During remediation, you can stop the selected potential threat's process and remove it permanently from the selected endpoints remotely. It includes associated parent to child processes.
The Stop and Remove process feature is supported on Windows and macOS endpoints.
Log on to Trellix EDR.
Select Menu → Monitoring.
On the Threats by Ranking / Threats by Time pane, select a threat to view the affected devices.
On the Device pane, select one or more affected devices to enable the Device Actions drop-down list.
From the Device Actions menu, select Stop and Remove.
Click Confirm to complete the remediation process.
You can check the action status to confirm that the stop and remove process action is completed:
On the Monitoring dashboard, refresh the device list.
On the Action History dashboard, Action Status displays the stop and remove process action as Completed.