Trellix IPS includes a variety of pre-configured security policies targeting different environments. These policies enable you to start monitoring your network right away.
Install the Manager as described in Trellix Intrusion Prevention System Installation Guide.
The Default Prevention policy is applied by default. You can leave this policy in place or pick the policy that best matches your needs. The Sensor you add will inherit this policy and pass it along to all interfaces of the Sensor.
Note
This policy enables blocking for certain attacks; immediately upon in-line deployment, Sensors will begin blocking these attacks when they are detected.
Configure the Sensor and add it to the Manager as described in Trellix Intrusion Prevention System Sensor Reference Guide, and Trellix Intrusion Prevention System Installation Guide.
On the Manager, check the Sensor's port configuration to be sure that it matches the way you have deployed the Sensor. Make changes as necessary.
Download and apply the latest Sensor software and signature file from the Update Server.
Send all configuration changes to the Sensor.
If you want, set up alert notification to email or pager by attack severity.
Using the information and features available in the Dashboard and Analysis pages, examine the resulting alerts for patterns to help you tune your policies.
Back up your data.