Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Consult with the ISSO/ISSM to review the organizational-specific written policy for the Trellix Application Control software. If no written policy exists, this is a finding.
Document fully the written policy for the Trellix Application Control software, to include processes for password management, vetting application for whitelist/blocking, frequency of reviewing application whitelist, and settings for other requirements in this STIG. Submit the written policy to be initially approved by and maintained by the Information System Security Officer/Information System Security Manager (ISSO/ISSM/AO) at that location. Formalize a change control process to ensure changes to the written policy are made in a controlled manner. Formalize a review process requiring signed acceptance by the ISSO/ISSM/AO for any changes made to the written policy. If a formal Change Advisory Board (CAB) or Configuration Control Board (CCB) exists, the Trellix Application Control written policy must be under the CAB/CCB oversight.
Note: The CLI Access is in lockdown mode by default when being managed by ePO. Since the CLI Access can be recovered for troubleshooting, this requirement needs to be met. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for how and when the Solidcore CLI is used by the organization. If the use of the CLI is not documented in the organization's written policy, this is a finding.
Follow the formal change and acceptance process to update the organization's written policy with the use of the CLI.
Note: The CLI Access is in lockdown mode by default when being managed by ePO. Since the CLI Access can be recovered for troubleshooting, this requirement needs to be met. Since the Solidcore CLI does not allow for technical enforcement of password complexity the enforcement will be via this written policy directive. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for CLI password complexity requirements. Verify the policy requires the password to be 15 characters in length and contain a mix of at least one lowercase, one uppercase, one number, and one special character. If the written policy does not document the requirement for password complexity and/or does not specify the password must be 15 characters in length and contain a mix of at least one lowercase, one uppercase, one number, and one special character, this is a finding.
Follow the formal change and acceptance process to update the written policy with the CLI password complexity requirements.
Note: The CLI Access is in lockdown mode by default when being managed by ePO. Since the CLI Access can be recovered for troubleshooting, this requirement needs to be met. Consult with the ISSO/ISSM to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for how the Solidcore client interface is used by the organization. Verify the policy identifies how the CLI password is protected. Ask the ePO admin, "What protection measures are used for the CLI password?" The protection measures should include, at a minimum, storage in a sealed envelope, which is then stored in an approved safe. Note: The envelope will contain the last access date along with those authorized to use it. If the written policy does not contain specific information on how the CLI password is protected and/or if that policy does not include, at a minimum, that the password be stored in a sealed envelope in an approved safe with the last access date noted, this is a finding.
Follow the formal change and acceptance process to update the written policy with specific information on how the CLI password is protected and that the password must be stored in a sealed envelope in an approved safe with the last access date noted.
Note: The CLI Access is in lockdown mode by default when being managed by ePO. Since the CLI Access can be recovered for troubleshooting, this requirement needs to be met. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for how the Solidcore client interface is used by the organization. Verify the policy identifies the frequency with which the CLI password is changed. If the written policy does not contain specific information on frequency with which the CLI password is changed, this is a finding.
Follow the formal change and acceptance process to update the written policy with specific information on the frequency with which the CLI password is changed.
Note: The CLI Access is in lockdown mode by default when being managed by ePO. Since the CLI Access can be recovered for troubleshooting, this requirement needs to be met. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to obtain a copy of the organization's documented policy for application whitelisting. The policy must contain procedures for accessing the CLI password, to include the system administrator (SA) gaining access to an approved safe in order for obtaining the password. If a procedure does not exist for accessing the CLI password as described above, this is a finding.
Follow the formal change and acceptance process to update the written policy to include procedures for accessing the CLI password and how the SA gains access to an approved safe in order for obtaining the password.
If an ATD server is not being used in the environment, this is Not Applicable. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to review the written policy to ensure the usage of an ATD is documented. If the usage of an ATD is not documented in the written policy, this is a finding. Determine the location of the ATD being used by the organization and verify the ATD is confined to the organization's enclave. If the location of the ATD being used by the organization cannot be determined and the ATD is not confined to the organization's enclave, this is a finding.
