Trellix Helix 2026.3 Release

Configure email notifications for Alerts (New) and for workflow and task failures: On the Notifications page, configure email notifications for Alerts (New) independently of legacy alerts. Choose the severities that generate a notification. Each Alerts (New) email includes the detection time, MITRE ATT&CK techniques, and top contributing alerts and events. It also includes affected assets and a link to the alert in Trellix Helix.
Enable the email notifications for  Trellix Hyperautomation workflow and task execution failures to avoid actively monitoring the Workspace page. Workflow and task failures are sent as separate emails based on the time interval set on the Notifications page.
You can enable email notifications for  Trellix Hyperautomation workflow and action failures. For details, see Configuring email notifications in the Helix Product Guide.

Tune correlated detection rules: You can tune Trellix detection rules in Rules (New). You can modify single-condition rules and correlated rules. A single-condition rule contains one match condition, and you can adjust its Threshold and Window settings. A correlated rule contains multiple match conditions at various nesting levels. You can add conditions to correlated rules without changing the correlation. You cannot adjust Threshold and Window settings for correlated rules.

The Trellix Helix user interface distinguishes your tuned conditions from default Trellix-defined conditions. You can revert an individual tuned condition or the entire rule to the Trellix default. The History tab records all tuning changes and displays the username and the timestamp.
For details, see Tune Trellix rules in the Helix Product Guide.

Filter rules by tag: On the Rules page, you can filter the rules table by tag to view specific rules. You can also filter and group multiple tags without manually grouping columns. For example, filter by the phishing tag or group it with other tags. For details, see Use tags to organize rules in the Helix Product Guide.

If you used rule packs in Rule Packs (Legacy), recreate the rule pack groupings as tags in Rules (New). For details, see Migrating from rule packs to tags in the Helix Product Guide.

Smart alert ordering with Trellix Wise: The Alerts (New) page includes a Wise Verdict column when you enable Trellix Wise. This column displays True Positive, False Positive, or Unanalyzed. The system sorts alerts by Wise Verdict, severity, and creation time. This sorting applies to standalone alerts and correlated alert groups.

The alert side panel or details view displays the confidence score. You can sort the alerts table manually. The table retains the selected sort order until you select Reset Sort. If Trellix Wise is disabled, alert sorting behavior remains unchanged. For details, see Understand alert ranking in the Helix Product Guide.

MITRE ATT&CK framework update: The MITRE ATT&CK framework has been updated from version 18.0 to 19.1. The update includes new techniques and tactics.

Add to List available on the Alerts (New) and Search (New) pages: Add affected asset data to a Trellix Helix list directly from the Alerts (New) and Search (New) pages. You can view the added data on the Lists page for correlation and analysis. For details, see View the assets affected by the alert and Use event data to refine a search or run a new search in the Helix Product Guide.

Integration Hub table improvements: The Integration Hub table includes Created At and Last Updated columns. You can sort the table by Created At, Last Updated, Ingest Usage (Daily), and Ingest Usage (Monthly)/EPS. The Unique Configuration column is hidden by default. You can add this column using column customization. The table supports column filtering. Your custom sort remains until you reset the sort.

Hide actions for unconfigured integrations: On the Integration Hub page, the Enable, Disable, and Delete actions are hidden for integrations that are missing a required identifier, such as a Sender ID. Reconfigure the integration to restore these actions. For Respond integrations, the Disable and Delete actions are not available after configuration.

Enlarge integration help screenshots: The Available Integrations page in the Integration Hub now includes a screenshot for third-party integrations. This screenshot displays where to obtain configuration values, such as client IDs and secrets, from partner or third-party portals. Select and enlarge the screenshot for better visibility. For details, see Integrate a new third-party security solution with Trellix helix in the Helix Product Guide.

Export and import  Hyperautomation workflows: You can export a workflow from the Workflows page to a local disk. You can also import a workflow from a local disk into Trellix Helix. Moving workflows helps you transfer configurations between environments. You can also analyze workflows from different environments. For details, see Manage workflows in the Helix Product Guide.

View search queries run by child organizations: Parent organizations can view search queries run by child organizations in a Trellix Helix Managed Security Service Provider (MSSP) environment. To view these queries, you must log to the parent organization. For example, if a child organization runs five searches, the parent organization can view all five searches. Previously, parent organizations could search child organization data but could not view the searches run by child organizations.

Child organizations cannot view searches run by other child organizations or by the parent organization.

Trellix Support: Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction.

Note

Access to the Trellix Support Portal requires login using valid Trellix customer support, partner, or employee credentials.

Trellix Helix Documentation: For detailed technical information, including product guides, release notes, and configuration instructions of Trellix Helix, visit our documentation portal.