The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Enabling the Block on Detection

  • Published on Sep 11, 2026
  • 1 minute(s) read
Prev Next
Skip to main content

To block access when Process Guard detects an attack, enable the Block on Detection toggle. When the configuration updates on the agent, the Process Guard Module will block attackers from obtaining credential data or key material stored within the LSASS process.

Note

This behavior has changed since the technical preview release, which blocked the processes by default when there was no detection only capability.

Related articles
  • Why is Process Guard not blocking the process?
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Frequently Asked Questions‌
  • Detecting Processes Accessing LSASS
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Installing the Process Guard Module‌
  • Enabling the Process Guard Agent Module
    Endpoint Security Modules (HX) > Process Guard > Endpoint Security Process Guard Module User Guide Release 1.7.0 > Configuring the Process Guard Module‌ > Configuring the Process Guard Agent Policy‌