Relocate or reinstall the ATD being used by the organization to be confined to the organization's enclave.
Consult with the ISSO/ISSM to obtain a copy of the organization's documented policy for application whitelisting. Review the written policy for how the Solidcore client interface is used by the organization. Verify the written policy identifies whether additional features are enabled or not under "Enforce feature control" of the Trellix Application Control Options ePO policy. If the written policy does not identify whether additional features are enabled or not under "Enforce feature control" of the Trellix Application Control Options ePO policy, this is a finding.
Follow the formal change and acceptance process to document any features needing to be enabled.
Consult with the ISSO/ISSM to review the organizational-specific written policy for the Trellix Application Control software. Verify the written policy includes a process for how applications are vetted and deemed to be allowed. If no written policy exists, this is a finding. If written policy does not include a process for vetting applications before allowing them, this is a finding.
Follow the formal change and acceptance process to update the written policy to include a process for how applications are vetted and deemed to be allowed.
Consult with the ISSO/ISSM to review the organizational-specific written policy for the Trellix Application Control software. Verify the written policy includes a process for how often the application whitelist is reviewed. If no written policy exists, this is a finding. If written policy does not include a process for how often the application whitelist is reviewed, this is a finding.
Follow the formal change and acceptance process to update the written policy to include a process for how often the application whitelist is reviewed.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy and view its properties. Click on the "Products" tab. Under "Product", verify the Solidcore 8.x client is listed as a product. If exists, click on the row to review additional information. Verify status shows "Enabled". If the Solidcore 8.x client is listed as an installed product but the status is not "Enabled", this is a finding.
Although there is more than one way to deploy and enable the Solidcore client, the following is the method described in the Trellix Application Control Installation Guide. From the ePO server console System Tree, select "My Organization" in the System Tree. To deploy the Solidcore 8.x client: Select "This Group and All Subgroups". Select the asset and view its properties. Click on the "Actions" button at the bottom of the screen. Select "Agent". Select "Modify Tasks on a Single System". Click "Actions". Select "New Client Task Assignment" to open the "Client Task Assignment Builder" page. Specify the task name and add descriptive information. Select the target platform, subplatform, and version. Select the "Solidcore 8.0.0" product from the "Products and components" list. Select the "Install" action. Select the language of the package. Specify the branch where to add the package. Click "Save", then click "Next to open the "Schedule" page. Specify scheduling details, then click "Next". Review details, then click "Save". To enable the Solidcore 8.x client and scan for inventory: Select "This Group and All Subgroups". Select the asset and view its properties. Click on the "Actions" button at the bottom of the screen. Select "Agent". Select "Modify Tasks on a Single System". Click "Actions". Select "New Client Task Assignment" to open the "Client Task Assignment Builder" page. Select the "Solidcore 8.0.0" product and "SC: Enable" task type, then click "Create New Task".
Determine CLI status. Access the system being reviewed. From an operating system command line, execute the following command: sadmin status <enter> If the status for CLI is "Allowed" or "Recovered", this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Click "Actions". Select "New Client Task Assignment" to open the Client Task Assignment Builder page. Select the "Solidcore 8.x product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page. Change "CLI status" to "Restrict". Click "Save".
This is a manual procedure to verify the CLI Access Password has been changed from its default setting by the ePO administrator. Ask the ePO admin, "Has the CLI Access Password been changed from its default setting?" If the default password is being used, this is a finding. Note: The password does not need to be divulged during the review. An interview question of the SA to validate that it is not the default is sufficient.
Change the CLI password with one other than the default, using administrative password complexity. From the ePO server console System Tree, select "My Organization". In the "Configuration (Client)" category, click on the Organization's specific Configuration (Client) Trellix Default policy. In the "CLI" tab, type a password other than the default, ensuring to conform to password complexity. Confirm the password. Click "Save".
