We are upgrading the backend engine for Trellix Endpoint Detection and Response (EDR) Investigation to deliver faster performance, enhanced details, and improved investigation capabilities that will be launched in the future. As previously communicated, the legacy EDR Investigation module has been officially decommissioned on September 14, 2026.
To ensure seamless incident response operations:
-
Adopt Trellix Wise: The Trellix Wise add-on is already enabled for your tenant at no additional cost. Use Wise AI to investigate threats with natural language queries and correlate related events. For details, see this "EDR documentation".
- Access historical investigations: To retrieve your historical investigation data, navigate to Trellix EDR > Investigating > Upgrading Investigations panel. For more information, see the Knowledge article How to use Case Graph Visualizer to view Trellix EDR investigation historical data, or for technical assistance, visit the Trellix Support Portal.
No manual configuration is required to use Trellix Wise; it is already activated for your tenant. We recommend notifying your SOC leads so they can begin using Trellix Wise today.
Thank you for your partnership as we build a faster, more resilient detection and response platform. For technical assistance, visit our Trellix Support Portal.
Frequently asked questions:
-
Why was the EDR Investigation module retired?
We upgraded the backend engine for Trellix EDR Investigation to deliver faster performance, enhanced details, and improved investigation capabilities. -
What is replacing the EDR Investigation module?
We transitioned to Trellix Wise, and recommend utilizing Wise AI to perform investigations with natural language and better correlation of the events. -
Can I still access my historical investigation data?
Yes. you can download the data from the Trellix EDR > Investigating > Upgrading Investigations panel. For more information, see the Knowledge article How to use Case Graph Visualizer to view Trellix EDR investigation historical data, or contact Trellix Support for assistance with your specific investigation data.