Trellix: Helix Pre-Release Scope and Deployment Notification

Hello Helix customers,

We would like to inform you of the upcoming release for Trellix Helix 2026.1. This release includes a wide array of new core features, performance updates, analyst workspace optimizations, and coverage expansions designed to evolve our solution and cater to your operational requirements.

Please review the planned features and deployment windows below.

Release Overview & Key Features

• CIDR Allowlist: Implementation of the CIDR Allow List on Trellix IAM.
• Muted Alerts: Enabled rules to be set for muted alerts for monitoring low and slow signal alerts.
• Alerts Retention in Cases: Alerts will now be retained in active cases beyond 90 days.
• Advanced Queries: Introduction of Search String Hints and Investigative tips inside alert timeline.
• Wise Summary Integrations: Enhanced Summary View with Wise inside Alert Details.
• Rule Management: Added detailed visibility of detection logic and rule details inside the alert timeline alongside rule editor syntax validation in the rule builder console.
• Advanced Filtering & Sorting: Integrated AgGrid Column Filtering across Rules Tables and Correlated Alerts, as well as Row Grouping.
• Case Workflows: Streamlined case assignment features including adding Alerts to a New Case, Bulk Actions workflows, and adding Events to a Case from Search.
• Alert Asset Details: Enriched asset information in the alerts asset page with an ability to perform contextual actions.

Hyperautomation Enhancements

• Custom Integrations: Added capability to create custom respond integrations and add new respond integrations.
• Special Authentication: Support for special authentication response integrations, such as Gmail.
• Tasks: View and add single step tasks in rules or execute via alerts asset or respond console.

Advanced Detection & Analytics

• Living off the Land Binaries: Expanded detection parameters for core system files rundll32.exe and schtask.exe.
• Living off the Land C2 frameworks: Added specific analytic tracking for Hugging Face command and control environments.
• Living off the Land RMM tools: Integrated extensive detection coverage for remote monitoring tools including AnyDesk, LogMeIn, Splashtop, Atera, FleetDeck, and BlueTait.
• Enterprise Coverage Expansion: Enhanced detection logic coverage for Okta, Phase 1 of lateral movement detection analytics, Distributed Component Object Model techniques, and new Trellix ENS integration coverage.

Regional Deployment Schedule
Production deployments are planned between June 10 and June 11, 2026.

Operations will execute sequentially according to the regional windows listed below:

Service Impact

Note on Service Interruption: End-to-end customer workflows are structurally validated to complete within expected time frames during these updates. No major performance degradation or system usability concerns have been identified during staging validation.

​​​​​​Product Guides and comprehensive Release Notes will be officially posted and available on June 12, 2026.