Trellix Endpoint Detection and Response with Forensics (EDRF) Client 50.3 is now available. This release is critical for all environments. Failure to apply this update might result in potential business impact.
This release includes key new features, performance upgrades, and critical security fixes.
Key improvements in this release:
-
Performance enhancements: Delivers approximately 40% improvement in boot time and a 25% reduction in internal footprint, bolstered by the removal of Malware Protect (MP) and Malware Guard (MG) from XClient. We recommend using Endpoint Security (ENS) for protection. See the "Configuration Resources" section below for details.
-
Exclusion Advisor audit (Phase 2): Introduces the second phase of the Exclusion Advisor audit to extend analysis beyond the event database to the Trace DB, Trace Log, and File Hash DB across platforms, surfacing the noisiest processes, files, and rules for targeted exclusions—with zero-impact endpoint auditing.
-
HX policy import utility GA: Provides seamless HX policy import support from HX to EDRF ePolicy Orchestrator (ePO) On-Prem.
For ePO - SaaS, the HX Policy import utility will be available on October 28, 2026.
-
Event Streamer 3.0: Introduces DXL Support in the XClient Event Streamer module to satisfy critical requirements for key customers and also support OS events of Windows, Linux, and MacOS.
-
Unified response actions: Unifies the Quarantine and Containment features into a streamlined experience.
-
Detection improvements: Expands detection coverage for advanced code injection techniques, including ProcessHypnosis and EarlyBird.
-
Linux self-protection: Enhances Linux self-protection by adding support for the BTRF file system.
-
Export enhancements: Restores missing metadata fields in S3 Trace Data Exports.
- Security and vulnerability fixes: Addresses critical and high-severity vulnerabilities found in BDH scans to ensure a strong security posture.
For more information about this release, see the Release Notes.
EDRF 50.3 is available now through the Product Downloads site or via the Software Catalog in ePO on-prem and in the Main Repository in ePO - SaaS.
For ePO SaaS, EDRF 50.3 will be made available in the Main Repository by October 14, 2026.
Reference documentation
Configuration resources: To assist with the transition from HX protection to ENS protection, see the following ENS documentation for setup and best practices:
- Upgrade from HX to EDRF
- ENS Threat Prevention Configuration Guide
- Migrating Policies to ENS MLP (Scroll down to the “Configure Protect Feature” section)
- Best Practices for Trellix ENS (Scroll down to see the Best Practices section)
Note: MP and MG are removed only from XClient; they remain available within XAgent.