Trellix IPS supports collecting Layer 7 data for all major protocols such as HTTP, FTP, and SMTP. In case of SMTP, it could be the sender's address, recipient's address, and attachment name. This information is needed for forensic analysis.
L7 data collection is enabled by default. The percentage of maximum number of concurrent flows with Layer 7 data varies by Sensor model.
The default value is set to 20% for NS9300, NS9200, NS9100, NS7350, NS7300, NS7250, NS7200, NS7150, NS7100, NS5200, NS5100, NS3500, NS3200, and NS3100 Sensors.
The default value is set to 100% for NS9500 and NS7500 Sensors.
Note
In case of an upgrade, the previous default value i.e., 20% or configured custom value is retained.