Trellix EDR with Forensics

Trellix EDR with Forensics automatically maps events in each alert to the MITRE ATT&CK framework, speeding up investigations and identifying gaps so you can remediate faster. Trellix EDR with Forensics scored 100% in the 2024 ATT&CK Evaluations for MacOS.

Yes. Trellix Wise brings together numerous forms of artificial intelligence and machine learning, including generative AI. It dynamically investigates alerts, learns from newly seen anomalies, correlates TTPs to previously identified threat campaigns, and automatically contextualizes every alert so analysts don’t have to waste time.

Trellix EDR with Forensics collects and analyzes more than 70 different telemetry sources, including account- and process-related information, network, DNS, and a wide range of others. It uses this information to piece together threat behavior and correlates it with threat intelligence from our endpoint protection platform (EPP) and third-party threat intelligence solutions to provide only the highest fidelity alerts.

In addition to the standard data that other EDR tools collect, Trellix EDR with Forensics can also collect processes, memory, driver data, power shell history, specific files, and even a full disk image of target hosts.

Combining the industry leading technologies from both FireEye and McAfee into a single detection stack expands coverage of MITRE TTPs, resulting in greater threat detection efficacy across all major platforms, including Windows, Linux, and MacOS.