--- title: "Trellix Helix 2026.3 Release" slug: "helix-2026-3-release-notes" updated: 2026-10-16T12:33:23Z published: 2026-10-16T12:33:23Z canonical: "docs.trellix.com/helix-2026-3-release-notes" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.trellix.com/llms.txt > Use this file to discover all available pages before exploring further. # Trellix Helix 2026.3 Release ### **Release summary** The Trellix Helix 2026.3 release includes new features and enhancements. #### **Release information** **Release date**: 16/10/2026 ### **What's new** This section provides a unified overview of all customer-facing updates introduced in the current release, including new features, feature enhancements, workflow or UI improvements, platform updates, and other significant changes. - **Configure email notifications for Alerts (New) and for workflow and task failures**: On the **Notifications** page, configure email notifications for **Alerts (New)** independently of legacy alerts. Choose the severities that generate a notification. Each **Alerts (New)** email includes the detection time, MITRE ATT&CK techniques, and top contributing alerts and events. It also includes affected assets and a link to the alert in Trellix Helix. Enable the email notifications for Trellix Hyperautomation workflow and task execution failures to avoid actively monitoring the **Workspace** page. Workflow and task failures are sent as separate emails based on the time interval set on the **Notifications** page. You can enable email notifications for Trellix Hyperautomation workflow and action failures. For details, see [Configuring email notifications](/network-and-platform/docs/configuring-email-notifications-2) in the Helix Product Guide. - **Tune correlated detection rules**: You can tune Trellix detection rules in **Rules (New)**. You can modify single-condition rules and correlated rules. A single-condition rule contains one match condition, and you can adjust its **Threshold** and **Window** settings. A correlated rule contains multiple match conditions at various nesting levels. You can add conditions to correlated rules without changing the correlation. You cannot adjust **Threshold** and **Window** settings for correlated rules. The Trellix Helix user interface distinguishes your tuned conditions from default Trellix-defined conditions. You can revert an individual tuned condition or the entire rule to the Trellix default. The **History** tab records all tuning changes and displays the username and the timestamp. For details, see [Tune Trellix rules](/network-and-platform/docs/tune-trellix-rules-new) in the Helix Product Guide. - **Filter rules by tag:** On the **Rules** page, you can filter the rules table by tag to view specific rules. You can also filter and group multiple tags without manually grouping columns. For example, filter by the phishing tag or group it with other tags. For details, see [Use tags to organize rules](/network-and-platform/docs/use-tags-to-organize-rules-1) in the Helix Product Guide. If you used rule packs in **Rule Packs (Legacy)**, recreate the rule pack groupings as tags in **Rules (New)**. For details, see Migrating from rule packs to tags in the Helix Product Guide. - **Smart alert ordering with Trellix Wise**: The **Alerts (New)** page includes a **Wise Verdict** column when you enable Trellix Wise. This column displays **True Positive**, **False Positive**, or **Unanalyzed**. The system sorts alerts by **Wise Verdict**, severity, and creation time. This sorting applies to standalone alerts and correlated alert groups. The alert side panel or details view displays the confidence score. You can sort the alerts table manually. The table retains the selected sort order until you select **Reset Sort**. If Trellix Wise is disabled, alert sorting behavior remains unchanged. For details, see [Understand alert ranking](/network-and-platform/docs/understand-alert-ranking-1) in the Helix Product Guide. - **MITRE ATT&CK framework update:** The MITRE ATT&CK framework has been updated from version 18.0 to 19.1. The update includes new techniques and tactics. - **Add to List available on the Alerts (New) and Search (New) pages:** Add affected asset data to a Trellix Helix list directly from the **Alerts (New)** and **Search (New)** pages. You can view the added data on the **Lists** page for correlation and analysis. For details, see [View the assets affected by the alert](/network-and-platform/docs/view-the-assets-affected-by-the-alert-1) and [Use event data to refine a search or run a new search](/network-and-platform/docs/use-event-data-to-refine-a-search-or-run-a-new-search-1) in the Helix Product Guide. - **Integration Hub table improvements:** The **Integration Hub** table includes **Created At** and **Last Updated** columns. You can sort the table by **Created At, Last Updated, Ingest Usage (Daily)**, and **Ingest Usage (Monthly)/EPS**. The **Unique Configuration** column is hidden by default. You can add this column using column customization. The table supports column filtering. Your custom sort remains until you reset the sort. - **Hide actions for unconfigured integrations:** On the **Integration Hub** page, the **Enable**, **Disable**, and **Delete** actions are hidden for integrations that are missing a required identifier, such as a **Sender ID**. Reconfigure the integration to restore these actions. For **Respond** integrations, the **Disable** and **Delete** actions are not available after configuration. - **Enlarge integration help screenshots:** The **Available Integrations** page in the **Integration Hub** now includes a screenshot for third-party integrations. This screenshot displays where to obtain configuration values, such as client IDs and secrets, from partner or third-party portals. Select and enlarge the screenshot for better visibility. For details, see [Integrate a new third-party security solution with Trellix helix](/network-and-platform/docs/integrate-a-new-third-party-security-solution-with-trellix-helix-1) in the Helix Product Guide. - **Export and import Hyperautomation workflows:** You can export a workflow from the **Workflows** page to a local disk. You can also import a workflow from a local disk into Trellix Helix. Moving workflows helps you transfer configurations between environments. You can also analyze workflows from different environments. For details, see [Manage workflows](/network-and-platform/docs/manage-workflows-1) in the Helix Product Guide. - **View search queries run by child organizations:** Parent organizations can view search queries run by child organizations in a Trellix Helix Managed Security Service Provider (MSSP) environment. To view these queries, you must log to the parent organization. For example, if a child organization runs five searches, the parent organization can view all five searches. Previously, parent organizations could search child organization data but could not view the searches run by child organizations. Child organizations cannot view searches run by other child organizations or by the parent organization. ### **Additional information** - [Trellix Support](https://support.trellix.com/): Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction. > [!NOTE] > Note > > Access to the Trellix Support Portal requires login using valid Trellix customer support, partner, or employee credentials. - [Trellix Helix Documentation](/network-and-platform/docs/helix): For detailed technical information, including product guides, release notes, and configuration instructions of Trellix Helix, visit our documentation portal.