The Trellix DXL includes client software and brokers that allow bidirectional communication between endpoints on a network.
Trellix DXL works in the background, communicating with services, databases, endpoints, and applications. The Trellix DXL client is installed on each managed endpoint, so that threat information from security products that use DXL can be shared immediately with all other services and devices. Sharing reputation information as soon as it is available reduces the security assumptions that applications and services make about each other when they exchange information. This shared information reduces the spread of threats.
DXL clients maintain a persistent connection to their brokers regardless of their location. Even if a managed endpoint running the client is behind a NAT (network address translation) boundary, it can receive updated threat information from its broker located outside the NAT.
For details about using Trellix DXL, see Trellix Data Exchange Layer Product Guide.