Obtain the organization's written policy for the Trellix Application Control software from the System or ePO Administrator. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Note: The organization specific rules policy is for additional allowed applications. In the event there are Trellix Default rules that need to be excluded in an organization or on a specific asset, a copy of the Trellix Default must be used in place of the Trellix Default rules policy. In that copy, only the specific rules should be removed that the organization wants to deny. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select "Solidcore 8.x: Application Control". For the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. Identify the organization-specific Rules policy applied to the system being reviewed. Click on "Edit Policy" beside the organization-specific Rules policy. Verify the list of applications under each of the "Rules Groups" in the organization-specific Rules policy against the written policy's list of allowed applications. If the organization-specific Rules policy contains any applications not documented in the written policy as allowed, this is a finding.
Obtain the organization's written policy for the Trellix Application Control software from the System or ePO Administrator. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. Remove any "Rules Groups" and/or applications under the "Rules Groups" that do not comply with the organization's written policy. If applications are required, follow the formal change and acceptance process to document the applications in the organization's written policy.
Note: This requirement is Not Applicable on a classified SIPRNet or otherwise closed network. This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Verify the "Use Trellix Global Threat Intelligence (Trellix GTI)" option is selected. Note: The "Trellix GTI" option must be selected, as a failover, even if an internal Trellix TIE server is configured. If the "Trellix GTI" option is not selected, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Place a check in the "Use Trellix Global Threat Intelligence (Trellix GTI)" option. Click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. If Reputation-Based Execution settings is not enabled, this check is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Verify the "Reputation-Based Execution Settings" is configured to allow binaries with "Most Likely Trusted" and above. If the allow binaries "Most Likely Trusted" and above is not selected for "Reputation-Based Execution Settings", this is a finding.
If Reputation-Based Execution settings is not enabled, this check is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Place a check in the "Reputation-Based Execution Settings: Allow binaries with" check box and select "Most Likely Trusted" from the drop-down selection box. Click "Save".
If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Verify the option for sending binaries for analysis under the "Advanced Threat Defense (ATD) settings" is selected. Consult with the information system security officer (ISSO)/information system security manager (ISSM) to review the written policy to verify the usage of an ATD is documented. If the option for sending binaries for analysis under the "Advanced Threat Defense (ATD) settings" is selected and the written policy does not include documentation on the usage of an ATD, this is a finding.
If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. Place a check in the "Advanced Threat Defense (ATD) settings: Send binaries" check box. Click "Save". Update the written policy to ensure the usage of an ATD is documented.
This requirement is only applicable to Windows platforms. For Mac and Linux platforms, this is Not Applicable. If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. If the option for sending binaries for analysis under the "Advanced Threat Defense (ATD) settings" is selected, verify the level of binaries to be sent for analysis is "Might be Trusted" and below. If the level of binaries to be sent for analysis is not "Might be Trusted", this is a finding.
If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. In the drop-down selection box of the "Advanced Threat Defense (ATD) settings: Send binaries" option, select "Might be Trusted". Click "Save".
This requirement is only applicable to Windows platforms. For Mac and Linux platforms, this is Not Applicable. If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. If the option for sending binaries for analysis under the "Advanced Threat Defense (ATD) settings" is selected, verify the "Limit file size to" option is set to 5 MB or less. If the "Limit file size to" option is not set to 5 MB or less, this is a finding.
If an ATD server is not being used in the environment, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. Select the "Reputation" tab. In the drop-down selection box of the "Advanced Threat Defense (ATD) settings: Limit file save" text box, enter a value of 5 MB or less. Click "Save".
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)" that is specific for the asset being reviewed. If the only "Application Control Options" policy applied to the system is the "Trellix Default" policy, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Actions" column, select "Edit Assignment" for the "Application Control Options (Windows) Category". Next to "Assigned policy:", click on drop-down selection box and choose an organization-specific Application Control Options policy for the asset being reviewed. Click "Save". If no organization-specific Application Control Options policy exist, click on "New Policy". Choose "Trellix Default" for "Create a policy based on this existing policy". Type a unique Policy Name. Click "OK". Configure the "Self-Approval", "End User Notifications", "Features", "Inventory", and "Reputation" tabs according to the organization's written policy and remaining STIG settings.
