What's new

New features

This release of the Trellix Intrusion Prevention System includes the following new feature:

Introducing Trellix Intrusion Prevention System Sensor - NS9600

This release of 11.1 introduces Trellix's next-generation IPS NS9600 Sensor model. The NS9600 Sensor operates at 20 Gbps, 40 Gbps, and 60 Gbps throughput depending on the license purchased. This release also offers the solution of stacking two NS9600 Sensors to achieve scalability. 120 Gbps throughput license is required for a NS9600 stack of 2 nodes to run.

The NS9600 Sensors are 1RU units equipped with the following components:

NS9600 licensing: In case of the NS9600 (standalone and in fail-over pair), a new license with a higher throughput is required to increase the throughput of the Sensor.

For NS9600 stack (2-node) or stacked Sensors in fail-over setup, you can combine multiple licenses of different capacity to achieve the throughput required and assign them to the stack. For example, you can import and assign any combination of licenses (20 + 40 + 60 Gbps) or, (60 + 60 Gbps) to achieve the throughput requirement of 120 Gbps. For more information, see Managing licenses in Trellix Intrusion Prevention System 11.1.x Installation Guide.

Unsupported features: Note that the following features are not supported in NS9600 Sensors:

For more detailed information, see Trellix Intrusion Prevention System NS9600 Sensor Hardware Guide and Trellix Intrusion Prevention System 11.1.x Product Guide.

Enhancements

This release of the Trellix Intrusion Prevention System includes the following enhancements:

Support for RSA 4096-bit key self-signed and CA-signed certificates

Starting with this release of 11.1, trust between the Manager and Sensor could also be established by using self-signed and CA-signed certificates with a 4096-bit key.

For more information, see Managing Certificates for Manager and Sensor in Trellix Intrusion Prevention System 11.1.x Product Guide

Support for DNS response fields for layer 7 data collection

In 11.1 Minor 6 release, Trellix IPS provided support for the collection of layer 7 data for DNS request fields. In this release of 11.1, Trellix IPS extends its support for the collection layer 7 data for DNS response fields as well, and the export of DNS response based L7 metadata to other Trellix products, such as Trellix Network Investigator (NI).

You can navigate to Devices → <Admin Domain Name> → Devices → <Device Name> → Setup → Advanced → L7 Data Collection page and enable L7 data collection for DNS request and response fields per interface or sub-interface of selected Sensors.

Note

To view or customize both DNS request and response fields, you need to use Manager and Sensor that are running on 11.1 Update 7 release versions, and a compatible signature set (11.10.23.3 and above) with DNS related attack signatures.

For more information, Enable Layer 7 Data Collection for an interface or sub-interface in Trellix Intrusion Prevention System 11.1.x Product Guide.

Introduction of SmartVision attacks

Trellix IPS now includes SmartVision attacks, a new set of native IPS attack definitions. These attacks generate base events that allow for more comprehensive and effective detection and correlation of network activities and potential threats, particularly for the lateral movement, when the integration between Trellix IPS and Trellix NI is enabled.

SmartVision attack definitions are included in the IPS signature set and automatically added into the default IPS policies (except Default DoS and Reconnaissance Only policy) with severity levels set to Low and higher, when a compatible signature set is in use.

When a SmartVision alert/attack is detected in any customer network environment, Manager sends the relevant alert data in JSON format to Trellix NI. NI consumes and utilizes these base events that enable it to perform more effective threat detection and correlation.

Note the following when you start working with SmartVision attacks:

For more information, see Harnessing SmartVision attacks for effective threat detection and response in Trellix Intrusion Prevention System 11.1.x Product Guide.

Terminology updates in the UI