The Trellix Security Enterprise Security Manager v11.6.12 brings event, threat, and risk data together to provide strong security intelligence, rapid incident response, seamless log management, and extensible compliance reporting. The TOE is distributed amongst six devices as follows: Enterprise Security Manager (ESM), Event Receiver (ERC), Application Data Monitor (ADM), Advanced Correlation Engine (ACE), Enterprise Log Manager (ELM), and Enterprise Log Search (ELS). The six TOE components are divided into three categories as follows:
\r\n\r\n
The TOE includes the hardware and software of the six Trellix Security Enterprise Security Manager components. TOE boundary encompasses all the devices of the Trellix Enterprise solution. The ESM is the central management entity responsible for managing all the other devices (colloquially called child devices) in the solution. All Data (ERC, ADM) and Auxiliary (ACE, ELM, ELS) are considered as child devices. Each of the child devices communicates with the ESM over TLS with mutual-authentication and SSH. The management-plane traffic between the ESM and child devices uses SSH; whereas the data-plane traffic uses X.509v3 mutually authenticated TLS. To manage the ESM (and the child devices via ESM), an administrator logs into the Web GUI of the ESM using HTTPS over TLS. Alternatively, an administrator may log into the local console of any of the TOE six components for local administration. Additionally, some of the child devices can communicate with each other over SSH and/or TLS trusted channels. The ESM communicates with a remote audit Syslog server over SSH to store the TOE-generated audit records. The Figure 1 below depicts a representative TOE deployment and interaction between the TOE components and external entities.
\r\nNote: The different color coding is only used to easily distinguish communication between the endpoints and it has no other significance.
\r\nFigure 1: Representative TOE Deployment
\r\nThe minimum configuration required for a Trellix TOE deployment consists of at least one management component, one data component, and one auxiliary component. In addition to the minimum configuration, additional instances of the data components or auxiliary components can be added to expand upon the minimum configuration in order to address larger enterprise deployments.
\r\nAll six TOE components are part of the evaluation. However, a minimum configuration of the TOE that was tested is identified below.
\r\nThe evaluation was carried out in accordance with the Common Criteria Evaluation and Validation Scheme (CCEVS) process and scheme. The criteria against which the Trellix Security Enterprise Security Manager v11.6.12 was evaluated is described in the Common Criteria for Information Technology Security Evaluation, Version 3.1 rev 5. The evaluation methodology used by the evaluation team to conduct the evaluation is the Common Methodology for Information Technology Security Evaluation, Version 3.1 rev 5. The product, when delivered and configured as identified in the Common Criteria Administrator Guidance, satisfies all of the security functional requirements stated in the Trellix Security Enterprise Security Manager Security Target. The project underwent CCEVS Validator review. The evaluation was completed in March 2025. Results of the evaluation can be found in the Common Criteria Evaluation and Validation Scheme Validation Report prepared by CCEVS.
","environmental_strengths":"The TOE provides the security functions required by NDcPP v2.2e.
\r\nThe TOE keeps local and remote audit records of security relevant events. The TOE internally maintains the date and time which can either be set manually or synchronized with an NTP server.
\r\nThe TOE provides cryptographic support for the services described in Table 7. The related FIPS140-2 validation details are provided in Table 21.
\r\nTable 7: TOE Provided Cryptography
\r\n| \r\n Cryptographic Method \r\n | \r\n\r\n Use within the TOE \r\n | \r\n\r\n Library Implementation \r\n | \r\n
| \r\n TLS Establishment \r\n | \r\n\r\n For inter-TOE-components communication (mutually authenticated TLS). \r\nFor remote administrative sessions over HTTPS – non mutually authenticated TLS (ESM only). \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n SSH Establishment \r\n | \r\n\r\n For inter-TOE-components communication \r\n | \r\n\r\n Trellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n ECDSA Signature Services \r\n | \r\n\r\n Used in SSH session establishment \r\n | \r\n\r\n Trellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n RSA Signature Services \r\n | \r\n\r\n Used in TLS session establishment \r\nUsed in SSH session establishment \r\nUsed in secure software update \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n DRBG \r\n | \r\n\r\n Used in TLS session establishment \r\nUsed in SSH session establishment \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n SHS \r\n | \r\n\r\n Used in secure software update, as well as in computing hash values for TLS and SSH cryptographic operations \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n HMAC-SHS \r\n | \r\n\r\n Used to provide TLS traffic integrity verification \r\nUsed to provide SSH traffic integrity verification \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
| \r\n AES \r\n | \r\n\r\n Used to encrypt TLS traffic \r\nUsed to encrypt SSH traffic \r\n | \r\n\r\n BC-FJA (Bouncy Castle FIPS Java API) v1.0.2.3 \r\nTrellix OpenSSL FIPS Object module v1.0.3 \r\n | \r\n
\r\n
Administrators connecting to the TOE are required to enter an administrator username and password to authenticate the administrative connection prior to access being granted.
\r\nThe TOE components authenticate to one another through X.509 certificates configured during the initial installation and setup process of the TOE (for data planes over TLS) or via public key authentication (for data planes over SSH). Administrators using the Web GUI remotely authenticate to the TOE using usernames and passwords.
\r\nThe TOE enables secure local and remote management of its security functions, including:
\r\nThe TOE ensures the authenticity and integrity of software updates through digital signatures and requires administrative intervention prior to the software updates being installed.
\r\nThe TOE performs a suite of self-tests to ensure the correct operation and enforcement of its security functions.
\r\nThe TOE monitors local and remote administrative sessions for inactivity and terminates the session when a threshold time is reached. An advisory notice is displayed at the start of each session.
\r\nThe TSF provides the following trusted communication channels:
\r\n