Before you install or upgrade the xAgent software

Third-party antivirus software packages use advanced heuristics engines to evaluate and protect your host endpoints. To ensure that Endpoint Security (HX) xAgent processes are not subject to these heuristics, verify that the agent executable files (*.exe files) meet the following requirements for the following antivirus software vendors (if applicable in your environment):

For more information, refer to the documentation provided with your antivirus software.

Rarely, third-party security software identifies installed Endpoint Security (HX) xAgent files and activity as malicious. It is a good idea to whitelist or exclude xAgent files from real-time scanning and behavioral analysis (sometimes known as HIPS) in your third-party security software. Endpoint Security (HX) xAgent software version 27 or later supports whitelisting by the original filename, which ensures that whitelisted files remain on the excluded list even if a user changes the filename. Endpoint Security (HX) xAgent software version 30 or later supports whitelisting by actor-based process, which allows you to suppress alerts for short lived processes.

In addition,Trellix strongly recommends that you create malware protection process, file and folder exclusions for any third-party antivirus software. For example, if you are running McAfee antivirus software on your host endpoints, you should use the Malware Protection tab to create exclusions for McAfee processes, files, and folders.

Be sure to create malware protection process, file, and folder exclusions for the following third-party antivirus software running on your host endpoints:

This will maximize performance, ensure compatibility with other antivirus software, and reduce the number of duplicate alerts you receive from the Endpoint Security (HX) xAgent malware protection feature and your third-party antivirus software. Use the malware protection global policy to define these exclusions. See Defining the Malware Protection Exclusion Policy  for more information.

You must whitelist the xAgent process ID to allow traffic from any contained Windows xAgent , and any contained macOS xAgent version 30 and later, that uses a proxy server to communicate with the Endpoint Security (HX) Server version 4.8 and later.

You must whitelist the xAgent process ID to allow traffic from any contained Linux agent version 34 and later that uses a proxy server to communicate with the Endpoint Security (HX) Server version 5.2 and later.

Endpoint Security (HX) supports certificate-based whitelisting for malware alerts only. This means that you can specify a family of binaries with a single rule. Certificate-based whitelisting can be provided through the Dynamic Threat Intelligence (DTI) Portal, or you can mark an alert as false positive, selecting the Digital Signature condition. This will identify all alerts with this certificate as false positive.