Release summary
This release introduces Trellix Wise™ for Private Cloud, the core of your agentic security operations center (SOC), with AI-native capabilities for investigation, remediation, and threat hunting that help security teams improve how they investigate and respond to threats while maintaining control over their security environment. The release also supports integration with existing security tools and deployment in restricted, isolated, and fully air-gapped environments.
Release date: 15/10/2026
What’s New
Core AI agents
Investigation agent
Autonomous triage and evidence correlation for incoming security alerts.
Automated evidence correlation: Evaluates incoming alerts by gathering context across connected security tools to produce structured investigation results with a clear verdict, confidence level, supporting evidence, and MITRE ATT&CK mappings.
Analyst-in-the-loop review: Review generated findings, inspect raw evidence, and validate verdicts directly within the alert workflow.
Hunting agent
Proactive threat detection across connected environments without relying on static alerts.
Proactive hunting: Runs federated searches across connected environments using custom hunting requirements, IOCs, and defined search parameters.
Finding evaluation and escalation: Analyzes returned telemetry to surface suspicious behaviors and allows analysts to escalate confirmed findings into active investigations.
Remediation agent
Governed response execution to contain verified threats.
Impact-aware response: Evaluates investigation findings and affected assets to recommend targeted mitigation workflows.
Cross-tool response actions: Executes response actions through native integrations, including disabling or enabling Active Directory accounts, forcing password resets, unlocking accounts, and creating ITSM tickets such as Jira.
Role and scope governance: Provides administrative control over execution permissions. Users can approve, override, deny, or escalate actions based on assigned roles and scopes.
Unified ecosystem and data integration
Security product integration: Connect to existing security product portfolios to support Ingest, Enrich, Egest, and active response execution. For details, see Trellix Knowledge Base article, Integrate Trellix Wise with Private Cloud - KB000015888.
In-place data analysis: Perform investigations and threat hunts directly against existing security data lakes without requiring data migration or duplication.
Local threat intelligence: Store and update threat intelligence locally to maintain access to threat intelligence context across connectivity modes.
Flexible private cloud deployment
Preferred infrastructure: Deploy virtual appliances on preferred infrastructure, including AWS, Azure, GCP, ESXi, Hyper-V, KVM, and Harvestor.io. For details, see Select a deployment environment.
Air-gapped and restricted operations: Process security data in environments with restricted or no direct connectivity using 2-Way (Collaborative), 1-Way (Private), and Offline (Sovereign) connectivity modes. For details, see Select a deployment mode.
Licensing modes: Support Appliance, Support, and Data-Sharing licenses based on the environment's connectivity mode.
Security, governance and administration
Granular role-based access control (RBAC): Restrict access to investigations, hunting, response actions, integrations, context data, and audit logs using built-in or custom scope-based roles. For details, see Trellix Wise™ for Private Cloud roles.
Identity and encryption standards: Integrate custom identity providers (IdP) for authentication and manage custom TLS certificates and CA trust bundles for encrypted communications.
FIPS 140-3 compliance: Support FIPS 140-3 compliance for cryptographic operations.
Common Criteria evaluation: Common Criteria evaluation is in progress.
Wise context management and feedback: Provide organization-specific assets, networks, and business context to tailor AI recommendations and threat evaluations. Capture analyst feedback and assessment validation to refine future investigations. For details, see Trellix Knowledge Base article, Set Wise context - KB000015886.
Audit logging: Track administrative and operational activity, including sign-ins, permission changes, configuration edits, and executed response actions. For details, see Review audit logs.
Operations and data protection
Operational dashboards: Monitor metrics across alert investigations, threat hunting cycles, and active integrations. For details, see Analyze dashboards.
System health monitoring: Enable Super Admins to monitor pod status, service health, and compute resource utilization across the appliance.
Encrypted backup and recovery: Support Full, Differential, and Incremental backups to S3 or NFS destinations and restore data from a backup schedule or backup location. Full backups include the Configuration Database, Operational Database, and vector Store. Backup artifacts are encrypted at rest using AES-256 GCM through FIPS-validated encryption modules and include a SHA-256 checksum for integrity verification. For details, see Backup and restore your data.
Known issues
For known issues, follow the following Trellix Knowledge Base articles:
Additional information
Trellix Thrive: Access the unified portal for technical support, product downloads, support case management, diagnostic tools, knowledge base articles, product training, webinars, and community interaction.
Trellix Wise™ for Private Cloud Documentation: For detailed technical information, including product guides, release notes, and configuration instructions of Trellix Wise™ for Private Cloud, visit our documentation portal.
Note
Access to the Trellix Thrive Portal requires login using valid Trellix customer support, partner, or employee credentials.