The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Press CTRL+K to open search

Test Exploit Prevention installation

  • Published on Sep 13, 2026
  • 1 minute(s) read
Prev Next

From the policy, enable Exploit Prevention and update signature 50001 with block and report access. Apply the policy to the client machine.

  1. Run the command to check if Exploit Prevention is enabled or disabled.

    ./mfetpcli --getepstatus

  2. To check the status of signatures, run:

    ./mfetpcli --getallepsignatures

    Note

    Block and report status for signature ID 50001 should be shown as enabled.

  3. Use this command to check violation of the rule:

    touch/usr/bin/watchbog

You will see permission denied as the Block status is enabled. And the event is reported to ePO.

Related articles
  • Check Linux signatures in Exploit Prevention policy
    Endpoint Security (ENS) > ENS 26.x > Trellix Endpoint Security (ENS) 26.x - Installation Guide - Linux > Installing the software on systems managed with Trellix ePO - On-prem > Installing content package for Exploit Prevention
  • Enable Exploit Prevention Policies from ePO - On-prem
    Endpoint Security (ENS) > ENS 26.x > Trellix Endpoint Security (ENS) 26.x - Threat Prevention Product Guide - Linux > Managing Endpoint Security (ENS) for Linux tasks > Exploit Prevention > Configure Exploit Prevention
  • Supported Exploit Prevention commands
    Endpoint Security (ENS) > ENS 26.x > Trellix Endpoint Security (ENS) 26.x - Threat Prevention Product Guide - Linux > Managing Endpoint Security (ENS) for Linux tasks > Exploit Prevention