Trellix-defined containment rules block or log actions that contained applications perform. You can change the block and report settings, but you can't otherwise change or delete these rules.
Make sure that the interface mode for the Trellix Endpoint Security (ENS) Client is set to Full access or log on to the Trellix Endpoint Security (ENS) Client as administrator.
Open the Trellix Endpoint Security (ENS) Client.
Click Adaptive Threat Protection on the main Status page.
Or, from the Action menu
, select Settings, then click Adaptive Threat Protection on the Settings page.Click Show Advanced.
Click Dynamic Application Containment.
In the Containment Rules section, select Block, Report, or both for the rule.
To block or report all, select Block or Report in the first row.
To disable the rule, deselect both Block and Report.
In the Exclusions section, configure executables to exclude from Dynamic Application Containment. Processes in the Exclusions list run normally (not contained).
Click Apply.