With Trellix EDR, you can prioritize threats based on the risk assessment of the situation and investigate. Threat prioritization helps you in mitigating the impact of threats on the environment.
You can trace the threats from the time when they first affected the endpoint and create an investigation case for each threat. Threats are categorized by rank. Rank is the measure of confidence about a detected threat's severity and how malicious it is. Select a threat from the threat list. By default, the threats are sorted by ranking. However, you can sort threats by time.
Threats are formed by a group of alerts aggregated by hash or command line of the process that triggered them. For details about individual alerts on Trellix EDR, see Check individual alert details.
Threat severity levels are color-coded. This color indicator helps you easily identify the high severity threats that require immediate attention.
The threats are categorized based on the severity level:
High - These threats are shown in red color. The process appears to be a high-risk threat and it should be immediately investigated and contained.
Medium - These threats are shown in orange color. The process appears suspicious and can be investigated and contained.
Low - These threats are shown in yellow color. The process appears to be of low severity. Trellix EDR continues to monitor the process and changes its status based on behavior and analysis.
Activity on a monitored endpoint is analyzed by the detection engine. If the activity indicates malicious or suspicious behavior, it is categorized and assigned a severity level. You can use this information to determine if it is an actual threat and what to do about it. The severity level of the root process increases when the threat level of its child processes increases, or the accumulated threat levels of its child processes increase.
Threats displayed are based on the selected time frame. The time frame can vary from within the past 4 hours up to the maximum retention time. The default is past 3 days. The maximum retention time is based on the subscription you choose during the on-boarding process. The minimum time you can choose is 30 days and maximum is 90 days. If you want to change the retention time, contact Trellix support center.