Trellix EDR

Key Features of Trellix HX include:

• Real-Time Indicator Detection: Monitors endpoint activity and analyzes system events in real-time to identify and alert on potential security threats.
• Exploit Guard Protection (Windows only): Shields Windows devices from exploit attempts targeting software vulnerabilities, reducing exposure to zero-day attacks. (Not available on macOS and Linux.)
• Malware Protection: Defends against various forms of malware, including viruses, trojans, spyware, and ransomware, using advanced signature-based and heuristic detection methods.
• MalwareGuard (Windows only): Uses AI-driven machine learning to detect and block sophisticated malware threats, including zero-day exploits (Not available on macOS and Linux). This module is not used by UC San Diego.
• Enterprise Search: Enables security teams to perform targeted searches across endpoints to identify known threat indicators and analyze system activity. 
• Data Acquisition: Collects critical forensic data from endpoints, aiding in security investigations and incident response.
• File Acquisition: Allows security teams to retrieve specific files related to an incident, such as event logs, registry data, memory snapshots, and malicious files, to assist in forensic analysis.
• Triage: Provides an initial risk assessment of security events, helping security teams prioritize response efforts based on severity.
• Host Containment: Temporarily isolates compromised or high-risk endpoints from the network to prevent threat spread while remediation actions are taken.

Trellix HX includes tools to help cybersecurity teams investigate and analyze potential threats:

• Data Acquisition – Collects critical forensic data from endpoints to assist in security investigations.
• File Acquisition – Retrieves specific files related to a security event, such as:
  • Event logs
  • Registry data
  • Memory snapshots
  • Malicious files
• Triage – Provides an initial risk assessment of security events, helping teams prioritize response efforts based on severity.

These capabilities enable security teams to quickly assess and contain threats.

Data Acquisition in Trellix HX allows security teams to collect specific metadata from endpoints to assist in forensic investigations. Its capabilities are designed to support targeted security analysis while aligning with compliance requirements.

What Data Can Trellix HX Collect?

Please note that the below are the capabilities of the software. UC San Diego’s use of the software is guided by the Electronic Communications Policy (ECP).

Categories of the data that is collected by Trellix:

Categories of the data that is collected by Trellix (continued):

• Full disk contents: Trellix HX supports full disk acquisition, but at UC San Diego it may only be used in accordance with the ECP.
• Full memory contents: Available, but only at the time of a malicious event to help analyze security threats. At UC San Diego, the software is used in accordance with the ECP.
• List of all files and directories: Available, but at UC San Diego only used in accordance with ECP.

These targeted capabilities help security teams investigate incidents efficiently without broad or intrusive data collection. If full disk imaging or complete file system access is required, organizations should use alternative forensic tools designed for that purpose.

For more details on collected data, refer to the Trellix HX Privacy Data Sheet.

For more details on how the collected data mentioned in the above Privacy Data Sheet would be used by our security team for an investigation, please refer to this video: Using Real-Time Events for Investigation - Trellix Endpoint Security (HX)

• Data is collected in real-time but only when relevant to security monitoring and threat detection. 
• Collected data is used solely for security purposes, including threat detection, incident response, and improving our security services.

For additional information on data handling see the following resources:

• UC San Diego OIA Routine System Monitoring Practices
• Google/Mandiant Privacy & Securing Data
• Trellix Privacy Statement

Note: UCOP’s Master Service Agreement with Mandiant and Trellix requires them to explicitly abide by ECP and our BAA. Learn more about UC's Threat Detection and Identification (TDI) system and refer to COO Nava's Letter to UC Faculty on the principles and considerations that guide the University’s efforts to respond to cyber attacks.

If a device is identified as compromised or at high risk, Trellix HX has a Host Containment feature that allows security teams to:

• Isolate the affected endpoint from the network to prevent further spread of threats.
• Maintain communication with security teams for investigation and remediation.
• Restore access once the threat has been addressed.

Host Containment is used only when necessary to protect the broader network while minimizing disruption to users.

The Office of Information Assurance (OIA) Threat Detection & Response (TDR) Team, when receiving a security investigation for an endpoint from our Managed Detection & Response (MDR) vendor, for most infections will ‘contain’ the infected host using the Trellix console and notify the system owner/system admin. 

Subject to the Electronic Communications Policy (ECP), system data acquisition and review may be required to prevent further harm to the user or the University or to assess the scope of impact (the team does not review content of files). 

For example, if the security event contains information regarding credential harvesting or evidence of lateral movement, the TDR Team will gather evidence from the infected host to understand what credentials were harvested, or what other hosts were logged onto. We also may want to understand the origination of the infection by looking at external communications or browser history.

In a rare occurrence (it has not occurred in the last 5 years) a TDR Team member may require forensic review by ourselves or our MDR vendor. In this case, a full image of the machine in question will be captured. This would be done by a Digital Forensic, Incident Response (DFIR) Tool and most likely would be when P4 data is effected. 

File Acquisition in Trellix HX is designed to enhance security investigations by collecting relevant data during malicious events. This feature helps security teams analyze threats while ensuring data collection remains targeted and aligned with compliance requirements.

What Files Can Trellix HX Collect?

• Logs and system snapshots to capture activity during a security event.
• Details of the malicious file associated with the event.
• Other security-relevant forensic data to assist in incident response.

UC San Diego’s intended use of Trellix HX does not support arbitrary file acquisition from endpoints. UC San Diego handles data in accordance with the Electronic Communications Policy (ECP).  This means security teams cannot retrieve files at will—data collection is strictly focused on identified security incidents.

For more details on how the collected files would be used by our security team for an investigation, please refer to this video: Endpoint Security (HX) - Using Real-Time Events for Investigation

Triage in Trellix HX is a security feature that automatically collects key forensic data when alerts are triggered. This helps security teams quickly assess and investigate potential threats without manual intervention.

What Data Does Triage Collect?

• Active Users: Captures information on users logged into the affected machine at the time of an alert, helping security teams determine user activity and potential involvement in an incident.
• Visited Websites: Records URLs of recently accessed websites, providing visibility into web activity that may have contributed to the security event.
• Downloaded Files: Logs details of files downloaded to the endpoint, helping identify potential malware or unauthorized downloads.

These triage collections occur automatically when an alert is triggered, ensuring security teams receive crucial data in real time. Additionally, security teams can initiate manual triage requests for deeper forensic analysis when necessary.

This targeted approach enhances security investigations while maintaining alignment with privacy and compliance standards.

For additional details, please refer to Trellix Endpoint Security (HX) Documentation.