Trellix FX File Protect

Speaking to Wise TV, Ekrem Kolday, Technical Manager at Komtera Technology, explained Trellix’s FX File Protect file security solution.

Kolday stated the following:
Today, many solutions used to detect targeted attacks—or to scan “at-rest files” (files in storage areas that are not actively being used)—rely on standard antivirus engines. However, the FX File Protect product offered by Trellix delivers high-performance operation by leveraging sandbox capabilities, serving as a solution specifically designed to detect targeted malicious data within at-rest file storage areas.

“At-rest files” reside in locations we commonly refer to as file servers—such as NFS, SharePoint, or cloud-based services like OneDrive and Amazon S3 Buckets—and include file types accessible to users. With our existing systems, however, we can only determine whether these files contain malicious content—or specifically, malware targeted at our environment—if the antivirus engine detects it during active use, such as during read or write operations.

In this context, it is highly unlikely for standard antivirus engines to detect targeted attacks or Zero-Day malware. Trellix’s File Protect FX solution proves to be an invaluable tool in this regard, offering advanced malware analysis capabilities for detecting threats within at-rest files. Trellix offers solutions across multiple product layers, including physical appliances, virtual appliances, and cloud-based options. If we choose a physical appliance for File Protect, it functions as a standalone unit with built-in sandboxing capabilities. However, if a Trellix sandbox solution is already present in the environment, we can deploy File Protect as a virtual appliance and integrate it with the existing sandbox; this allows us to utilize our sandbox resources more efficiently by leveraging their high-performance analysis capabilities.

Consider some example scenarios: when transferring files between the outside world and internal networks (intranets), there is often insufficient verification regarding file safety. Trellix FX File Protect addresses this by scanning files uploaded to sharing portals or file servers and categorizing them as safe or unsafe. It subjects files to advanced malware analysis, ensuring that only those deemed safe are circulated within the organization or made available to users. This provides a straightforward yet critical capability: ensuring that only clean files—verified through advanced analysis—enter and circulate within our corporate network.

We can further expand upon these scenarios. In environments or customer sites with high volumes of incoming file transfers from external sources, it is often difficult to scan files before they enter the system. With File Protect, however, files uploaded to designated folders undergo advanced malware analysis, ensuring that only safe files are admitted into the corporate network. All the scenarios I have described can be configured—whether through automated scheduled scan tasks or by specifying file types—thanks to the File Protect product.