Managing remediation actions

After an infected file is placed in quarantine, the Endpoint Security (HX) xAgent 's malware protection engines perform specific remediation actions to prevent the infection from spreading to other files on the host endpoint or to other endpoints on your network. These remediation actions include cleaning the infected file, removing any malware traces, and notifying the endpoint user when a file is quarantined or cleaned. You can enable and disable the malware protection remediation actions for all of your host endpoints or select host sets in your environment using the Web UI or the API.

This section covers how to use the Web UI to modify the agent default policy or a custom policy to enable or disable malware protection remediation actions.

Managing remediation actions for MalwareGuard

By default, remediation actions for MalwareGuard processing are disabled for all of your host endpoints. You can enable and disable remediation actions for MalwareGuard processing for all of your host sets using the agent default policy. You can also enable and disable remediation actions for MalwareGuard processing for specific host sets in your environment using a custom exclusion policy.

Important

MalwareGuard is supported for Windows agents version 27 and later only.

By default the Enable Quarantine Actions for MalwareGuard setting is disabled in the xAgent default policy.

This section covers how to use the Web UI to enable and disable remediation actions for MalwareGuard processing for all of your host endpoints or for select host sets in your environment. See the Endpoint Security (HX) REST API Guide for information on using the API to enable and disable remediation actions for MalwareGuard processing.

Enabling Remediation Actions for MalwareGuard

Follow the instructions in this section to create a custom policy that enables remediation actions for MalwareGuard processing and assigns the policy to all of your host endpoints or select host sets in your environment.

To create a custom policy for MalwareGuard processing:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
Click Create a Custom Policy to go to the Create Policy page.
Enter a policy name in the Name field and a policy description in the Description field.
Click CATEGORIES to access a list of the policy categories.
Select the Malware Protection checkbox and click Apply

To enable the quarantine actions for MalwareGuard setting in your custom policy:

In the Malware Detection section, toggle the Signature and Heuristic Detection ON/OFF switch and the MalwareGuard Detection ON/OFF switch to ON.
Important
You must enable malware detection (Signature and Heuristic Detection) before you enable MalwareGuard.
In the Quarantine section, toggle the Quarantine ON/OFF switch to ON.
Important
You must enable MalwareGuard Detection and Quarantine before you enable remediation actions for MalwareGuard.
Locate Quarantine Actions and select the Enable Quarantine Actions for MalwareGuard option to enable quarantine actions for MalwareGuard processing.
Click Save.

Now you can assign all of your host sets to the custom policy or select host sets to the custom policy. You can also set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Disabling Remediation Actions for MalwareGuard

To disable the remediation actions for MalwareGuard setting in your custom policy:

Note

When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Enable Quarantine Actions for MalwareGuard option to disable remediation actions for MalwareGuard processing.
Click Save.

Cleaning Quarantined Files

When malware is detected on an endpoint and an infected file is quarantined, the Trellix Endpoint Security (HX) xAgent malware protection engine attempts to clean the file by removing the malware infection. If a file cannot be cleaned, it is removed from the endpoint.

You can enable and disable the malware protection file clean setting for all of your host sets using the xAgent default policy. You can also enable and disable the malware protection file clean setting for specific host sets in your environment using a custom exclusion policy.

Important

Operating system permissions on the host endpoint may prevent malware protection from cleaning an infected file or application.

Malware protection processing (malware detection) and quarantine must be enabled, or file clean is ignored.

This section covers how to use the Web UI to enable and disable the malware protection file clean setting. See the Endpoint Security (HX) REST API Guide for information on using the API to enable and disable the malware protection file clean setting.

Enabling File Clean

To enable the file clean setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Click Save.

To enable the file clean setting for selected host sets:

Note

See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Disabling File Clean

To disable the file clean setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Clean Infections from File (Once Quarantined) option to disable and ignore the removal of malware infection from quarantined files.
Click Save.

