We are pleased to announce that the following Trellix Endpoint Detection and Response Content updates are now available:
- EDR Windows Content version 4.2.2.5241 (supports EDR Windows Client versions 4.2.2.x, 4.2.1.x, and 4.2.0.x)
- EDR Mac Content version 4.2.1.4972 (supports EDR Mac Client version 4.2.1.x)
- EDR Linux Content version 4.2.1.4973 (supports EDR Linux Client version 4.2.1.x)
We recommend applying these updates to ensure your endpoints benefit from these enhancements.
This release focuses on streamlining Client operations and improving the overall endpoint footprint.
This release includes the following enhancements:
- For Linux: Adds new telemetry selection rules to monitor high-fidelity malicious usage patterns of socat and curl.
- Performance optimization: This update includes optimized logic to minimize the strain on system resources and reduce disk I/O, thereby improving overall performance.
- Noise reduction: Updated default compatibility logics and trusted signers to ensure seamless interoperability with verified third-party security and administrative software (Tanium, Fortinet, OpenSSL).
To ensure you receive the latest content, see the "General policy configuration" section of the Product Guide for configuring content updates. For more information on how to apply and verify the content, see the Knowledge article How to update Trellix EDR Client content.
For more information, see the EDR documentation on the Product Docs portal.
Trellix EDR Windows Content version 4.2.2.5241, Mac Content version 4.2.1.4972, and Linux Content version 4.2.1.4973 are available now through the Product Downloads site and software catalog in ePO.