Trellix Application and Change Control 8.4.5 Windows Release Notes

The Trellix Application and Change Control 8.4.5 release includes new features, enhancements, and resolved issues.

Every update release is cumulative and includes all features and fixes from the previous release. We recommend that you always upgrade to the most current update.

Rating

The rating defines the urgency for installing this update.

This release is recommended for all environments. Apply this update at the earliest convenience.

Release details

For release dates and build numbers, see KB87944.

Upgrade support

This release supports upgrading from:

For information about the TACC extension and client upgrade supported path, see KB87944.

New or changed

[TACC Client] Request approval for users without administrative rights — Users without administrative rights can now request approval for restricted actions.

[TACC Extension] Registry bypass for Windows rule groups — Trellix Application Control now includes a registry bypass option for Windows rule groups. In the Exclusions tab, select Advanced Options → Exclude file from registry operations to apply the registry bypass (attr -g) to a specific process. This policy bypasses registry operations for the specified process on the client.

[TACC Extension] Skiplist for Linux rule groups — The skiplist (-s) option is now available in the user interface for Linux rule groups. In Application Control (Unix) rule groups, select the Exclusions tab, then select Exclude local path and all its files and sub-directories from the allow list. Use this option to exclude a local path and its contents from the allow list.

[TACC Client and Extension] Exclusive TIE Enterprise reputation source — This release introduces an enhancement to the Trellix Threat Intelligence Exchange (TIE) integration. A new TIE Enterprise Trust Level option is now available in the Application Control Options (Windows) policy. When you enable this option, Application Control uses TIE Enterprise as the exclusive source for file reputations, disabling the use of Trellix GTI and Intelligent Sandbox reputations.

Note the following behavior for this feature:

To improve visibility, a new TieEnterpriseLevelTrustEnable property has been added to the System Tree. This property displays the status of the TIE Enterprise Trust Level for each endpoint, allowing you to quickly verify whether the setting is enabled or disabled across your environment.

[TACC Extension] Enhanced reputation display for TIE overrides — To provide a clear context for user-defined reputations, the display format in the Solidcore Events page has been updated. An (Enterprise) suffix is now added for events generated for files whose reputation was specifically overridden as Malicious by a user through the TIE Reputations page.

This applies to events originating from endpoints where the deny reasons are either TIE - Malicious process SHA-1 or TIE - Malicious Certificate.

The Reputation column in the Solidcore Events page now displays these overridden reputations as:

Known issues

For a list of current known issues, see Application and Change Control 8.x Known Issues (KB87839).

Resolved issues

This release resolves known issues.