Trellix EDR services are available in two modes: Trellix EDR running on ePO - On-prem and Trellix EDR running on ePO - SaaS cloud services. Trellix EDR services run on ePO - SaaS cloud services.
Trellix EDR on ePO - On-prem
ePO - On-prem manages Trellix EDR extensions to communicate with the DXL Broker and Trellix EDR cloud services.
The DXL Broker is a communication fabric among Trellix EDR services, the cloud, and devices.
The devices relay data back to the ePO - On-prem server and DXL Broker.
Devices with Active Response clients (if present) send data back to ePO - On-prem and DXL Broker.
Send Trellix EDR traces to AWS S3 bucket.
Trellix EDR on ePO - SaaS cloud
Trellix EDR cloud services communicate to ePO - SaaS.
Trellix EDR client sends data to ePO - SaaS and Trellix EDR cloud services.