The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Press CTRL+K to open search

How it works

  • Published on Sep 3, 2026
  • 1 minute(s) read
Prev Next

Trellix EDR services are available in two modes: Trellix EDR running on ePO - On-prem and Trellix EDR running on ePO - SaaS cloud services. Trellix EDR services run on ePO - SaaS cloud services.

Trellix EDR on ePO - On-prem

GUID-A94E0368-B7BC-41A8-8AE3-9CA563FC991C-low.png

  1. ePO - On-prem manages Trellix EDR extensions to communicate with the DXL Broker and Trellix EDR cloud services.

    The DXL Broker is a communication fabric among Trellix EDR services, the cloud, and devices.

  2. The devices relay data back to the ePO - On-prem server and DXL Broker.

  3. Devices with Active Response clients (if present) send data back to ePO - On-prem and DXL Broker.

  4. Send Trellix EDR traces to AWS S3 bucket.

Trellix EDR on ePO - SaaS cloud

GUID-47098037-3311-4331-A8B7-7DFFDC760EED-low.png

  1. Trellix EDR cloud services communicate to ePO - SaaS.

  2. Trellix EDR client sends data to ePO - SaaS and Trellix EDR cloud services.