The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

How Application Control works in a managed environment

Prev Next

Application Control creates a allow list of all authorized executable files. When you attempt to run an executable file that isn't allowed, Application Control checks the reputation of the file and allows or blocks its execution.

  1. A user or application tries to execute a file on a managed endpoint where Application Control and Trellix Agent are installed.

  2. Application Control checks the reputation of the file and allows or blocks its execution.

  3. Application Control communicates with the Trellix GTI server to fetch the reputation of the file.

  4. The administrator manages all endpoints, deploys policies, creates rules, adds certificates, manages the inventory, monitors activities, and approves requests.

  5. Information about the attempt to run the application is sent to the ePO - SaaS server, where it appears in a dashboard, report, or log.

How_Application_Control_works__Windows__V2.png