Engines

The Malware engines to scan the selected file type. If you select Gateway Anti-Malware for a File Type, you must either use an NS-series Sensor running on Sensor software version 9.1 or above, or NTBA.

For MVX to work, you must integrate the corresponding Sensors with the VX appliance. See the chapter Integration with MVX for more information.

For Trellix Intelligent Sandbox to work, you must integrate the corresponding Sensors with Trellix Intelligent Sandbox. See the chapter Integration with Trellix Intelligent Sandbox for more information.

Action Thresholds

Specifies the type of response to be made for the attack. The types of responses are:

• Alert — Alerts are raised in Attack Log.

• Block — This action blocks packets for detected malware, thus preventing the malicious file from reaching the host.

  The first step towards prevention is typically to block attacks that have a high severity level. When you know which attacks you want to block, you can configure your policy to perform the drop attack packets response for those attacks. If not configured in the policy, the Attack Log allows you to update the policy to block traffic.

• Send TCP Reset— Disconnects a TCP connection at the source, destination, or both ends of the transmission, thus preventing the malicious file from reaching the host.

  Note: This response may not work effectively with SPAN and tap deployments.

• Add to Block List— If any of the engines report the submitted file to be malicious, the Manager adds the file's MD5 hash to the block list in its database. To be added to this list, the file's severity must be the same or more than what you specify in this field. For example, if you specify high as the criteria, then files of severity high and very high are added to the block list. Within the next 5 minutes, the Manager adds this file to the local block list of all the Sensors that it manages.

  Note: The TIE/GTI File Reputation engine does not support Add to Block List response action. You can manually add the desired malware file's MD5 hash to the block list from the Attack Log page.

• Save File— One of the response actions specified is the ability to archive the file in a file store based on the Advanced Malware policy. The files that are selected based on this configuration are forwarded to Manager.

  • For files greater than 5 MB, only the first 5 MB is available as the saved file.

  • To prevent the Manager's disk from getting frequently filled up, use the Save File feature sparingly.

  • The Sensor's simultaneous file scan capacity is reduced if the Save File option is enabled. See the table in this section for the details.