The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Excluding heuristic detections from malware protection processing

Prev Next

The Endpoint Security (HX) xAgent malware protection engine uses heuristics-based detection to identify previously unknown zero day malware on your host endpoints. You can enable and disable the heuristic detections exclusion from quarantine and malware protectihon processing for all of your host sets using the agent default policy. You can also exclude heuristic detections from quarantine and malware protection processing for specific host sets in your environment using a custom exclusion policy.

Important

Malware protection processing (malware detection) and quarantine must be enabled, or the heuristic detection exclusion is ignored.

This section covers how to use the Web UI to exclude heuristic detections from quarantine and malware protection processing. See the Endpoint Security (HX) REST API Guide for information on using the API to exclude heuristic detections from quarantine and malware protection processing.