Core attribute

The additional information displayed in the Endpoint Information section is shown in the following table.

• Network Forensics — Click this tab to analyze the network behavior of the endpoint when NTBA is configured.

  
  
  

  You can filter your view by choosing the time and date of your choice.

  
  
  

  You can view the data according to your time preference by selecting the time period from the drop-down list. You can use the icon to view the details before and after any event/attack.

  
  
  

  The following table shows the information displayed in the Network Forensics section.

  Item	Description
  Summary	Endpoint summary that includes IP address, country of the endpoint, etc. View the client connections from this endpoint that include the TCP services, UDP services, etc. View the server connections to this endpoint that include the TCP services, UDP services, etc.
  Suspicious Flows
  Suspicious activity indicator	View indicators that map to an event like an alert or attack.
  IP Address	Specify an IP address and use Search to view flows for this address.
  Time	Displays the date and time when the suspicious flow for an event occurred Tip You can sort the flows view based on time.
  Suspicious Activity	Displays the indicator that specifies the suspicious activity performed like an URL accessed that was involved in another attack, blocked executable accessed and others
  Source	Specifies the source from which the flow was initiated for an endpoint. Details include endpoint and ports used.
  Destination	Specifies the destination details like endpoint involved and port
  Applications	Displays the applications accessed from the endpoint
  Attack	Attacks for a specific endpoint that include attack name and result
  File / URL Accessed	Specifies file or URL access details for a specific endpoint

  To close the network forensics page, click the icon.

  For more information, see the section Using context-aware data for network forensics.

• Quarantine — Use this option to block all the traffic originating from the specified IP address seen on the selected device for the selected time.

  
  
  

  To quarantine endpoints to block all the traffic originating from the specified IP address:

  Option	Definition
  IP Address	Enter the IP address of the endpoint.
  Device	Select the specific device of the endpoint whose traffic originating from the IP address you want to block.
  Quarantine Duration	Select the quarantine duration from the drop-down list.
  Remediate	Select the checkbox to redirect the configured endpoint to the configured remediation portal. Note You can configure the remediation portal settings in Devices → Global → IPS Device Settings → Quarantine → Remediation Portal Remediation cannot be configured for IPv6 address. The checkbox and the information icon for remediation is not displayed if you enter an IPv6 address in the IP Address field.

  Click Quarantine. The endpoint is added and displayed in the Quarantine page.

• Tag (in ePO)— Use this option to assign a tag to the selected endpoint in Trellix ePO - On-prem.

  You are able to assign tags only to endpoints whose Endpoint Type denotes MANAGED. This means that the endpoint runs a suitable version of Trellix Agent and is managed by Trellix ePO - On-prem.

  To assign a tag:

  1. Select a tag from the drop-down list. If the tag you looking for does not appear in the list, click the refresh button.
  2. Click Tag.

     If the tagging is successful you receive a message stating its success. If not, you receive a failure notification.

To scan for vulnerabilities:

1. Click button to scan for vulnerabilities against the selected host.

   Note

   If the selected IP address is found in an MVM scan configuration, it displays a message to inform that the scan is successful. If the selected IP address is found in more than one available MVM scan configuration, the Scan for Vulnerabilities window is displayed.

   
   
   

2. Select an MVM configuration from the MVM Scan Configuration drop-down list.
3. Click Start Scan to run the scan.

   Note

   To refresh the configuration, click

   

   .

Note

If the selected IP address is not found in any of the MVM scan configuration, a warning message is displayed informing that the default configuration will be used for the scan. Click OK to proceed with the scan. Scan for Vulnerabilities option is available only when integration with Vulnerability Manager is enabled and if you have edit privileges to run the scan.