The process section settings control Endpoint Security (HX) xAgent processing. These settings can also be changed manually for an individual host using a text editor.
Setting Key | Default | Supported Edit Methods | ||
|---|---|---|---|---|
Web UI | CLI | API | ||
100 percent | Yes | Yes | Yes | |
true | Yes | No | Yes | |
idle | Yes | No | Yes | |
true | No | No | Yes | |
-- | Yes | No | Yes | |
cpu_limit Key
The cpu_limit key specifies the maximum percentage of CPU use allowed by all agent processes. Valid values range from 10 through 100 percent. The default is 100 percent.
The CPU usage total of all agent processes must stay within this limit. Non-agent processes do not count towards the limit.
Note
Real-time collection is excluded from CPU limiting.
macOS endpoints do not support CPU limiting.
For more information about the use of this field, see CPU Limiting.
The cpu_limit setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"cpu_limit": 100,
deny_local_admin_stop: true
"priority": "idle",
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (see Setting the Maximum CPU Limit).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
deny_local_admin_stop Key
The deny_local_admin_stop key indicates whether agent protection is activated or disabled for agent service. Valid values are true (protection is activated or enabled) and false (protection is not activated or disabled). The default is true, which means your system administrators cannot stop or restart the Endpoint Security (HX) Agent service on your Windows endpoints.
This protection is provided only for Windows agents running Windows Vista, Windows 2008, or later Windows versions. It prevents or allows agent service termination.
The deny_local_admin_stop setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"priority": "idle",
"cpu_limit": 100,
"deny_local_admin_stop": true
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (See Configuring a Tamper Protection Policy).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
priority key
The priority key specifies the scheduling priority of the xAgent process for acquisitions. Valid values are highest, high, above, normal, below, and idle. The default is idle.
Important
Trellix recommends that you use the Web UI to change the priority scheduling setting in the Agent Default Policy to NORMAL immediately after you upgrade your Endpoint Security (HX) server to version 4.5.0 or later.
Note
Priority Scheduling for xAgent processes is only supported on Trellix Endpoint Security (HX) version 4.5 or later.
The table below defines the base priority settings available for xAgent processes.
xAgent Process Base Priority Settings | Description | Base Priority Class by Operating System | |
|---|---|---|---|
Windows | macOS/Linux | ||
IDLE | xAgent process threads are prioritized at the lowest base priority and will only run when the CPU is idle. All other process threads run at a higher priority. An IDLE setting will also result in longer I/O delays for agent processing. ImportantIDLE is the default priority scheduling setting assigned to agent process threads. Trellix recommends that you use the Web UI to change the priority scheduling setting in the Agent Default Policy to NORMAL immediately after you upgrade your Endpoint Security (HX) server to version 4.5.0 or later. | IDLE_PRIORITY_CLASS | 19 |
BELOW NORMAL | The operating system prioritizes agent process threads above process threads with an IDLE base priority but below process threads with a NORMAL base priority. | BELOW_NORMAL_PRIORITY_CLASS | 5 |
NORMAL | The operating system does not assign agent process threads any special scheduling needs. | NORMAL_PRIORITY_CLASS | 0 |
ABOVE NORMAL | The operating system prioritizes agent process threads above process threads with a NORMAL base priority but below process threads with a HIGH base priority. | ABOVE_NORMAL_PRIORITY_CLASS | -5 |
HIGH | xAgent process threads preempt process threads with a ABOVE NORMAL, NORMAL, or IDLE base priority. Process threads assigned a HIGH base priority are considered time-critical tasks and must be executed immediately. ImportantTrellix does not recommend setting the priority scheduling value for xAgent process threads to HIGH. Process threads with a HIGH base priority may use nearly all of the available CPU time on your host endpoint. | HIGH_PRIORITY_CLASS | -10 |
HIGHEST | xAgent process threads are given the highest base priority and preempt process threads assigned all other base priority levels and important process tasks performed by the operating system. | REALTIME_PRIORITY_CLASS | -20 |
The priority setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"cpu_limit": 100,
deny_local_admin_stop: true
"priority": "idle",
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (see Setting the Priority Schedule for Agent Processes).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
protection_enabled key
The protection_enabled key indicates whether xAgent protection is activated. Valid values are true (protection is activated) and false (protection is not activated). The default is true.
Important
: Trellix does not recommend disabling your Tamper Protection policy because it may allow users with administrative rights, threat actors, and malware to compromise your endpoint protection.
This protection is provided for Endpoint Security (HX) xAgents version 20 or later running on Windows endpoints only. It prevents an agent services from being stopped or restarted.
The protection_enabled setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). See the example below.
"process":
{
"cpu_limit": 100,
deny_local_admin_stop: true
"priority": "idle",
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (See Configuring a Tamper Protection Policy).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).
uninstall_password key
The unistall_password key specifies the password required to uninstall password-protected Endpoint Security (HX) xAgent software from the host endpoint using the msiexec.exe command line option.
The uninstall_password setting is provided by the Endpoint Security (HX) server through the agent configuration. The process uininstall_password setting should be listed within quotation marks ("). Enclose the full list of process settings in braces ({}). The password value consists of a lowercase salt:hash value (16-byte random salt and sha256 hash). See the example below.
"process":
{
"cpu_limit": 100,
deny_local_admin_stop: true
"priority": "idle",
"protection_enabled": true,
"uninstall_password": "QxLUF1bgIAdeQXyy:326354F3E06CABB2A9CDC97ABCC2FADE1686EC6656EF3B20415F5569EED79E04"
}
Change this setting using one of the following methods:
Web UI (see Configuring the Agent Removal Protection Password).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).