--- title: "Endpoint Detection and Response (EDR)" slug: "endpoint-detection-and-response-edr" status: "update" updated: 2026-10-01T14:32:44Z published: 2026-10-01T14:32:44Z canonical: "docs.trellix.com/endpoint-detection-and-response-edr" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Endpoint Detection and Response (EDR) ### What is Trellix EDR ? [Trellix EDR Overview](/v1/docs/overview-46) [Key features of Trellix EDR](/v1/docs/key-features-8) [How Trellix EDR works](/v1/docs/how-it-works-3) [Detection - Navigating through an attack using Trellix EDR](/v1/docs/detection-navigating-through-an-attack-using-trellix-edr) [Investigation - Investigate an attack using Trellix EDR](/v1/docs/investigation-investigate-an-attack-using-trellix-edr) [Hunting - Threat hunting on endpoints using clues from Trellix EDR investigations](/v1/docs/hunting-threat-hunting-on-endpoints-using-clues-from-trellix-edr-investigations) ### Getting started with Trellix EDR [Activate your Trellix account](/v1/docs/activate-your-trellix-account-2) [Configuring Single Sign-On to log on to Trellix](/v1/docs/configuring-single-sign-on-to-log-on-to-trellix-1) [Configure users](/v1/docs/configure-users) [Add and assign roles to users](/v1/docs/add-and-assign-roles-to-users) ### Installing Trellix EDR [Deploy Trellix EDR using ePO - SaaS](/v1/docs/deploy-trellix-edr-using-epo-saas) [Install Trellix EDR on ePO - On-prem](/v1/docs/install-trellix-edr-on-epo-on-prem) ### Upgrade Trellix EDR [Upgrade Trellix EDR client using ePO - SaaS](/v1/docs/upgrade-trellix-edr-client-using-epo-saas) [Upgrade Trellix EDR client using ePO - On-prem](/v1/docs/upgrade-trellix-edr-client-using-epo-on-prem) [Upgrade content packages](/v1/docs/upgrade-content-packages) ### Configuring Trellix EDR clients [Recommendations for configuring clients](/v1/docs/recommendations-for-configuring-clients) [Create a custom policy](/v1/docs/create-a-custom-policy) [Configure a policy](/v1/docs/configure-a-policy) [Configuration examples and benefits](/v1/docs/configuration-examples-and-benefits) ### Migrate from MAR to Trellix EDR (Part 1) [About migrating MAR to Trellix EDR](/v1/docs/migrate-from-active-response-to-trellix-edr) [Check in Trellix EDR extension](/v1/docs/check-in-trellix-edr-extension) [Add account credentials to ePO - SaaS Cloud Bridge](/v1/docs/add-account-credentials-to-epo-saas-cloud-bridge) [Upgrade DXL Broker](/v1/docs/upgrade-dxl-broker) [Deploy the Trellix EDR client](/v1/docs/deploy-trellix-edr-client) ### Migrate from MAR to Trellix EDR (Part 2) [Remove Active Response extensions](/v1/docs/remove-active-response-extensions) [Remove the Trellix ePO - SaaS Cloud Bridge 1.x extension](/v1/docs/remove-the-epo-on-prem-cloud-bridge-1-x-extension) [Remove Active Response software packages](/v1/docs/remove-active-response-software-packages) ### Monitoring threats [About monitoring threats](/v1/docs/monitoring-threats-1) [Prioritize threats](/v1/docs/prioritize-threats-1) [Analyze threats](/v1/docs/analyze-threats-1) ### Investigating threats [Overview of Trellix Wise and its functionalities](/v1/docs/investigating-threats-1) [Analyze threats using Trellix Wise in Device Search](/v1/docs/analyze-threats-using-trellix-wise-in-device-search) [Search for historical data across endpoints using Trellix Wise](/v1/docs/search-for-historical-data-on-multiple-endpoints-1) ### Searching historical endpoint data [Search for historical data on multiple endpoints](/v1/docs/search-for-historical-data-on-multiple-endpoints-1) [Search for IOCs hashes on multiple endpoints](/v1/docs/search-for-iocs-hashes-on-multiple-endpoints-1) [Search for historical data on a single endpoint](/v1/docs/search-for-historical-data-on-a-single-endpoint-1) [Analyze trace time and detection time of an activity](/v1/docs/analyze-trace-time-and-detection-time-of-an-activity-1) [Configure a policy to search for data of loaded DLLs](/v1/docs/configure-a-policy-to-search-for-data-of-loaded-dlls-1) ### Searching real-time endpoint data [Search real-time data of endpoints for investigation and threat hunting](/v1/docs/search-real-time-data-of-endpoints-for-investigation-and-threat-hunting-1) [Run the real-time search query for investigation and threat hunting](/v1/docs/run-the-real-time-search-query-for-investigation-and-threat-hunting-1) [Save a real-time search query](/v1/docs/save-a-real-time-search-query-1) [Run the saved real-time search query for investigation and threat hunting](/v1/docs/run-the-saved-real-time-search-query-for-investigation-and-threat-hunting-1) ### Respond to threats [About responding to threats](/v1/docs/respond-to-threats-1) [Contain threats](/v1/docs/contain-threats-1) [Remediate threats](/v1/docs/remediate-threats-1) [Dismiss threats](/v1/docs/dismiss-threats-1) [Exclude threats](/v1/docs/exclude-threats-from-the-potential-threat-list-1) ### Trellix EDR API [Trellix EDR APIs for single customer](/v1/docs/trellix-edr-apis) ### Collecting device data and reacting to incidents [Collecting device data for real-time search](/v1/docs/collecting-device-data-for-real-time-search-1) [Reacting to incidents](/v1/docs/reacting-to-incidents-1) ### Trellix EDR product documents [Release Notes](/v1/docs/edr-release-notes) [Installation Guide](/v1/docs/trellix-endpoint-detection-and-response-installation-guide) [Product Guide](/v1/docs/trellix-endpoint-detection-and-response-product-guide) ### Technical Content [Known Issues - KB91275](https://support.trellix.com/s/article/KB91275) [Cloud threat detection updates - KB15254](https://support.trellix.com/s/article/000015254) [Supported platforms - KB91345](https://support.trellix.com/s/article/KB91345) [Port requirements for each component on Trellix ePO - On-prem - KB66797](https://support.trellix.com/s/article/KB66797)