EDRF On-prem January 2026

Trellix EDR with Forensics (EDRF) On-prem January 2026 release includes the following performance enhancements.

Release details

For release details and supported platforms, see the Trellix Knowledge Base (KB) article, Supported Platforms for Trellix EDR with Forensics - KB000014084.

New or changed

Performance enhancements for EDRF On-prem telemetry

To improve the EDRF On-prem telemetry performance, the following components are updated to increase the DXL Broker throughput to the EDR Telemetry Store:

DXL Broker extension version 6.1.3
EDRF ePO extension version 2.1.2

When used together, these updates improve telemetry ingestion rates for on-premises EDRF deployments (version 50.1 or later). These optimizations support up to 18,000 endpoints per standard DXL Broker appliance.

To achieve the throughput improvements, upgrade all DXL Brokers to version 6.1.3 or later. For more information, see Trellix Data Exchange Layer 6.1.x Release Notes.

Verify the current DXL Broker version to determine the upgrade path:

Upgrade from DXL Broker 6.1.2 or earlier
Determine the EDR Telemetry Store registration status:
- If an EDR Telemetry Store server is registered, perform the following steps:
  1. Delete the EDR Telemetry Store registered server.
  2. Upgrade the DXL Brokers to version 6.1.3.
  3. Install the EDRF ePO extension version 2.1.2.
  4. Register the EDR Telemetry Store server.
- If an EDR Telemetry Store server is not registered, proceed with the standard upgrade procedure.
Upgrade from DXL Broker 6.1.3 or later: If DXL Broker 6.1.3 or later is deployed to all DXL Brokers and no EDR Telemetry Store server is registered, perform the following steps:
1. Install the EDRF ePO extension version 2.1.2.
2. Register the EDR Telemetry Store server.

For more information, see Install or upgrade the DXL Broker.