Trellix IPS considers any unauthorized action taken with the intent of hindering, damaging, incapacitating, or breaching the security of your network as an attack. An attack typically prepares for or carries out threats to your critical assets. Attacks can be active, wherein the goal is to directly exploit some vulnerability in a system or software package. In contrast, passive attacks generally consist of monitoring or eavesdropping on traffic with the intention of viewing or capturing sensitive data.
The result of a successful active attack is an intrusion-disruption of the normal services, unauthorized access, and/or some form of tampering with the system. When you install Trellix IPS in the prevention (IPS) mode, it detects and blocks attacks. In the detection (IDS) mode, it reports the attacks. However, based on the type of attack, the attack traffic might have reached the intended target.