The Throttling settings must be enabled and configured to settings according to organizations requirements.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-213346 | MCAC-TE-000121 | SV-213346r961479_rule | CCI-001774 | medium |
| Description | ||||
| The throttling settings regulate the data flow between the clients and Trellix ePO. The value for each category defines the number of entries that will be sent to the Trellix ePO daily. Clients start caching for the defined category when the specified threshold value is reached. After the cache is full, new data for that category is dropped and not sent to the Trellix ePO. As such, settings must be high enough to allow for all data to reach the Trellix ePO. | ||||
| STIG | Date | |||
| Trellix Application Control 8.x Security Technical Implementation Guide | 2025-06-09 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-7(5)
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.4.8
1.00
- DISA · V3R2 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-001774
1.00
- DISA · V3R2 · disa_xccdf · related
Details
Check Text (C-213346r961479_chk)
From the ePO server console System Tree, select the "Systems" tab.
Select "This Group and All Subgroups".
Select the asset to be validated.
Select "Actions".
Select "Agent".
Select "Modify Policies on a Single System".
From the product pull-down list, select Solidcore 8.x: General.
From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab.
Verify the "Enable Throttling" check box is selected.
Verify the throttling settings are configured according to organization's written policy.
If the "Enable Throttling" check box is not selected, this is a finding.
If the throttling settings do not match the organization's written policy or the settings are not documented in the written policy, this is a finding.
Fix Text (F-14572r505074_fix)
From the ePO server console System Tree, select the "Systems" tab.
Select "This Group and All Subgroups".
Select the asset.
Select "Actions".
Select "Agent".
Select "Modify Policies on a Single System".
From the product pull-down list, select Solidcore 8.x: General.
From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab.
Place a check in the "Enable Throttling" check box.
Configure the throttling settings based upon organization's written policy.
Click "Save".