Bahrain, Saudi Arabia
TrellixDetect, investigate and stop threats across endpoints, email, network and data
Trellix makes security products for endpoints, email, networks and data, and Trellix Helix, which brings alerts from Trellix and other vendors together for extended detection and response (XDR).
- ePO
- One console for endpoint policy, on-premises or SaaS
- Helix
- XDR with AI-driven analytics and guided investigations
- Cloud and on-premises email security options
- DLP
- Data loss prevention on endpoints, in storage and on the network
Problems Trellix is used to solve
Most organisations already have some security tools. These are the gaps Trellix products are designed to close.
| Topic | What it can lead to | How Trellix helps |
|---|---|---|
| Malware and ransomware reaching laptops and servers | What it can lead to: Encrypted files, stolen data and downtime. | How Trellix helps: Trellix Endpoint Security (ENS) blocks threats, scans files when they are accessed and runs targeted scans, with firewall and web control modules. |
| Attacks that get past prevention and go unseen | What it can lead to: Attackers stay in the network for weeks before anyone notices. | How Trellix helps: Endpoint detection and response (EDR) records endpoint activity so analysts can investigate and contain suspicious behaviour. |
| Phishing and malicious attachments | What it can lead to: Credential theft and malware delivered by email. | How Trellix helps: Trellix Email Security analyses attachments and URLs in an isolated virtual environment and can remove messages found malicious after delivery. |
| Sensitive data leaving by email, USB, web or AI tools | What it can lead to: Data breaches and regulatory exposure. | How Trellix helps: Trellix Data Loss Prevention (DLP) monitors and controls data on endpoints, in storage and on the network, including uploads to generative AI sites. |
| Too many alerts from too many tools | What it can lead to: Analysts miss the alerts that matter. | How Trellix helps: Trellix Helix correlates alerts from Trellix and third-party sources and prioritises high-impact threats. |
What Trellix does
Trellix is a portfolio rather than a single product. These are the main product families; most organisations start with one or two.
Endpoint Security (ENS)
Threat Prevention, Firewall, Web Control and Adaptive Threat Protection modules, managed through Trellix ePolicy Orchestrator (ePO).
Endpoint Detection and Response
Collects endpoint activity for investigation and response, and maps findings to MITRE ATT&CK, a public catalogue of attacker techniques.
Email Security
Inspects inbound and outbound email for malware, phishing URLs, impersonation and spam, with sandbox analysis of attachments and links.
Data Loss Prevention
Device control, data discovery, endpoint DLP for Windows and macOS, and network monitoring and prevention.
Network Detection and Response
Network security appliances that detect threats in network traffic and can forward evidence to Helix for correlation.
Trellix Helix (XDR)
Brings together detections from native and third-party tools, with AI-driven analytics and a guided investigation workflow for security operations centre (SOC) teams.
Trellix products and how they are delivered
Deployment choices affect cost, staffing and data location. These are the options Trellix documents.
| Topic | What it covers | Delivery options documented by Trellix |
|---|---|---|
| ePolicy Orchestrator (ePO) | What it covers: Central policy and reporting for Trellix endpoint products | Delivery options documented by Trellix: ePO - On-prem or ePO - SaaS |
| Endpoint Security (ENS) and EDR | What it covers: Prevention, firewall, web control, detection and response on endpoints | Delivery options documented by Trellix: Agents on endpoints, managed through ePO |
| Email Security | What it covers: Malware, phishing, impersonation and spam in email | Delivery options documented by Trellix: Email Security - Cloud or Email Security - Server |
| Data Loss Prevention | What it covers: Data on endpoints, in storage and in network traffic | Delivery options documented by Trellix: DLP - SaaS; network components as virtual or hardware appliances, and on AWS for Network Prevent |
| Helix | What it covers: Correlation and investigation across security tools | Delivery options documented by Trellix: SaaS, with an on-premises collector forwarding logs; ingests Trellix and third-party sources |
Product names and packaging change over time. Confirm the current edition and licensing for your scope with us before planning.
Before you deploy or migrate to Trellix
A readiness check for an endpoint, email or XDR rollout. Tick what is in place: nothing you select is saved or sent.
How VirtuThinko helps you adopt Trellix
- 01
Requirements
We can help you write down what you need Trellix to do, which products fit and which existing tools they replace or complement.
- 02
Demo or proof of concept
We can arrange a demonstration and, where it makes sense, a limited trial against agreed success criteria.
- 03
Design and deployment
We can help plan the architecture, integrations and rollout, including change windows and a rollback plan.
- 04
Tuning and handover
We can help tune policies after go-live and hand over documentation and knowledge to your team.
- 05
Ongoing support
Where you want it, we can help with day-to-day administration, upgrades and periodic reviews.
Extended detection and response (XDR) collects and correlates detections from several security layers, such as endpoint, email, network and cloud, so analysts see one attack instead of many separate alerts. Trellix Helix is Trellix’s platform for this, and it accepts data from Trellix products and from many third-party log sources.
Yes. Trellix documents both ePolicy Orchestrator - On-prem and ePolicy Orchestrator - SaaS.
Trellix documents Threat Prevention, Firewall, Web Control and Adaptive Threat Protection as the ENS modules. Adaptive Threat Protection requires Threat Prevention.
Trellix publishes integration guidance for Microsoft 365, and describes retroactive removal of emails found malicious after delivery in Microsoft 365 and Google Workspace. Check the exact deployment mode for your mail flow with us or Trellix.
Trellix release notes for DLP Endpoint for Windows describe blocking generative AI URLs and monitoring text uploaded to generative AI prompts.
Yes. Trellix publishes a list of supported third-party log sources for Helix, many of which are collected over syslog.
Explore Trellix for your organisation
Tell us which areas you want to cover (endpoint, email, data or security operations) and what you use today. A member of our team will contact you to arrange an initial conversation.