Threat Prevention protects your Mac from malware threats and unwanted programs by scanning items on your Mac.
When enabled, the software scans files, folders on local, network-mounted volumes, and removable media whenever you access or create an item.
Trellix Endpoint Security (ENS) for Mac uses the latest engine that:
Performs complex analysis using the malware definition files (DATs)
Decodes the contents of the item you access
Compares them with the known signatures stored in the DAT files to identify malware
In addition, Trellix GTI (heuristic network check for suspicious files) looks for suspicious files and programs running on client systems that Threat Prevention protects.
Use Threat Prevention preferences to configure actions for on-access scan, on-demand scan, or to exclude files or paths from scanning.