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Self-Approval" tab, verify the "Enable Self-Approval" check box is not selected. If the "Enable Self-Approval" check box is selected, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Self-Approval" tab, de-select the "Enable Self-Approval" check box. Click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. If "End User Notification" is not used by the organization, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "End User Notification" tab, determine if the "User Message:" option "Show the messages dialog box when an event is detected and display the specified text in the message." is selected. If "Show the messages dialog box when an event is detected and display the specified text in the message." is not selected, this is Not Applicable. If "Show the messages dialog box when an event is detected and display the specified text in the message." is selected, consult with the ISSO/ISSM to review the organizational-specific written policy for the Trellix Application Control software. Verify the usage of "End User Notification" is documented in the written policy and verify criteria for configuration. If "End User Notification:" variables are not configured to written documentation, this is a finding. If "End User Notification" is not documented in written policy, this is a finding.
If "End User Notification" is not used by the organization, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "End User Notification" tab, select or de-select the "Show the messages dialog box when an event is detected and display the specified text in the message." based upon organization's written policy. If "Show the messages dialog box when an event is detected and display the specified text in the message." is de-selected based upon written policy, populate "Helpdesk Information" with information from the written policy. Click "Save". If "Show the messages dialog box when an event is detected and display the specified text in the message." is selected based upon written policy, populate "Helpdesk Information" with information from the written policy. Click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset(s) that need the organization-specific policy. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Features" tab, review options selected. If the "Enforce feature control" check box is not selected and/or "Memory protection" is selected, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Features" tab, place a check in the "Enforce feature control" check box. Remove the check in the "Memory protection" check box. Select or de-select remaining features, based upon written policy. Click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Features" tab, review options selected. If the "Enforce feature control" check box is selected with any features, consult with the ISSO/ISSM to review the written policy and ensure the usage of additional features are documented. If the usage of additional features are not documented in the written policy, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Features" tab, remove any features selected. If features are required technically that are not documented in the organization's written policy, document the use of those features following the formal change and acceptance process as documented in the organization's written policy.
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Inventory" tab, review options selected. If the "Hide Windows OS Files: Inventory items signed with Microsoft certificates will not be sent to Trellix ePO." option is not selected, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. From the "Policy" column, select the policy associated with the Category "Application Control Options (Windows)". On the "Inventory" tab, place a check in the "Inventory: Hide Windows OS Files: Inventory items signed with Microsoft certificates will not be sent to Trellix ePO." check box. Click "Save".
Note: For VDI workstations that are reset copies of a VDI master image, this requirement is Not Applicable. For VDI master images, once an inventory is pulled after updates, further inventory is not required. Note: This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. Consult with the ISSO to determine the endpoints used for the sampling of inventory pulls. From the Trellix ePO console, select Menu >> Systems >> System Tree. If sampling is a group, select the group in the System Tree and switch to the “Assigned Client Tasks” tab. Otherwise, select each endpoint on the “Systems” page and then click Actions >> Agent >> Modify Tasks on a Single System. Confirm a client task exists with an “SC: Pull Inventory” task type. Review the task properties to validate the task is configured to run at least as frequently as every seven days and tasks randomize the inventory pulls. If a sampling of endpoints does not have a “Pull Inventory” task type applied and/or the “Pull Inventory” task is not configured to run at least as frequently as every seven days at randomized intervals, this is a finding.
