Trellix EDR analyzes emails reported as phishing to the Security Operations Center (SOC) and helps you perform the investigation.
It identifies and extracts email addresses, subject, body, attachments, metadata, and headers for better visualization. It also lets you view, analyze, and respond to phishing reports. Trellix EDR automatically analyzes IP addresses, fully qualified domain names (FQDNs), and files available on the analyzed email.
Important
This feature is only supported if your tenant is hosted in a United States data center.
Log on to Trellix EDR as administrator.
Click the configuration icon on the top-right corner to access the Configuration page.
Click Manage integrations, then click + Add to add an integration.
In the Name field, type the phishing email if you want to provide an email evidence of phishing and create an investigation.
Note
Phishing emails are supported only in unsigned and unencrypted
.emland.msgformats.Under the Action drop-down list, select Add Email Evidence, then click Save to add a new integration.