During remediation, you can stop the interpreter processes such as Python and Bash by the process ID and remove the associated script remotely using the full path.
The Stop and Remove Content reaction is supported on Windows and macOS endpoints.
Log on to Trellix EDR.
Select Menu → Real-time Search.
On the Search box, enter a search expression.
Click the search icon to start collecting data from managed devices.
Based on the search expression, the list of events, processes, or devices is displayed.
From the list, select the affected event, process, or device, then select Action → Mitigate → Stop and Remove Content.
A new window appears and then you can enter details:
Process ID — The process ID.
Full file path — The process's full path.
Click Confirm to complete the Stop and Remove Content action.
A confirmation message displays as the action launched is completed successfully.
On the Action History dashboard, Action Status displays the stop and remove content action as Completed.