Supported platforms for Trellix Endpoint Detection and Response
Technical Articles ID:
KB91345
Last Modified: 2024-04-24 09:19:28 Etc/GMT
Environment
Trellix Agent (TA)
Trellix Endpoint Detection and Response (EDR)
NOTES:
MVISION EDR was rebranded to Trellix EDR in version 4.1.0.
McAfee Agent (MA) was rebranded to TA in version 5.7.7.
Summary
Recent updates to this article
Date
Update
April 23, 2024
Updated EOL tags in the table under the "Product release information" section.
April 12, 2024
Updated the "Hardware requirements" section under "CPU/RAM".
March 21, 2024
Updated the "Product release information" section with Trellix EDR 4.2.0 Hotfix 2.
March 4, 2024
Updated the "Product release information" section.
February 9, 2024
Added support for Red Hat 9.3.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
IMPORTANT: On macOS only. When installing EDR client 4.1.1, you must install or upgrade all Trellix products to the latest rebranded version for all products to function normally.
Upgrading any single product, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed.
For more information about installing or upgrading Trellix products on macOS, see KB96485 - Upgrade process for April 2023 Mac product releases.
Contents
Click to expand the section you want to view:
MVISION-EDR extension:
After you check in the MVISION EDR extension, all dependent extensions and packages are installed:
MVISION Cloud Bridge 2.0.0
MVISION-EDR-Client
MVISION EDR Endpoint Snapshot Tool
MVISION-EDR-Client-Package
MVISION-EDR
DXL extensions
Security Information
and Event
Management (SIEM)
MVISION EDR supports the following SIEM integrations:
Enterprise Security Manager (ESM) 10.0.0 or later.
NOTE: See the ArcSight statement below for 11.3.1 and earlier limitations.
11.3.2 and later natively support EDR without the ArcSight limitation detailed below. For integration steps, see the ESM Data Sources Configuration Reference Guide.
IMPORTANT: For 11.3.1 and earlier, ArcSight ESM and ESM integration is supported only for automating the creation of guided investigations. One of the following can be used:
An external FQDN
An external IP address
The host name or IP address of an endpoint that uses the MVISION EDR client
Splunk ESM 7.1.0 using the Common Information Model.
NOTE: You can feed detections from MVISION EDR into your SIEM tool by configuring your ESM to consume standard Syslogs.
Activity Feed (AF) feature: Currently, this feature only supports pushing data to Amazon S3 and Syslog servers. Support is available on the functionality of the Activity Feed API. However, the ingestion of the AF API responses to your SIEM is out of the scope of Trellix Support. For more information on the AF API, see the "API sample for Activity feed" section of the Trellix Endpoint Detection and Response Product Guide on the Documentation Portal.
IMPORTANT: We don't support custom scripts from any other cloned or forked sites with changes.
IMPORTANT: IS reputation information and reports are available only with MVISION EDR on-premises extension 3.2.0.1 or later. This feature isn't supported on MVISION ePO.
Only a single appliance of IS in a single ePO is supported. MVISION EDR doesn't support a Multi-cluster ATD setup.
Threat Intelligence Exchange (TIE)
MVISION EDR supports TIE 2.3 or later.
IMPORTANT: TIE reputation information is available only with MVISION EDR on-premises extension 3.2.0.1 or later. This feature isn't supported on MVISION ePO.
Only bridged scenarios are supported; only one TIE is displayed in the Data Source list.
Endpoint Protection Platforms
MVISION EDR supports the following endpoint protection platforms only on Windows 10, 64-bit:
ENS 10.7 or later
MVISION Endpoint
NOTE: If using ENS 10.7 to provide EMC CAVA scanning capability, we currently recommend that EDR shouldn't be installed on the scanner. A fix to allow these products to coexist will be available in a future version of the product.
System Integrity Protection (SIP) must be enabled.
3
Ubuntu operating systems 18.04, 20.04, and 20.10 are End of Support and only provide LTSS support for security issues.
4
As of version 4.1.1, EDR client is also supported on Native M1 and M2 Apple hardware.
Virtual infrastructure software versions for EDR client
EDR client supports any virtualization solution, assuming that the following criteria are met:
EDR client and needed dependencies (DXL and MA) support the operating system being virtualized.
The virtualization solution is a supported solution from the virtualization solution vendor. The solution isn't EOL, beta, or an otherwise unsupported virtualization solution.
