Trellix Attack Path Discovery (APD) is a cloud-based security solution for continuous threat exposure management. It identifies, surfaces, prioritizes, validates, and maps the paths an attacker can exploit based on misconfigurations and vulnerabilities to reach critical assets.
Trellix APD correlates data across managed user assets. This intelligence includes vulnerabilities, identities, network topology, threat-informed context, and system configurations. The platform does not analyze vulnerabilities or network alerts in isolation.
Trellix APD enables Security and IT teams to move beyond reactive vulnerability management. Teams can focus remediation efforts on the exposures that present the highest business risk. It provides a shared, risk-based view of security posture. Organizations can proactively reduce attack paths, improve remediation efficiency, and strengthen cyber resilience.
The Trellix NDR integration displays potential lateral movement and privilege escalation chains directly in the investigation console. This integration connects passive network detection with proactive risk mitigation.
Note
This integration requires a Trellix NDR Enterprise license. Trellix APD is not available as an on-premises or air-gapped solution.
How it works
Trellix APD integrates with Trellix NDR to identify attack paths and prioritize risks. The platform correlates asset telemetry with vulnerability intelligence. This reveals exactly how attackers move through your environment.
The Trellix NDR command-line interface generates authentication keys. Trellix Support uses the keys to provision a secure cloud tenant.
Data collector scripts are deployed to managed user endpoints. The scripts collect asset telemetry and send it to the platform.
Supported vulnerability scanners connect using API credentials. The platform imports vulnerability data from Tenable, Qualys, and Rapid7.
The cloud platform analyzes the telemetry and vulnerability data. This calculation builds risk scores and maps network choke points.
Security analysts detect and investigate threats in the Trellix NDR console. By default, analysts redirect to the portal from the console menu. Analysts can also access the platform directly through a URL.
System administrators export detailed remediation reports. These reports provide recommended prioritized actions to eliminate attack paths and reduce risk.
Note
Verify active data collectors in the Risk Insights tab. Confirm scanner connections in the Vulnerability Sources menu. Accurate data collection ensures reliable attack path mapping.