In Trellix EDR, when a trigger or reaction executes or fails to execute, an Event ID entry is added to the ePO - On-prem or ePO - SaaS Threat Event Log.
Event ID | Event name | Description |
|---|---|---|
36645 | Trellix EDR reaction event | A reaction event is executed. |
36646 | Trellix EDR reaction event failure | A reaction event executed with errors. |
36655 | Update successful | Content update is successful. |
36656 | Update failed | Content update failed. |
36657 | Roll back successful | Roll back of trace content is successful. |
36658 | Roll back failed | Roll back of trace content failed. |
36659 | Trellix EDR install event failure | An install event executed with errors. |
36660 | Trellix EDR trace connection success | A trace connection using VLAN Trunk Protocol (VTP) or RepBO is successful. |
36661 | Trellix EDR trace internal reputation failure | Trace connection using VTP or RepBO failed. |