Trellix Endpoint Security unrestricted port blocking rule violation detected
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
Goal
Identify port blocking rule violations detected by Trellix Endpoint Security that were logged but not blocked by Trellix itself. These unblocked may indicate potential unauthorized network access.
Strategy
Monitor for logged violations of port blocking rules that were not acted upon. These events may indicate attempts to communicate through blocked ports, which could suggest malicious activities.
Triage and Response
- Review the details of the port blocking rule violation, including the specific port and application involved.
- Analyze the event information to understand why the violation was not blocked.
- Investigate the impacted endpoint using its hostname -
{{@attributes.analyzerhostname}} and IP address - {{@attributes.analyzeripv4}}. - Assess the risk associated with the violation and determine appropriate actions, such as enhancing network security policies.
- Continue monitoring for similar violations to prevent unauthorized access attempts.
