This notification combines the latest Endpoint Detection and Response with Forensics (EDRF) Cloud January 2026 enhancements with the EDRF Client 50.2.0 update. We encourage all customers to review the new capabilities below and plan their upgrades to EDRF Client 50.2.0 accordingly.
EDRF Client 50.2.0 enhancements (Release Notes)
-
Windows Filtering Platform (WFP) protection: Ability to mitigate EDR evasion techniques with a new feature that identifies and removes unauthorized WFP blocking filters targeting EDRF processes.
-
System performance enhancements: Optimization of resource handling and improvement of overall endpoint stability and CPU utilization.
-
Self-protection for Linux: Extended security to Linux endpoints, preventing unauthorized access or tampering with EDRF processes, files, and configurations.
-
FIPS mode support: EDRF Client is now fully supported on Windows, Linux, and macOS operating systems running in FIPS mode for cryptographic operations.
-
Support for 4K key size: With this release, the EDRF Client now supports 4096-bit RSA keys for secured digital transactions.
- Exclusion advisor: A new built-in audit module enables visibility into high-frequency system activities to help administrators create targeted exclusion policies.
EDRF Cloud January enhancements (Release Notes)
-
Trellix Wise upgrades:
- Direct remediation: Suggested Actions now include direct links to Quarantine Device, Dismiss Threat, and Kill Process from within Wise responses.
-
Response streaming: AI-driven insights now stream in real-time within the Interactive and Dossier modes.
-
Enhanced forensic data collection: This release adds five new collection actions including Command Shell History, PowerShell History, Full Memory, Comprehensive Investigative Details, and Quick File Listing.
-
IOC detection rules: The dashboard now intelligently filters event types based on the selected operating system during custom rule creation.
- Threat alerts API (v3): Added edr/v3/alerts API support, providing expanded responses that include critical HostInfo data.
Reference documentation
Note: To receive information about product updates, sign up for the Support Notification Service.
For instructions, see the Thrive Portal User Guide and navigate to Profile and Settings > My Settings > Manage Support Notification Services (SNS) subscription preferences.