When you see a suspicious login activity or unusual user behavior on the endpoint, you can terminate the selected user's session remotely on the endpoint using the specific user name.
The Execute User Logoff reaction is supported on Windows, Linux, and macOS endpoints.
Log on to Trellix EDR.
Select Menu → Real-time Search.
On the Search box, enter a search expression.
Click the search icon to start collecting data from managed devices.
Based on the search expression, the list of events, processes, or devices is displayed.
From the list, select the affected event, process, or device, then select Action → Contain → Execute User Logoff.
A new window appears and then you can enter details:
User name — The user to be logged off.
Click Confirm to complete the Execute User Logoff action.
A confirmation message displays as the action launched is completed successfully.
On the Action History dashboard, Action Status displays the execute user logoff action as Completed.