The Trellix Application Control Options Inventory interval option must be configured to pull inventory from endpoints on a regular basis not to exceed seven days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213341	MCAC-TE-000115	SV-213341r944855_rule		Medium

Description
When Trellix Application Control is deployed on a system, it creates a whitelist of all executable binaries and scripts present on the system. The whitelist contains all authorized files, and only files that are present in the whitelist are allowed to execute. An executable binary, script, or process that is not in the whitelist is said to be unauthorized and is prevented from running. Trellix Application Control uses a centralized repository of trusted applications and dynamic whitelisting to reduce manual maintenance effort. Running frequent Pull Inventory tasks ensures inventory information does not become stale. There must be the minimum interval between consecutive inventory pull runs (when the inventory information is fetched from the endpoints). By default, this value is seven days and is the recommended setting. Pulling at an interval of greater than seven days will allow for the inventory of endpoints to become stale.

Description

When Trellix Application Control is deployed on a system, it creates a whitelist of all executable binaries and scripts present on the system. The whitelist contains all authorized files, and only files that are present in the whitelist are allowed to execute. An executable binary, script, or process that is not in the whitelist is said to be unauthorized and is prevented from running. Trellix Application Control uses a centralized repository of trusted applications and dynamic whitelisting to reduce manual maintenance effort. Running frequent Pull Inventory tasks ensures inventory information does not become stale. There must be the minimum interval between consecutive inventory pull runs (when the inventory information is fetched from the endpoints). By default, this value is seven days and is the recommended setting. Pulling at an interval of greater than seven days will allow for the inventory of endpoints to become stale.

STIG	Date
Trellix Application Control 8.x Security Technical Implementation Guide	2023-12-18

Details

Check Text ( C-14569r944853_chk )
Note: For VDI workstations that are reset copies of a VDI master image, this requirement is Not Applicable. For VDI master images, once an inventory is pulled after updates, further inventory is not required. Note: This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable. Consult with the ISSO to determine the endpoints used for the sampling of inventory pulls. From the Trellix ePO console, select Menu >> Systems >> System Tree. If sampling is a group, select the group in the System Tree and switch to the “Assigned Client Tasks” tab. Otherwise, select each endpoint on the “Systems” page and then click Actions >> Agent >> Modify Tasks on a Single System. Confirm a client task exists with an “SC: Pull Inventory” task type. Review the task properties to validate the task is configured to run at least as frequently as every seven days and tasks randomize the inventory pulls. If a sampling of endpoints does not have a “Pull Inventory” task type applied and/or the “Pull Inventory” task is not configured to run at least as frequently as every seven days at randomized intervals, this is a finding.

Check Text ( C-14569r944853_chk )

Note: For VDI workstations that are reset copies of a VDI master image, this requirement is Not Applicable. For VDI master images, once an inventory is pulled after updates, further inventory is not required.
Note: This requirement is only applicable to Windows platforms. For MAC and Linux platforms, this is Not Applicable.

Consult with the ISSO to determine the endpoints used for the sampling of inventory pulls.

From the Trellix ePO console, select Menu >> Systems >> System Tree.

If sampling is a group, select the group in the System Tree and switch to the “Assigned Client Tasks” tab.

Otherwise, select each endpoint on the “Systems” page and then click Actions >> Agent >> Modify Tasks on a Single System.

Confirm a client task exists with an “SC: Pull Inventory” task type. Review the task properties to validate the task is configured to run at least as frequently as every seven days and tasks randomize the inventory pulls.

If a sampling of endpoints does not have a “Pull Inventory” task type applied and/or the “Pull Inventory” task is not configured to run at least as frequently as every seven days at randomized intervals, this is a finding.

Fix Text (F-14567r944854_fix)
From the Trellix ePO console, select Menu >> Systems >> System Tree. To apply a client task to a group, select a group in the System Tree and switch to the "Assigned Client Tasks" tab. To apply a client task to an endpoint, select the endpoint on the "Systems" page and then click Actions >> Agent >> Modify Tasks on a Single System. Click Actions >> New Client Task Assignment to open the "Client Task Assignment Builder" page. Select "Solidcore 8.x" for the product and "SC: Pull Inventory" for the task type and then click "Create New Task" to open the "Client Task Catalog" page. Specify the task name and add any descriptive information. Click "Save". Click "Next" to open the "Schedule" page. Schedule the task to run at least as frequently as every seven days and then click "Next". Review and verify the task details and then click "Save".

Fix Text (F-14567r944854_fix)

From the Trellix ePO console, select Menu >> Systems >> System Tree.

To apply a client task to a group, select a group in the System Tree and switch to the "Assigned Client Tasks" tab.

To apply a client task to an endpoint, select the endpoint on the "Systems" page and then click Actions >> Agent >> Modify Tasks on a Single System.

Click Actions >> New Client Task Assignment to open the "Client Task Assignment Builder" page.

Select "Solidcore 8.x" for the product and "SC: Pull Inventory" for the task type and then click "Create New Task" to open the "Client Task Catalog" page.
Specify the task name and add any descriptive information.

Click "Save".
Click "Next" to open the "Schedule" page. Schedule the task to run at least as frequently as every seven days and then click "Next".

Review and verify the task details and then click "Save".