To disable the file clean setting for selected host endpoints:

Note

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Clean Infections from File (Once Quarantined) option to disable and ignore the removal of malware infection from quarantined files.
Click Save.

Removing Malware Traces from Quarantined Files

In addition to cleaning the infected file, Trellix Endpoint Security (HX) xAgent malware protection engine can remove artifacts created by the malware and revert any changes the malware infection may have made to other files or registry entries on the host endpoint. You can enable and disable the removal of malware traces through the Web UI or the API.

Important

Malware protection processing, including malware detection (Signature and Heuristic Detections), Quarantine, and Clean Infection from Files (Once Quarantined) must be enabled, or malware trace removal is ignored.

This section covers how to use the Web UI to enable and disable the malware trace removal setting. See the Endpoint Security (HX) REST API Guide for information on using the API to enable and disable the malware trace removal setting.

Enabling Malware Trace Removal

To enable the malware trace removal setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Important
Clean Infections from File (Once Quarantined) must be enabled, or malware trace removal is ignored.
Select the Remove Malware Traces (Once Quarantined) option to enable the removal of malware artifacts and file and registry cleanup.
Click Save.

To enable the malware trace removal setting for selected host sets:

Note

See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Important
Clean Infections from File (Once Quarantined) must be enabled, or malware trace removal is ignored.
Select the Remove Malware Traces (Once Quarantined) option to enable the removal of malware artifacts and file and registry cleanup.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Disabling Malware Trace Removal

To disable the malware trace removal setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Remove Malware Traces (Once Quarantined) option to disable the removal of malware artifacts and file and registry cleanup.
Click Save.

To disable the malware trace removal setting for selected host sets:

Note

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Remove Malware Traces (Once Quarantined) option to disable the removal of malware artifacts and file and registry cleanup.
Click Save.

Managing Malware Protection Notification Alerts

Allow your endpoint users to receive notification alerts when Trellix's malware protection engine identifies a file infected with malware and places the infected file in quarantine or attempts to clean the infected file. You can enable and disable quarantine and clean notification alerts using the Web UI or the API

Important

The appearance of the malware protection quarantine and clean notification alerts on the host endpoints depends on the version of Windows you are running on your endpoints.

This section covers how to use the Web UI to enable and disable the malware protection notification alerts. See the Endpoint Security (HX) REST API Guide for information on using the API to enable and disable the malware protection notification alerts.

Enabling Malware Protection Notification Alerts

To enable the malware protection notification alert setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Important
Clean Infections from File (Once Quarantined) must be enabled, or notification alerts are ignored.
Select the Notify the User on the Host When a File Has Been Quarantined or Cleaned option enable notification alerts.
Click Save.

To enable the malware protection notification alert setting for selected host sets:

Note

See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Verify that malware detection and quarantine are enabled by ensuring that the Signature and Heuristic Detection ON/OFF switch and the Quarantine ON/OFF switch are both set to ON.
Important
Malware detection (Signature and Heuristic Detection) and quarantine must be enabled before you enable malware protection quarantine actions.
Enabling quarantine may result in data loss when malware is blocked in an active process or file and malware protection terminates the process that started the infection.
Locate Quarantine Actions and select the Clean Infections from File (Once Quarantined) option to enable file cleaning for quarantined files.
Important
Clean Infections from File (Once Quarantined) must be enabled, or notification alerts are ignored.
Select the Notify the User on the Host When a File Has Been Quarantined or Cleaned option to enable notification alerts.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Disabling Malware Protection notification alerts

To disable the malware protection notification alert setting for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link to access the Edit Policy page.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Notify the User on the Host When a File Has Been Quarantined or Cleaned option to disable notification alerts.
Click Save.

To disable the malware protection notification alert setting for selected host sets:

Note

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Malware Protection tab.
Locate Quarantine Actions and clear the Notify the User on the Host When a File Has Been Quarantined or Cleaned option to disable notification alerts.
Click Save.