From the Trellix ePO console, select Menu >> Systems >> System Tree. To apply a client task to a group, select a group in the System Tree and switch to the "Assigned Client Tasks" tab. To apply a client task to an endpoint, select the endpoint on the "Systems" page and then click Actions >> Agent >> Modify Tasks on a Single System. Click Actions >> New Client Task Assignment to open the "Client Task Assignment Builder" page. Select "Solidcore 8.x" for the product and "SC: Pull Inventory" for the task type and then click "Create New Task" to open the "Client Task Catalog" page. Specify the task name and add any descriptive information. Click "Save". Click "Next" to open the "Schedule" page. Schedule the task to run at least as frequently as every seven days and then click "Next". Review and verify the task details and then click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. Verify that the Trellix Applications Default Rules policy is part of the assigned policies applied to the system being reviewed. If the Trellix Applications Default Rules policy is not part of the assigned polices applied to the system being reviewed, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. Click on the "New Policy Instance" button at the bottom of the screen. Scroll down to locate the new policy instance just created. Click on the drop-down selection box for "Assigned policy:" and choose "Trellix Applications (Trellix Default)". Select the "Locked (prevent breaking inheritance below this point)" radio button. Click "Save".
This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. Verify that a Rules policy copied from the Trellix Default Rules policy is part of the assigned policies applied to the system being reviewed. If a Rules policy copied from the Trellix Default Rules policy is not part of the assigned policies applied to the system being reviewed, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. Click on the "New Policy Instance" button at the bottom of the screen. Scroll down to locate the new policy instance just created. Click on the drop-down selection box for "Assigned policy:" and choose "Trellix Default)". Select the "Locked (prevent breaking inheritance below this point)" radio button. Click "Save".
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For Windows Platforms, select the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. For MAC/Linux Platforms,select the "Application Control Rules (Unix)" Category, click on "Edit Assignments" under the "Actions" column. Verify that there exists at least one organization-specific Rules policy as part of the assigned policies applied to the system being reviewed. If an organization-specific Rules policy is not part of the assigned polices applied to the system being reviewed, this is a finding. If the only "Application Control Rules" policy applied to the system is the "Trellix Default" policy, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: Application Control. For Windows Platforms, for the "Application Control Rules (Windows)" Category, click on "Edit Assignments" under the "Actions" column. For MAC/Linux Platforms, for the "Application Control Rules (Unix)" Category, click on "Edit Assignments" under the "Actions" column. Click on the "New Policy Instance" button at the bottom of the screen. Scroll down to locate the new policy instance just created. Click on the drop-down selection box for "Assigned policy:" and choose the organization-specific policy for the system being reviewed. If one does not exist, click "New Policy" and create a new policy based upon organization's written policy. Click "Save".
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization. If the only "Configuration (Client)" policy applied to the system is the "Trellix Default" policy, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Actions" column, select "Edit Assignment" for the "Solidcore (Client)" Category. Next to "Assigned policy:", click on the drop-down selection box and choose an organization-specific "Solidcore (Client)" policy. Click "Save". If no organization-specific Solidcore (Client) policy exists, click on "New Policy". Choose "Trellix Default" for "Create a policy based on this existing policy". Type a unique Policy Name. Click "OK".
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab. Verify the "Enable Throttling" check box is selected. Verify the throttling settings are configured according to organization's written policy. If the "Enable Throttling" check box is not selected, this is a finding. If the throttling settings do not match the organization's written policy or the settings are not documented in the written policy, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab. Place a check in the "Enable Throttling" check box. Configure the throttling settings based upon organization's written policy. Click "Save".
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset to be validated. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. For Windows platforms, from the "Policy" column, select the policy associated with the Category "Exception Rules (Windows)" that is specific to the organization. For Unix Platforms, from the "Policy" column, select the policy associated with the Category "Exception Rules (Unix)" that is specific to the organization. If the "Exception Rules" policy applied to the system has exceptions documented, verify the exceptions are documented in the organization's written policy. If the Exceptions are not documented, this is a finding.
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Select "Modify Policies on a Single System". From the product pull-down list, select Solidcore 8.x: General. For Windows Platforms, from the "Policy" column, select the policy associated with the Category "Exception Rules (Windows)" that is specific to the organization. For MAC/Unix Platforms, from the "Policy" column, select the policy associated with the Category "Exception Rules (Unix)" that is specific to the organization. Remove any exceptions which are not documented in the organization's written policy. If any exceptions are required, follow the formal change and acceptance process to document the required exceptions in the organization's written policy.