During remediation, you can delete the potential threat's selected folder or folders on the endpoint remotely using the full path of the folder.
The Delete Folder reaction is executed when a folder is opened in the terminal, the folder is deleted once the endpoint is rebooted.
The delete folder reaction is supported on Windows, Linux, and macOS endpoints.
Log on to Trellix EDR.
Select Menu → Real-time Search.
On the Search box, enter a search expression.
Click the search icon to start collecting data from managed devices.
Based on the search expression, the list of events, processes, or devices is displayed.
From the list, select the affected event, process, or device, then select Action → Mitigate → Delete Folder.
A new window appears and then you can enter details:
Full path — The folder's full path.
Click Confirm to complete the Delete Folder action.
A confirmation message displays as the action launched is completed successfully.
On the Action History dashboard, Action Status displays the delete folder action as Completed.