Why you must provide a full packet capture in PCAP format
Last Modified: 2024-01-22 11:53:26 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Why you must provide a full packet capture in PCAP format
Technical Articles ID:
KB77570
Last Modified: 2024-01-22 11:53:26 Etc/GMT EnvironmentTrellix Intrusion Prevention System
SummaryTo troubleshoot Sensor detection issues, you must analyze the traffic that causes the issue. You must also determine the parts of the Sensor that are involved. Sometimes, you can't determine why a detection does or doesn't occur without a full, non-encrypted packet capture in PCAP format.
The Sensor protocol engine maintains several complex state systems for detection accuracy. These state systems are optimized for performance and only the final result can be logged on a standard Sensor firmware.
You need a full capture in PCAP format because it allows Support to resend the collected traffic through Sensors equipped with debug features. For example, when the Sensor parses HTTP data, it maintains the state system on HTTP request and HTTP response states. Methods such as GET, PUT, POST, URI, or HTTP headers are analyzed. For any vulnerability and threat, the Sensor checks if the trigger condition is in the correct state. With the partial packet logs, it's impossible to reproduce the whole state-machine transition.
An issue might not exist in the final state and can be in an earlier sequence when the attack is triggered.
Technical Support requires a full flow packet capture in PCAP format to perform the following:
Affected ProductsLanguages:This article is available in the following languages: |
|