V-213346

Discussion

The throttling settings regulate the data flow between the clients and Trellix ePO. The value for each category defines the number of entries that will be sent to the Trellix ePO daily. Clients start caching for the defined category when the specified threshold value is reached. After the cache is full, new data for that category is dropped and not sent to the Trellix ePO. As such, settings must be high enough to allow for all data to reach the Trellix ePO.

Check Content

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".

Select the asset to be validated.

Select "Actions".

Select "Agent".

Select "Modify Policies on a Single System".

From the product pull-down list, select Solidcore 8.x: General.

From the "Policy" column, select the policy associated with the Category "Configuration (Client)" that is specific to the organization and select the "Throttling" tab.

Verify the "Enable Throttling" check box is selected.

Verify the throttling settings are configured according to organization's written policy.

If the "Enable Throttling" check box is not selected, this is a finding.

If the throttling settings do not match the organization's written policy or the settings are not documented in the written policy, this is a finding.