Trellix EDR Release Notes (Cloud) - October 15, 2024

Mode selection — The Ask Wise functionality offers two selection modes based on the nature of the threat analysis: Interactive Mode and Dossier Mode. These modes enable users to effectively engage with and analyze threats.

Interactive Mode — Interactive Mode is a dynamic feature that enables users to choose various analysis options for detailed information about a threat. Utilizing Generative AI, it provides insights based on the selected options and includes multiple sections for exploration.

Dossier mode — Dossier Mode consolidates the output of the Generative AI analysis for a selected threat, providing a summary and recommendations. This information is displayed in a structured section format within the Trellix Endpoint Detection and Response user interface.

Knowledge graph analysis — The Knowledge Graph analysis option features color-coded representation for each node, indicating severity levels: red for high severity, yellow for medium severity, and blue for no severity. Additionally, the Knowledge Graph now includes Process IDs (PIDs) for each node, representing individual processes.

Note

The Knowledge Graph option is only available in Interactive mode and not in Dossier mode.

Draft an Email — A Draft an Email analysis option is newly introduced under the Trellix Wise functionality Ask Wise and this option enables SOC Analysts to send detailed threat analyses or notify users about malicious processes or files via email.

Expand view option —The Expand View option is now available in the Ask Wise pane under the Trellix EDR Monitoring dashboard. This option allows users to expand the view pane for a better display of the analysis and contract it as needed.

Language selection — The language selection option is available under the Ask Wise pane in the Trellix EDR Monitoring dashboard. Supported languages include English, French, Italian, Portuguese, Spanish, Japanese, Korean, Thai and German with English as the default. This functionality allows analyses to be performed in the user’s preferred language.

Event selection — The Event Selection functionality in the Trellix EDR Device Search enables you to choose any event associated with an artifact for analysis using the Ask Wise option. By specifying the event occurrence time frame, you can refine the search window to select only the relevant events for analysis.

Note

You can select a maximum of 25 events to analyze with Ask Wise option, regardless of the artifact chosen. Once the 25-event limit is reached, a yellow prompt will appear at the end of the events list.

Event highlighter — The event highlighter in Trellix EDR Device Search ensures that once an event is selected for analysis with the Ask Wise, it cannot be selected again, thereby preventing the duplication of events.

Print Option — This functionality allows you to print detailed analyses of a particular threat or save the analyses as a PDF file. The print option is available in both Interactive and Dossier modes.

Feedback system — You can provide feedback on the assistance received from the Trellix Wise. The feedback system includes a rating option, allowing you to rate the support from 1 (poor service) to 5 (excellent service). Additionally, you can include constructive comments in the Additional Feedback section.

Caching — Trellix Wise now includes an inbuilt caching feature, allowing users to obtain requested data from the cache without delay. The language selection feature also supports caching, enabling users to perform analyses in the same language used previously.