Trellix Application Control 8.x Security Technical Implementation Guide

Version: 3

Updated: 03 Sep 2025

Findings: 31

Findings

V-213316 - A Trellix Application Control written policy must be documented to outline the organization-specific variables for application whitelisting. (medium)
V-213317 - The use of a Solidcore 8.x local Command Line Interface (CLI) Access Password must be documented in the organizations written policy. (medium)
V-213318 - The Solidcore client Command Line Interface (CLI) Access password complexity requirements must be documented in the organizations written policy. (medium)
V-213319 - The Solidcore client Command Line Interface (CLI) Access Password protection process must be documented in the organizations written policy. (medium)
V-213320 - The requirement for scheduled Solidcore client Command Line Interface (CLI) Access Password changes must be documented in the organizations written policy. (medium)
V-213321 - The process by which the Solidcore client Command Line Interface (CLI) Access Password is made available to administrators when needed must be documented in the organizations written policy. (medium)
V-213322 - The Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be confined to the organizations enclave. (medium)
V-213323 - The configuration of features under Trellix Application Control Options policies Enforce feature control must be documented in the organizations written policy. (medium)
V-213324 - The organizations written policy must include a process for how whitelisted applications are deemed to be allowed. (medium)
V-213325 - The organizations written policy must include procedures for how often the whitelist of allowed applications is reviewed. (medium)
V-213326 - The Solidcore client must be enabled. (medium)
V-213327 - The Solidcore client Command Line Interface (CLI) must be in lockdown mode. (high)
V-213328 - The Solidcore client Command Line Interface (CLI) Access Password must be changed from the default. (high)
V-213329 - The organization-specific Rules policy must only include executable and dll files that are associated with applications as allowed by the organizations written policy. (medium)
V-213330 - The Trellix Application Control Options Reputation setting must be configured to use the Trellix Global Threat Intelligence (Trellix GTI) option. (medium)
V-213331 - The Trellix Application Control Options Reputation-Based Execution settings, if enabled, must be configured to allow Most Likely Trusted or Known Trusted only. (medium)
V-213332 - The Trellix Application Control Options Advanced Threat Defense (ATD) settings must not be enabled unless an internal ATD is maintained by the organization. (medium)
V-213333 - The Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be configured to send all binaries with a reputation of Might be Trusted and below for analysis. (medium)
V-213334 - The Trellix Application Control Options Advanced Threat Defense (ATD) settings, if being used, must be configured to only send binaries with a size of 5MB or less. (medium)
V-213336 - The Trellix Application Control Options policy must be configured to disable Self-Approval. (medium)
V-213337 - The Trellix Application Control Options policy End User Notification, if configured by organization, must have all default variables replaced with the organization-specific data. (medium)
V-213338 - The Trellix Application Control Options policies Enforce feature control memory protection must be enabled. (medium)
V-213339 - Enabled features under Trellix Application Control Options policies Enforce feature control must not be configured unless documented in written policy and approved by ISSO/ISSM. (medium)
V-213340 - The Trellix Application Control Options Inventory option must be configured to hide OS Files. (medium)
V-213341 - The Trellix Application Control Options Inventory interval option must be configured to pull inventory from endpoints on a regular basis not to exceed seven days. (medium)
V-213342 - The Trellix Applications Default Rules policy must be part of the effective rules policy applied to every endpoint. (medium)
V-213343 - A copy of the Trellix Default Rules policy must be part of the effective rules policy applied to every endpoint. (medium)
V-213344 - The organization-specific Rules policies must be part of the effective rules policy applied to all endpoints. (medium)
V-213345 - The organization-specific Solidcore Client Policies must be created and applied to all endpoints. (medium)
V-213346 - The Throttling settings must be enabled and configured to settings according to organizations requirements. (medium)
V-213347 - The Solidcore Client Exception Rules must be documented in the organizations written policy. (medium)