Trellix IPS supports collecting Layer 7 data for all major protocols such as HTTP, FTP, DNS, SMTP, SMB, and DCERPC (over TCP only). In case of SMTP, for example, it could be the sender's address, recipient's address, and attachment name. This information is needed for forensic analysis.
L7 data collection is enabled by default. The percentage of maximum number of concurrent flows with Layer 7 data varies by Sensor model.
The default value is set to 20% for NS9300, NS9200, NS9100, NS7350, NS7300, NS7250, NS7200, NS7150, NS7100, NS5200, NS5100, NS3500, NS3200, NS3100 Sensors, and Virtual IPS Sensors.
The default value is set to 100% for NS9600, NS9500, NS7600, NS7500, and NS3600 Sensors.
Note
In case of an upgrade, the previous default value i.e., 20% or configured custom value is retained.