The virtualization solution supports the operating system being virtualized. To confirm operating system support, see the virtualization solution documentation.
The virtualization solution runs under full virtualization or paravirt mode, if supported.
Compatible ENS versions
Although ENS isn't a requirement, EDR and ENS share the Core Components (SysCore). So, there are certain versions with which it isn't compatible.
ENS Version
EDR Client Version
EDR
3.4.0
EDR
3.5.0
EDR
3.5.2
EDR
4.0.0
EDR
4.1.0
EDR
4.1.1
EDR
4.2.0
ENS 10.7.x
Yes
Yes
Yes
Yes
Yes
Yes
Yes
ENS 10.6.11
No
No
No
No
No
No
No
ENS 10.6
No
No
No
No
No
No
No
ENS 10.5.5
No
No
No
No
No
No
No
ENS 10.5.4
No
No
No
No
No
No
No
ENS 10.5.3 for RS3
No
No
No
No
No
No
No
ENS 10.5.2
No
No
No
No
No
No
No
ENS 10.5.1
No
No
No
No
No
No
No
ENS-TP for MAC 10.7.92
No
No
No
No
No
Yes
Yes
ENS-TP for MAC 10.7.5–10.7.8
Yes
Yes
Yes
Yes
Yes
No
No
ENS-TP for MAC 10.7.1
No
No
No
No
No
No
No
ENS-TP for MAC 10.7
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.10
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.9
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.8
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.7
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.6
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.5.x
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.4
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.3
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.2
No
No
No
No
No
No
No
ENS-TP for MAC 10.6.1
No
No
No
No
No
No
No
ENS-TP for MAC 10.6
No
No
No
No
No
No
No
ENS-TP for MAC 10.5.0
No
No
No
No
No
No
No
ENS-TP for MAC 10.2.3
No
No
No
No
No
No
No
ENS-Linux 10.7.x
Yes
Yes
Yes
Yes
Yes
Yes
TBD
ENS-Linux 10.6.12–10.6.13
No
No
No
No
No
No
No
ENS-Linux 10.6.7
No
No
No
No
No
No
No
ENS-Linux 10.6.6
No
No
No
No
No
No
No
ENS-Linux 10.6.5
No
No
No
No
No
No
No
ENS-Linux 10.6.4
No
No
No
No
No
No
No
ENS-Linux 10.6.3
No
No
No
No
No
No
No
ENS-Linux 10.6.2
No
No
No
No
No
No
No
ENS-Linux 10.6.1
No
No
No
No
No
No
No
ENS-Linux 10.6.0
No
No
No
No
No
No
No
ENS-Linux 10.5.0
No
No
No
No
No
No
No
ENS-Linux 10.2.2
No
No
No
No
No
No
No
1
There's a known compatibility issue between ENS 10.6.1 July 2019 Update (or earlier) and EDR. The issue symptom is a general higher CPU utilization on systems. This issue is resolved in the ENS 10.6.1 October 2019 Update. For more information about this issue, see KB92058 - High memory consumption in mfetp.exe, or high general CPU when EDR is present.
2
IMPORTANT: On macOS only. When installing EDR client 4.1.1, you must install or upgrade all Trellix products to the latest rebranded version for all products to function normally.
Upgrading any single product, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed.
For more information about installing or upgrading Trellix products on macOS, see KB96485 - Upgrade process for April 2023 Mac product releases.
Mouse — Microsoft mouse or compatible pointing device
Monitor — 256-color or higher VGA monitor
CPU/RAM — The CPU requirement is a minimum of a Single Core. We recommend aDual Core Intel Pentium processor or compatible architecture.
The processor specifications are a recommended guideline, but aren't a hard requirement. The EDR-supported architecture can be seen in the table below:
Operating System
Supported Architecture
Windows, Linux
X64
MacOS
X64, Apple's M1/M2 ARM processors
DISK - Linux folder use:
/opt/McAfee/mvedr/
Usually requires less than 100 MB of space.
/var/McAfee/mvedr/data
Stores logs, trace.db, and file_hash.db. The folder isn't expected to exceed 3.5 GB.
EOL period—The time frame that runs from the day we announce product discontinuation, until the last date that we formally support the product. In general, after the EOL period is announced, no enhancements are made.
EOL date—The last day that the product is supported, according to the terms of our standard support offering.
