Press CTRL+K to open search

Install Trellix EDR on ePO - On-prem

Updated
  • Updated on Sep 10, 2026
  • Published on Aug 27, 2026
  • 6 minute(s) read
Prev Next

You can install Trellix EDR locally on the ePO - On-prem server.

  • Make sure that you have ePO - On-prem 5.10.x or later installed.

  • For information about deploying Trellix Agent, see the Trellix Agent Installation Guide.

  • Make sure to install the DXL broker extension before you install the Trellix EDR 4.1.x client.

  • On Software Catalog, you can see the following options when there is an update in release version — <major>.<minor>.<patch>.<build>.

    • The Update option is displayed only when there is a change in the "<patch> or <build>" or "<patch>.<build>".

    • The Check-in option is displayed only when there is a change in the "<major> or <minor>" or "<major>.<minor>"

Important

If you are using older versions of Trellix products on macOS, make sure to install or upgrade to the latest rebranded version for all the products to function normally. Upgrading any one of the products, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed. For more information about installing or upgrading Trellix products on macOS, see KB96485.

Upon installation or upgrade of the Trellix EDR client, you might have to reboot the client system.

Note

You can link multiple ePO - On-prem environments to a single tenant by following the same steps from 6 to 10.

  1. Log on to Trellix EDR as administrator.

  2. Click the configuration icon on the top-right corner to access the Configuration page.

  3. On the Configuration page, select Use Trellix ePO - On-prem for management.

    Important

    Make sure you select the correct configuration. This setting can only be changed with the assistance of Customer Support.

  4. Click Save, then click Continue to confirm the configuration.

  5. In the View account settings section, you can opt to share telemetry data by selecting I choose to share telemetry data (defined below) with Trellix and its third-party processors, then click Save.

  6. Check in the Trellix EDR extension:

    1. Log on to ePO - On-prem as administrator.

    2. Select Menu → Software → Software Manager / Software Catalog, then under Product Categories search for Trellix EDR.

    3. Select the Trellix Endpoint Detection & Response product to view the list of available components.

      Note

      Select the appropriate Trellix EDR client package for Windows, Linux, or macOS endpoints.

    4. For the Trellix EDR component, under Actions click Check In.

    5. Read the Trellix End User License Agreement and select I accept the terms in the license agreement checkbox.

    After checking in the Trellix EDR extension, all dependent extensions and packages are installed.

    • ePO - SaaS Cloud Bridge

    • Trellix EDR Endpoint Snapshot Tool

    • Trellix EDR

    • Trellix Data Exchange Layer extensions

    • Trellix Data Exchange Layer broker extensions

    • Trellix EDR Client

    • Trellix EDR Client Package

  7. Add your Trellix EDR account credentials to ePO - SaaS Cloud Bridge:

    1. From ePO - SaaS, select Menu → Configuration → Appliance and Server Registration.

      1. Click Add to add a new registration token.

      2. Select the Client type as Trellix ePolicy Orchestrator - SaaS.

      3. Type the number of appliances or servers you want to register in the Number of clients field and click Save.

        To view the generated token, expand Trellix ePolicy Orchestrator - SaaS under Servers. Note down the registration token.

      4. Perform one of these actions if you want to revoke the token:

        • From the token list, click Revoke under Actions.

        • Select the token, then select Revoke from the Take Action drop-down list in the token details pane.

        • To revoke the token from a client - select a token from the token list, then select one or more clients from the Registered Clients pane and select Revoke from the Take Action drop-down list.

    2. Log on to the ePO - On-prem server as an administrator. Select Menu → Configuration → Server Settings, then select Trellix ePO-SaaS Cloud Bridge from Setting Categories. The Trellix ePO-SaaS Cloud Bridge Server Settings page displays these options:

      1. Status— Displays the status of the connection. See Status Messages for detailed status information.

        Note

        Before you configure your connection, the status is This server is not linked with Trellix ePO-SaaS.

      2. Tenant ID — Displays the tenant ID of the linked ePO-SaaS account.

      3. Cloud Bridge Client ID — Displays the Client ID associated with the token.

    3. From the Trellix ePO-SaaS Cloud Bridge Server Settings page, click Edit.

      1. Enter the Registration Token generated from Step a.

      2. In the ePO Logon URL section, enter the ePO - On-prem URL which you are using to access the on-premises ePO - On-prem server.

