Trellix EDR 4.1.0 Release Notes (On-premises)

This   Trellix Endpoint Detection and Response 4.1.0 (On-premises) release includes new features, enhancements, resolved issues, and product rebranding changes.  

Release details

¹Separate release cadence is followed for   Trellix EDR Endpoint Snapshot Tool. The latest available version is considered for this release. For installing or upgrading to the latest available version, see   Software Catalog or   Trellix Products Downloads site.  

When you install or upgrade to   Trellix EDR 4.1.x:  

• You might be required to reboot the endpoint. On some installs and upgrades,   Trellix EDR installation will not proceed until the endpoint is rebooted and the installation or upgrade is restarted. For details, see   KB96049.  

• Endpoints unaffected by   KB96049 might be prompted to reboot the endpoint. It is a good practice to reboot the endpoint but not mandatory. The reboot message can be suppressed by disabling the   Prompt User When a Reboot is Required option on the   Trellix Agent properties page.  

New features and changes

This release includes the following features and changes.  

• Rebranding changes — You can continue to secure your organization with   Trellix EDR as usual. You will notice the following changes in the software:  

  • Brand logo — McAfee logo is replaced with   Trellix logo.  

  • User interface — Color and typeface are updated to provide better user experience.  

  • Product name — MVISION EDR is renamed as   Trellix EDR.  

  • End User License Agreement and Copyright — The End User License Agreement and Copyright are updated according to legal requirements. For more details, read the agreement details.  

  As part of rebranding, the certificates used to sign our software have been updated. If your enterprise automatically updates root certificates, the software update/installation does not require any additional effort. However, if your enterprise manages root certificate updates manually, you need to install the new intermediate and root certificates.  

  For information on downloading and installing the certificates, see   KB91697.  

• Separate   Trellix EDR client packages - In this release, the single   Trellix EDR client package is now split into three separate packages for each operate system — Windows, Linux, and macOS. When installing the   Trellix EDR client, select the appropriate package and install on endpoints.  

• Linux traces — The   Trellix EDR trace feature now supports the Linux operating system. The traces are collected from the Linux endpoints to detect any suspicious activity on the endpoint and threats are shown on the   Monitoring dashboard with metadata to help you in investigation.  

  Before installing the   Trellix EDR client on Linux endpoints, make sure to enable kernel syscall auditing to discover security violations and track security-relevant information. For details about enabling syscall auditing on different Linux distributions, see:  

  • Red Hat — Enable audit in grub configuration  

  • Ubuntu — Enable audit in grub configuration  

  • SUSE — Enable audit in grub configuration  

  For the Linux kernel version 3.15 or earlier, the Linux trace functionality can't co-exist with auditd:  

  • If auditd is running, enabling the Linux trace functionality stops the audit service.  

  • To start the auditd service, the trace functionality must be disabled before restarting the auditd service.  

  The audit system must not be in immutable mode to use trace functionality. Otherwise, trace process will not be able to add the audit rules.  

  Note

  The audit flag to set failure must not be set to "2" (2=panic). If set, it can cause the kernel panic once the backlog limit exceeds.  

  The supported event types on Linux endpoints are:  

  • Processes  

  • Files  

  • Network connections  

  • Service change events  

  • User logon events  

  • Kernel module load and unload events  

• Content update methods — In this release on the   Trellix EDR client version 4.1.x, you have an option to select either   Dynamic content update or   ePO push content update method to update content on Windows endpoints.  

  • By default, the   Dynamic content update is selected and effective only for Windows endpoints.  

  • macOS endpoints will automatically default to the   ePO Push Content update method.  

    For more details about the content update methods, see   General policy configuration.  

    Note

    The   Trellix EDR content update is not supported on Linux endpoints.  

    The below table gives details about the supported content update methods according to the version and operating system.  

    Version	Endpoints with operating system	Supported methods
    4.1.x or later	Windows	Dynamic content update and ePO push content update
    	Linux	Content update is not supported
    	macOS	ePO push content update
    4.0.x	Windows	Dynamic content update
    	Linux	Content update is not supported
    	macOS	ePO push content update
    3.5.2 or earlier	Windows	ePO push content update
    	Linux	Content update is not supported
    	macOS	ePO push content update

Updated platform, environment, or operating system support

For the complete list of system requirements, see supported platforms for   Trellix EDR in   KB91345.  

Resolved issues

Known issues

For a list of known issues in this product release, see   KB91275.  

Installation information

The   Trellix Endpoint Detection & Response Installation Guide has the information you need to install the product for the first time and to migrate from   McAfee® Active Response.