---
title: "What's new"
slug: "what-s-new-37"
tags: ["Release Notes", "IPS 11.1.x"]
updated: 2026-10-02T12:52:33Z
published: 2026-10-02T12:52:33Z
canonical: "docs.trellix.com/what-s-new-37"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trellix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# What's new

### New features

This Trellix Intrusion Prevention System release includes the following new features:

**New performance monitoring capabilities**

With the 11.1 Update 9 release, you can now monitor the **Packets** usage and **Inspection Time** from **Performance Charts**. You can access it through **Device** → **<Admin Domain Name>** → **Devices** → **<Device Name>** → **Troubleshooting** → **Performance Charts**. This functionality is supported on NS3600, NS7500, NS7600, NS9500, NS9600, IPS-VM600, IPS-VM600-SSL, IPS-VM5000, and IPS-VM5000-SSL Sensors.

The new **Packets** and **Inspection Time** metrics are explained below:

**Packets** - You can view the number of packets transferred within a specified time frame. By default, the system displays device-level packet data. To access port-specific data, select **Port** from the available drop-down menu.

You can customize your view of network packets by selecting or deselecting any of the five available size ranges: Total, 0-64, 65-127, 128-255, and 256-511. By default, all ranges are displayed. For any chosen interface, the system displays the number of packets in the format: **<Device Name>**, **<Number> packets of <packet size range>**, and time in **MMM DD HH:MM:SS YYYY**.

**Inspection Time** - You can monitor the total inspection time, along with the inspection time contributed by each of the top 5 contributors. By default, the system does not display the top five contributors to this delay. To enable the visibility of these top five contributors, select the **Top 5 Contributors** checkbox.

For any chosen interface, the system displays the inspection time in the format: **<Device Name>**, **<time in microseconds> Inspection Time <contributor details>**, and time in **MMM DD HH:MM:SS YYYY**.

For more information, see [Performance metrics](/network-and-platform/docs/performance-metrics) in Trellix Intrusion Prevention System 11.1.x Product Guide.

**OpenID Connect (OIDC)-based Identity Provider (IdP) authentication in the Manager**

Starting with this release, the Manager supports user authentication through an OpenID Connect (OIDC)-based Identity Provider (IdP) to enhance security and streamline the user login experience with Single Sign-On (SSO) capabilities. This allows users to log in to the Manager with their IdP credentials, including Multi-Factor Authentication (MFA) if enabled. Supported IdPs are Okta, Microsoft Entra, and Google IdP.

Before configuring IdP authentication in the Manager, ensure the following requirements are met:

- The Manager client application must be registered with the IdP. This process provides the necessary Client ID and Client Secret keys required for the IdP server configuration in the Manager.

> [!NOTE]
> Note
> 
> You need to have access to IdP with required privileges to register the IPS Manager client application. Or else, contact your IdP system administrator and request for the registration.
- Users must have an active account with the required IdP and be assigned appropriate user profile and user policy by their IdP system administrator so that they can access the Manager using IdP credentials.
- A proxy server must be configured in the Manager for internet access.

Enabling IdP authentication is a two-step process:

1. Configure IdP Server(s) in Manager using the **Manager** → **<Admin Domain Name>** → **Setup** → **GUI Access** → **IdP Authentication** page.
2. Add a user with **ODIC** as **Authentication Type**, specifying their **IdP User Name**, email address (which must match the one configured in IdP), and assigning them a role (barring **No Role**).

If **Allow IdP access only?** option is enabled during the IdP server configuration, users are directly authenticated by the configured IdP on accessing the Manager. Otherwise, they can choose between the local Manager login and IdP-based login.

For more information, refer to Leveraging OIDC for IdP Authentication in the Manager in Trellix Intrusion Prevention System 11.1.x Product Guide.

**New alert and audit notifications in syslog messages**

From this 11.1 release, a new token **$IV_MANAGER_DETAILS$** is introduced to display the hostname and IP addresses of the Manager. You can access it from **Manager** → **<Admin Domain Name>** → **Setup** → **Notification** → **IPS Events** → **Syslog** and **Manager** → **<Admin Domain Name>** → **Setup** → **Notification** → **User Activity** → **Syslog**. For an MDR setup, it further specifies if the Manager is "primary" or "secondary".

For more information, see Add a Syslog notification profile to forward alerts and Forward audit information to Syslog Server in Trellix Intrusion Prevention System 11.1.x Product Guide.

### Enhancements

This Trellix Intrusion Prevention System release includes the following enhancements:

**Enhanced throughput monitoring capabilities**

Starting with this 11.1 release, the unit used for plotting the device throughput charts is Mbps. This functionality is supported on NS3600, NS7500, NS7600, NS9500, NS9600, IPS-VM600, IPS-VM600-SSL, IPS-VM5000, and IPS-VM5000-SSL Sensors. The **Maximum**, **Average**, or **Minimum** summarized data are replaced with **Average** and **Peak** throughput usage at both device and port levels. The data update frequency has improved from every 3 minutes to every 30 seconds.

For more information, see [Performance metrics](/network-and-platform/docs/performance-metrics) in Trellix Intrusion Prevention System 11.1.x Product Guide.

**NS7600 20 Gbps licensing support**

This 11.1 release now enables the NS7600 Sensor model to achieve 20 Gbps throughput. This significant performance upgrade is designed to support more demanding network environments. However, this enhanced 20 Gbps throughput does not apply when the Sensor is functioning in a failover pair.

For more information, see NS7600 Sensor capacity in Trellix Intrusion Prevention System 11.1.x Product Guide.

