What's new

New features

This release of the Trellix Intrusion Prevention System does not include any new features.

Enhancements

This release of the Trellix Intrusion Prevention System includes the following enhancements:

Support for RSA 4096-bit key self-signed and CA-signed certificates

Starting with this release of 11.1, trust between the Manager and Sensor could also be established by using self-signed and CA-signed certificates with a 4096-bit key.

Note

When deploying the device in a CC configuration, you must use only the RSA 2048-bit key.

For more information, see Managing Certificates for Manager and Sensor in Trellix Intrusion Prevention System 11.1.x Product Guide

Support for DNS response fields for layer 7 data collection

In 11.1 Minor 6 release, Trellix IPS provided support for the collection of layer 7 data for DNS request fields. In this release of 11.1, Trellix IPS extends its support for the collection layer 7 data for DNS response fields as well, and the export of DNS response based L7 metadata to other Trellix products, such as Trellix Network Investigator (NI).

You can navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Setup → Advanced → L7 Data Collection page and enable L7 data collection for DNS request and response fields per interface or sub-interface of selected Sensors.

Note

To view or customize both DNS request and response fields, you need to use Manager and Sensor that are running on 11.1 Update 7 release versions, and a compatible signature set (11.10.23.3 and above) with DNS related attack signatures.

For more information, Enable Layer 7 Data Collection for an interface or sub-interface in Trellix Intrusion Prevention System 11.1.x Product Guide.

Introduction of SmartVision attacks

Trellix IPS now includes SmartVision attacks, a new set of native IPS attack definitions. These attacks generate base events that allow for more comprehensive and effective detection and correlation of network activities and potential threats, particularly for the lateral movement, when the integration between Trellix IPS and Trellix NI is enabled.

SmartVision attack definitions are included in the IPS signature set and automatically added into the default IPS policies (except Default DoS and Reconnaissance Only policy) with severity levels set to Low and higher, when a compatible signature set is in use.

When a SmartVision alert/attack is detected in any customer network environment, Manager sends the relevant alert data in JSON format to Trellix NI. NI consumes and utilizes these base events that enable it to perform more effective threat detection and correlation.

Note the following when you start working with SmartVision attacks:

For more information, see Harnessing SmartVision attacks for effective threat detection and response in Trellix Intrusion Prevention System 11.1.x Product Guide.

Terminology updates in the UI