Analyze High-Risk Endpoints

You can view and analyze the endpoints whose behavior on the network is consistent with malware infection and callback activity. From the dashboard, view the Top High-Risk Endpoints that gives you details of endpoints whose behavior on the network is consistent with malware infection. On clicking an endpoint on the Top High-Risk Endpoints dashboard, you are directed to the Analysis → High-Risk Endpoints page. This page displays the details of the endpoints identified as risky to your network.

You can analyze the details of risky endpoints, such as IP address, DNS name, OS, the user details, the endpoint risk which is determined by the attacks, and certain behavioral indicators. You can view the count of the attacks per malware phase. These are classified as Exploits, Infections, and Callbacks.

You can further drill-down to view the details of these attacks, such as time of the attack, detailed attack description, name of the attack, and the result of the attack on your network. You can further download the packet log to analyze the affected data packets, obtain the attacker forensics and the target forensics, and view the direction of the traffic on which the attack is detected – whether inbound or outbound. The target and attacker details, such as, the IP address, country and the port can also be viewed. You can view these information specific to any admin domain by selecting the required admin domain from the Domain drop-down list. The data is calculated based on the admin domain selected and will change for each admin domain and the corresponding child domains selected.

You can analyze the behavioral risks, such as patterns and Endpoint Threat Factor (ETF) and the occurrence of the last event. The patterns value indicates the risk of the endpoint based upon attack patterns. For example, a spike in certain attacks or groups of attacks to or from this endpoint over a given time period would increase its patterns value and therefore its overall endpoint risk. The ETF is a value assigned by Trellix IPS to internal endpoints to indicate their risk to the network. Multiple components are considered to determine the value, including fluctuations in the number of connections/bytes to or from the endpoint, the reputation of endpoints with which it is communicating, and the number and severities of alerts it has generated. The ETF is in turn used to influence the overall endpoint risk.

Note

Data displayed in the Top High-Risk Endpoints monitor is automatically refreshed by the Manager on an hourly basis. This is not user configurable.

Attack Log

Upon double-clicking on the endpoint IP address, the Attack Log page opens. You can analyze and view alerts related to the selected endpoint IP address.

To close the attack log, click Back or icon.

The following table shows the information displayed in the High-Risk Endpoints section.

'Selected endpoint'

• Endpoint Information

  The Endpoint Information sub-tab shows the following details specific to the endpoint.

  
  
  

  Option	Definitions
  Country	Country of the endpoint
  DNS Name	DNS name of the endpoint to resolve the names to IP addresses
  NetBIOS Name	NetBIOS name of the endpoint to access the endpoint machines
  Operating System	Operating system platform of the endpoint
  Device Type	Device type of the attacker/target
  MAC Address	MAC address of the endpoint
  Domain/Workgroup	Domain or workgroup of the endpoint
  User	Operating system user name of the endpoint
  Data Source	Point product (ePO/MVM) from where information is retrieved
  Trellix Agent Check-In Time	Check-in time of the Trellix Agent that communicates with the same ePO server integrated with the admin domain
  Endpoint Type	Type of the endpoints: UNMANAGED (No Agent)— This indicates that there is no Trellix Agent installed on the endpoint. UNMANAGED (MANAGED)— This indicates that the endpoint has a Trellix Agent but there is no active communication channel between the Agent and ePO server integrated with the admin domain.
  Installed products	List of the installed products

  • Threat Explorer
    • Explore as attacker IP — Explore the threats where the endpoint is the source IP address.
    • Explore as target IP — Explore the threats where the endpoint is the destination IP address.

      For more information, see the section Threat Explorer.

  • Network Forensics — Click this tab to analyze the network behavior of the endpoint when NTBA is configured.

    
    
    

    You can filter your view by choosing the time and date of your choice.

    
    
    

    You can view the data according to your time preference by selecting the time period from the drop-down list. You can use the icon to view the details before and after any event/attack.

    
    
    

    For more information, see the section Using context-aware data for network forensics.
  • Quarantine — Use this option to block all the traffic originating from the specified IP address seen on the selected device for the selected time.

