The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

Configure Trellix EDR to SIEM connection on ePO - On-prem

  • Published on Aug 27, 2026
  • 1 minute(s) read
Prev Next

You can configure Trellix EDR with SIEM for real-time visibility to all activity on your systems, networks, database, and applications.

  1. Log on to ePO - On-prem as an administrator.

  2. Select Menu → Configuration → Server Settings → Trellix EDR Settings.

  3. Click Edit (bottom-right corner).

  4. In the SIEM Connection section, add the following:

    1. The host. For example, https://.

      Note

      Port is not needed for Trellix ESM connection.

    2. The user account you created earlier and the password.

  5. Click Test Connection.

You see a message indicating successful connection to the SIEM.