      3. Click Save.

        Note

        The Cloud Bridge settings page now contains a field ePO Logon URL which can be seen only from ePO - On-prem 5.10.0 Update 7 onwards. This URL is added to the allowed URL list in Identity and Access Management (IAM). This is needed for IAM to redirect the user to the on-premises ePO - On-prem after authentication using Log On With ePO - SaaS feature.

    4. The ePO - SaaS Cloud Bridge Server Settings page displays the status as This server is actively linked, and the linked account as the email address for the Trellix account:

      1. Status — After configuration, above the Refresh button, the status is This server is actively linked.

      2. Trellix ePO-SaaS Tenant ID — The ID for the particular ePO - SaaS tenant.

      3. Cloud Bridge Client ID — The Client ID associated with the token.

      4. ePO Logon URL — Your ePO - On-prem URL which you are using to access the ePO - On-prem server.

      Your ePO - On-prem server is now connected to the ePO - SaaS account.

      Note

      You might see some error messages while linking your ePO - On-prem account with the ePO - SaaS account. For more information, see Common error messages while linking ePO - On-prem with ePO - SaaS account.

    5. To view the connected servers in ePO - SaaS, go to Menu → Configuration → Appliance and Server Registration.

      1. Click Trellix ePolicy Orchestrator - SaaS under Servers.

      2. The Used Clients column displays the number of clients connected to ePO - SaaS.

  8. The Correct DXL Cloud Databus URL server task in ePO automatically configures the DXL Cloud Databus URL based on your region. By default, this server task runs daily to verify and correct the URL.

    To modify the server task:

    1. In ePO, go to Menu > Configuration > Server Tasks.

    2. In the Server Tasks page, locate the Correct DXL Cloud Databus URL server task, and then select Edit in the Actions column.

    3. On the Description tab, modify the Name and Notes.

    4. Enable or disable the Schedule Status, and then select Next.

    5. On the Actions tab, select Next.

    6. On the Schedule tab, choose the schedule type, start date, end date, and schedule time, and then select Next.

    7. On the Summary tab, review the settings, and then select Save.

    To update the data center location manually follow these steps.

    1. In ePO, go to Menu > Configuration > Server Settings.

    2. In the Setting Categories pane, select DXL Cloud Databus.

    3. Click Edit and enter the URL for your server destination.

      The following lists the DXL Cloud Databus URLs by data center location.

      • US-West data center — https://api.soc.trellix.com/cloudproxy/databus/produce

      • US-East data center — https://api.soc.us-east-1.trellix.com/cloudproxy/databus/produce

      • Frankfurt data center — https://api.soc.eu-central-1.trellix.com/cloudproxy/databus/produce

      • Canada data center — https://api.soc.can-central-1.trellix.com/cloudproxy/databus/produce

      • Asia Pacific South data center — https://api.soc.ap-south-1.trellix.com/cloudproxy/databus/produce

    4. Click Save.

    An incorrect URL configuration in the DXL Cloud Databus causes Trellix EDR features to become non-functional or display incomplete data.

    If you are unsure of your data center location, contact Trellix Support and provide your tenant ID.

  9. Install or upgrade the DXL broker to version 5.0.x or later.

    For details about installing or upgrading DXL broker, see Trellix Data Exchange Layer Installation Guide.

  10. Deploy the Trellix EDR client to devices:

    1. On ePO - On-prem, select Menu → Product Deployment, then click New Deployment.

    2. Enter a name and description for the deployment task.

    3. Select the appropriate Trellix EDR client package for Windows, Linux, or macOS endpoints as the software package.

    4. Click Select Individual Systems.

    5. From System Tree, on the System Selection page, select the devices where you want to deploy the Trellix EDR client, then click OK.

    6. Click Run Immediately to start the deployment task immediately.

    7. Click Save.

    Note

    When installing Trellix EDR client on macOS endpoints, the endpoint user is prompted with pop-ups to grant permission for TrellixSystemExtensions on the general tab from the security and privacy page. Also, you must allow full disk access for TrellixSystemExtensions and fmpd on the privacy tab.

  11. On Trellix EDR, click the configuration icon to access the Configuration page:

    1. Select Install components, then click Done.

    2. Select Configure data sources, click Trellix ePO - On-prem, and verify whether the connection status is green.

  12. Check that all Trellix EDR basic components are installed and the product is connected to ePO - On-prem.

    To install Trellix EDR on another ePO - On-prem system, follow steps 6 through 10.

Related articles