Configuring Exploit Guard

Endpoint Security (HX) xAgent software version 21 or later supports exploit detection, a component of Exploit Guard. Endpoint Security (HX) xAgent version 23 or later supports exploit prevention, another component of Exploit Guard.

Exploit Guard components use an internal rules file and an exclusion file that lists common files to be excluded from Exploit Guard processing. These files are supplied by Trellix only. Updates to the rules and exclusion files are provided automatically through Trellix's Dynamic Threat Intelligence (DTI) cloud.

Note

Exploit Guard is supported for desktop operating systems Windows XP SP3, Windows 7, Windows 8, Windows 10 and Windows 11 as well as Windows server operating systems 2008, 2012, 2016, 2019 and 2022. The operating system is automatically detected by the agent.

Exploit Guard is not supported on endpoints where the monitored applications (

Adobe Reader, Adobe Flash, Microsoft Edge, Firefox, Google Chrome, Java, Microsoft Outlook, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint, and Microsoft Office 2010

fltldr.exe

files

) are streamed from a virtual application server, such as App-V, Xenapp, or VMware ThinApp. Exclude streamed applications from Exploit Guard processing for the affected endpoints. If all your endpoints are affected, use a global policy; if only a few endpoints are affected, use host sets in an exception policy.

You can set policies for Exploit Guard that are specific to your organization. Using these policies, you can:

Turn Exploit Guard on and off for all host endpoints.
Maintain a global policy, specific to your installation for all host endpoints, that allows you to specify global Exploit Guard options.
Maintain an exception policy for selected host sets.

For information about defining Exploit Guard policies and managing Exploit Guard, refer to the Endpoint Security Agent (HX) Administration Guide.