Endpoint Detection and Response (EDR)

What is Trellix EDR ?

Trellix EDR Overview

Key features of Trellix EDR

How Trellix EDR works

Detection - Navigating through an attack using Trellix EDR

Investigation - Investigate an attack using Trellix EDR

Hunting - Threat hunting on endpoints using clues from Trellix EDR investigations

Getting started with Trellix EDR

Activate your Trellix account

Configuring Single Sign-On to log on to Trellix

Configure users

Add and assign roles to users

Installing Trellix EDR

Deploy Trellix EDR using ePO - SaaS

Install Trellix EDR on ePO - On-prem

Upgrade Trellix EDR

Upgrade Trellix EDR client using ePO - SaaS

Upgrade Trellix EDR client using ePO - On-prem

Upgrade content packages

Configuring Trellix EDR clients

Recommendations for configuring clients

Create a custom policy

Configure a policy

Configuration examples and benefits

Migrate from MAR to Trellix EDR (Part 1)

About migrating MAR to Trellix EDR

Check in Trellix EDR extension

Add account credentials to ePO - SaaS Cloud Bridge

Upgrade DXL Broker

Deploy the Trellix EDR client

Migrate from MAR to Trellix EDR (Part 2)

Remove Active Response extensions

Remove the Trellix ePO - SaaS Cloud Bridge 1.x extension

Remove Active Response software packages

Monitoring threats

About monitoring threats

Prioritize threats

Analyze threats

Investigating threats

Overview of Trellix Wise and its functionalities

Analyze threats using Trellix Wise in Device Search

Search for historical data across endpoints using Trellix Wise

Searching historical endpoint data

Search for historical data on multiple endpoints

Search for IOCs hashes on multiple endpoints

Search for historical data on a single endpoint

Analyze trace time and detection time of an activity

Configure a policy to search for data of loaded DLLs

Searching real-time endpoint data

Search real-time data of endpoints for investigation and threat hunting

Run the real-time search query for investigation and threat hunting

Save a real-time search query

Run the saved real-time search query for investigation and threat hunting

Respond to threats

About responding to threats

Contain threats

Remediate threats

Dismiss threats

Exclude threats

Trellix EDR API

Trellix EDR APIs for single customer

Collecting device data and reacting to incidents

Collecting device data for real-time search

Reacting to incidents