    
    
    

    To quarantine endpoints to block all the traffic originating from the specified IP address:

    Properties option definitions

    Option	Definition
    IP Address	Enter the IP address of the endpoint.
    Device	Select the specific device of the endpoint whose traffic originating from the IP address you want to block.
    Quarantine Duration	Select the quarantine duration from the drop-down list.
    Remediate	Select the checkbox to redirect the configured endpoint to the configured remediation portal. Note You can configure the remediation portal settings in Devices → Global → IPS Device Settings → Quarantine → Remediation Portal. Remediation cannot be applied for IPv6 address. The checkbox and the information icon for remediation is not displayed if you enter an IPv6 address in the IP Address field.

    Click Quarantine. The endpoint is added and displayed in the Quarantine page.

  • Tag (in ePO)— Use this option to assign a tag to the selected endpoint in Trellix ePO - On-prem.

    You are able to assign tags only to endpoints whose Endpoint Type denotes MANAGED. This means that the endpoint runs a suitable version of Trellix Agent and is managed by Trellix ePO - On-prem.

    To assign a tag:

    1. Select a tag from the drop-down list. If the tag you looking for does not appear in the list, click the refresh button.
    2. Click Tag.

       If the tagging is successful you receive a message stating its success. If not, you receive a failure notification.

• ePO Threat Events

  The ePO Threat Events sub-tab displays the latest 50 Threat Events listed in the ePolicy Orchestrator - On-prem for a selected endpoint. The information displayed under this sub-tab includes the date and time at which the threat event was generated, the ID associated with the event, the event description, event category, action taken on the event, and the type of the threat that triggered the event.

  You can click the icon to refresh the list and view the latest 50 Threat Events listed in the ePolicy Orchestrator - On-prem for the selected endpoint. The Search text field allows you to search for a specific event based on the Event Received Time, Event ID, Event Category and Threat Type. For example, to view all events associated with the Event ID 1095, type 1095 in the Search field.

  Note

  The sub-tab has Any Severity filter selected by default. With this filter selected, the sub-tab displays all types of events including those which are informational and/or of low-severity. Such events act as noise and impede one's ability to find true threats. To exclude these events, select the Warning+ Severity Only filter from the drop-down menu. This displays only those events with Critical, Alert and Warning severity.

  Note

  Ensure that the ePO server has the latest Trellix IPS Extension file installed. For information on how to download and install the Trellix IPS Extension, see the section Install Trellix IPS extension file in Trellix ePO - On-prem in Trellix Intrusion Prevention System Integration Guide.

  
  
  

• Vulnerability Assessment

  The Vulnerability Assessment sub-tab displays the following details. This tab will be populated with vulnerability assessment scan results for the selected endpoint when integration with McAfee Vulnerability Manager (MVM) is enabled.

  
  
  

  Item	Description
  Scan for Vulnerabilities	Click button to scan for vulnerabilities against the selected host. If the selected IP address is found in an MVM scan configuration, it displays a message to inform that the scan is successful. If the selected IP address is found in more than one available MVM scan configuration, the Scan for vulnerabilities window is displayed. Select an MVM configuration from the MVM Scan Configuration drop-down list. Click Start Scan to run the scan. Note To refresh the configuration, click . If the selected IP address is not found in any of the MVM scan configuration, a warning message is displayed informing that the default configuration will be used for the scan. Click OK to proceed with the scan. Note Scan for Vulnerabilities option is available only when integration with Vulnerability Manager is enabled and if you have edit privileges to run the scan.
  Search	Search for any specific scanned data. For example, type http in the Search text field to view the data specific to http service.
  General Activity	The following details are displayed: Overall Criticality — Criticality level of the endpoint Last Scan Time — Date and time of the latest scan By Scan Engine — Name of the scan engine
  Open Ports	The following open port details are displayed: Protoport — Port ID Service — Name of the service running on the port Description — Description of the service
  Vulnerabilities	The following vulnerability details are displayed: Risk — Specifies the risk level. Example: Informational. Name — Name of the service running on the port CVE — CVE ID hyperlink of the vulnerability that displays more information on the vulnerability