Trellix EDRF

Trellix Endpoint Detection and Response (EDR) identifies and prevents malicious behaviors occurring on devices in the environment.

With Trellix EDR, you can remotely stop and block processes on these devices and query which devices are running these processes. Leveraging intelligence from sources such as the Mitre Att&ck framework and research centers like SANS, Trellix EDR conducts attack analysis to determine whether any of these identified attacker behaviors are occurring in your environment. If it detects a behavior chain matching an attack chain, it immediately blocks it and provides reference sources for further investigation and hardening.

By sharing specific references and providing guidance, it enables analysts to continuously learn and enhance their skills.
Like many other Trellix products, Trellix EDR is deployed to users' devices through Trellix ePO, but it uses a separate interface provided as a Software-as-a-Service (SaaS) for event investigation and action-taking.