**Enhanced SNMP scalability**

From this 11.1 release, while adding NMS users and IP addresses from **Devices** → **<Admin Domain Name>** → **Devices** → **<Device Name>** → **Setup** → **Remote Access** → **NMS**, you can add a maximum of 50 users, IPv4, and IPv6 addresses.

For more information, see [Management of NMS users](/network-and-platform/docs/management-of-nms-users-2) in [Trellix Intrusion Prevention System 11.1.x Installation Guide](/network-and-platform/docs/installing-trellix-intrusion-prevention-system-2).

**Enhanced fault notifications in syslog messages**

From this 11.1 release, **$IV_DEVICE_NAME$** will also display the hostname and IP addresses of the Manager. You can access it from **Manager** → **<Admin Domain Name>** → **Setup** → **Notification** → **Faults** → **Syslog**. For an MDR setup, it further specifies if the Manager is "primary" or "secondary".

For more information, see [Forward faults to a Syslog server](/network-and-platform/docs/forward-faults-to-a-syslog-server-1) in Trellix Intrusion Prevention System 11.1.x Product Guide.

**Enhanced security for User Accounts**

Starting with the 11.1 Update 9 release, all information displayed in the user details panel is encrypted. This signifies that sensitive user data, including personal information and account credentials, is now protected through encryption, thereby strengthening user privacy and overall security.

For more information, see [How to view user account information](/network-and-platform/docs/how-to-view-user-account-information) in Trellix Intrusion Prevention System 11.1.x Product Guide.

**Denial of Service (DoS) profile support at member Sensor level in stack and stack failover configurations**

With this release of 11.1, Denial of Service (DoS) management, profiles, and filters are now supported at the individual member Sensor level within stack and stack failover configurations for NS9600 and NS9500 models.

In these environments, each Sensor node independently learns DoS profiles and applies response actions based on the traffic it processes, regardless of the node via which the traffic entered the stack. Because the learning is independent, the resulting actions are also independent for each node. For example, if a DoS bin in the profile is marked as block in one node, the other node could still forward traffic on the subnets of that bin, till it also learns that subnet to block.

> [!WARNING]
> Important
> 
> Changing the learning mode on one member Sensor (e.g., forcing detection or rebuilding a profile) automatically applies the same configuration to the other Sensor in a failover pair or to all other Sensors in a stack or stack failover setup.

You can access the DoS settings for each member Sensor in stack or stack failover setup by navigating to **Devices** → **<Admin Domain Name>** → **Devices** → **<Device Name>** → **Member Sensors** → **<Stackname-node id>** → **Troubleshooting** → **Denial of Service** → **Profiles | Data Management | Filters** in the Manager.

For more information, refer to [What is a DoS Profile](/network-and-platform/docs/what-is-a-dos-profile) in Trellix Intrusion Prevention System 11.1.x Product Guide.

### Terminology updates in the UI

| **Navigation Path** | **Prior to 11.1.7.136** | **11.1.7.136 and later** |
| --- | --- | --- |
| **At domain level**: **Devices** → **<Admin Domain Name>** → **Global** → **IPS Device Settings** → **IVX Integration** → **Enable IVX Integration** → **Enable IVX Cloud** **At device level**: **Devices** → **<Admin Domain Name>** → **Devices** → **<Device Name>** → **Setup** → **IVX Integration** → **Enable IVX Integration** → **Enable IVX Cloud** | The hostname for IVX Cloud service is preconfigured and is not editable. | You can enter the hostname for IVX Cloud service manually. |
| **Manager** → **<Admin Domain Name>** → **Integration** → **GTI** | Go to **Endpoint/URL Reputation** and view **Public GTI Endpoint/URL Reputation Queries**, the link is displayed as **https://nsp.repl.gti.trellix.com**. | Go to **Endpoint/URL Reputation** and view **Public GTI Endpoint/URL Reputation Queries**, the link is displayed as **https://ips.repm.gti.trellix.com**. |

### IPS CLI enhancements

The following Sensor CLI commands are updated:

**Debug Mode**

| **Command** | **Description** |
| --- | --- |
| `getnistats` | Several counters have been added to identify specific errors and statistics related to exporting data to the Trellix Network Investigator (NI), such as the following: - Counters to track the Sensor's configuration polling requests to the NI device, including total requests, successes, failures, and specific errors like invalid tokens, timeouts, or gateway errors - Counters for the export of Netflow and Metadata, which include total POST requests, export successes and failures, various timeouts, and connection errors such as authentication failures or bad gateway responses - Counters that monitor the success and failure of creating the necessary Netflow and Metadata templates - Counters for the Sensor's internal data handling, including memory map (memmap) enqueue success and failure, discarded messages, and errors related to invalid data or system function failures |
| `ninetflowstat` | Some of the counters that have been added are the following: - Counters to track the lifecycle of memory buffers (mbufs) used for Netflow and Metadata, including successful allocations, frees, and their corresponding failures - Count of total Netflows and Metadata ring enqueue failures from l7ae to NI - Counters for other issues, such as `Total Netflow send failed` and `Total Metadata invalid event type`. |

### Updated platform, environment, or operating system support

This release provides the following enhancements related to platforms, environments, or operating systems:

**MariaDB upgrade**

Starting with this release of 11.1, the IPS Manager uses MariaDB version 10.11.11, which includes additional security against new vulnerabilities and bug fixes.

**Apache Tomcat server upgrade**

With this release of 11.1, the Tomcat server used in the Manager is upgraded to version 9.0.104. This server update provides a collection of security fixes.