Automatic upgrade from Endpoint Security (HX) to EDRF

The automatic upgrade imports Endpoint Security (HX) policy configurations, host sets, and host set associations into ePO. This feature evaluates endpoint host sets to create operating system-specific EDRF policies (Windows, Linux, macOS) and corresponding System Tree groups without manual recreation.

When endpoints receive multiple policies, the system applies a priority hierarchy to resolve conflicts and establish the effective configuration. Each generated policy set automatically creates General, Streaming, Detection, and Remediation policies.

To upgrade from Endpoint Security (HX) to EDRF automatically, perform these steps:

1. Register HX server and enable policy communication in ePO

2. Execute automatic policy import task in ePO

3. Deploy Trellix Agent to endpoints running legacy xAgent

4. Deploy EDRF Client to endpoints running legacy xAgent

Register HX Server and enable policy communication in ePO

Complete these configuration steps before initiating the policy import task.

Prerequisites

Before initiating the automatic upgrade process, ensure that your environment meets the following technical requirements:

• Authentication: Migrate the Trellix Endpoint Security (HX) server to Trellix IAM. The automatic upgrade process does not support FireEye IAM.

• User Privileges: Obtain administrator credentials for Trellix ePolicy Orchestrator (ePO) - On-prem and create a dedicated administrator account on the Trellix HX server.

• HX Appliance Software: Update the Trellix HX appliance to version 10.0.5 and install hotfix image-ENDPT-229908_HX10.0.5-fehfx.img.

• ePO Extensions: Install the Trellix EDR with Forensics (EDRF) extension package (version 2.1.1.330 or higher) and the Migration/Upgrade extension package in Trellix ePO - On-prem.

• Change Freeze: Enforce an active configuration freeze on the Trellix HX server. Do not modify host sets, policies, or associations during the migration.

• Server Registration: Verify that the target Trellix HX server is not already registered under Trellix ePO Server Settings. Existing duplicate registrations prevent the creation of migration server tasks.

Step 1: Install extensions

1. Log in to Trellix ePO - On-prem as an administrator.

2. Navigate to Menu > Software > Extensions.

3. Install EDRF extension.zip.

4. Install Migration / Upgrade extension.zip.

Step 2: Register HX Server instance

1. Navigate to Menu > Configuration > Server Settings > HX Instance Management.

2. Select Edit > Actions > Add HX Instance.

3. Select Automatic mode.

4. Enter the HX server name and FQDN URL (https://servername:port/).

5. Select Show Cert to validate the certificate fingerprint.

6. Enter the HX administrator credentials and save the settings.

Step 3: Enable policy communication

1. Navigate to Menu > Policy Catalog > Trellix EDR with Forensics.

2. Under the General policy category, select Show Advanced > Forensics (HX) Server.

3. Select the registered HX instance from the menu.

Execute automatic policy import in ePO

Use the Import HX Policies workflow in ePO to automatically convert legacy Endpoint Security (HX) host sets and policy hierarchies into OS-specific EDRF policies and System Tree groups.

1. Navigate to Menu > Policy > Import HX Policies.

2. Under Get Started: Choose HX Server, select your registered HX server from the drop-down list.

3. Click Preview Import.

   • Review the count of current HX Host Sets and defined policies against the estimated number of EDRF policies to be generated.

4. Click Start Import to launch the background server task for policy conversion.

5. Monitor task progress under Menu > Systems > Server Task Log or Menu > Reporting > Audit Log.

Post-Import Validation

1. Verify System Tree Groups: Navigate to Menu > Systems > System Tree. Confirm that new System Tree subgroups named after the HX server exist, mirroring active HX host sets. The system adds associated endpoints as unmanaged assets pending Trellix Agent deployment. (Note: The system omits empty host sets without active endpoints or assigned policies).

2. Verify Converted Category Policies: Navigate to Menu > Policy > Policy Catalog and select Trellix EDR with Forensics. Expand each category (General, Protection, Streaming, Detection, and Remediation) to confirm that generated policies (prefixed with HX Migrated-) assign to matching System Tree groups.

3. Verify Converted Containment Settings: Open the converted Remediation policy to confirm that IP address allow lists, containment notification text, and web page redirect URLs migrated correctly.

4. Import Additional HX Servers (If Applicable): If managing multiple appliances, select Import Additional HX Servers. Run import tasks sequentially.

Deploy Trellix Agent to endpoints

Deploy Trellix Agent (5.8.x or later) to endpoints in the newly populated System Tree groups before deploying the EDRF Client.

1. Navigate to Menu > Systems > System Tree.

2. Select the target System Tree group created during the policy import.

3. Select System Tree Actions > Deploy Agents.

4. Select Trellix Agent (5.8.x or later) from the Target version drop-down menu.

5. Enter appropriate domain administrator credentials to push the agent to selected systems.

6. Click OK to execute the deployment task.

Deploy Trellix EDRF Client to endpoints

Deploying the EDRF Client package automatically uninstalls legacy xAgent and xAgent Proxy components from target endpoints.

1. Navigate to Menu > Software > Product Deployment.

2. Click New Deployment.

3. Enter a deployment name and select Trellix EDR with Forensics Client from the Package drop-down menu.

4. Under Select System Tree Groups, select the target groups mapped during the policy import phase.

5. Select Save to start the deployment task.

Post-Deployment Verification

After deploying the EDRF Client, the residual files, registry keys, and background processes from the Endpoint Security (HX) xAgent might remain on the endpoint.

Follow these steps to verify client execution and purge remnant files:

1. Log in to a target managed endpoint.

2. Open Task Manager (Windows) or Activity Monitor (macOS / Linux).

3. Confirm that the xclient.exe process is running actively.

4. Verify whether residual xagent.exe or xagentproxy.exe processes remain in the process list.

5. Execute the hx-xclient-cleanup post-upgrade script in ePO to purge residual directories, registry keys, and remnant background processes from managed endpoints.