Supported platforms for Trellix Endpoint Detection and Response
Technical Articles ID:
KB91345
Last Modified: 2023-10-23 10:59:32 Etc/GMT
Environment
Trellix Agent (TA)
Trellix Endpoint Detection and Response (EDR)
NOTES:
MVISION EDR was rebranded to Trellix EDR in version 4.1.0.
McAfee Agent (MA) was rebranded to TA in version 5.7.7.
Summary
Recent updates to this article
Date
Update
October 23, 2023
Updated "Mac Operating Systems" in the "Supported operating systems" section.
October 11, 2023
Made the following changes:
Added Sonoma support under "Supported operating systems" section.
Added release information for October 11, 2023 (on-premises) hotfix in the "Product release information" table.
October 5, 2023
Made the following changes:
Added information about the "Activity Feed" feature in the "General Products" table under the "Product Software requirements" section.
Added the release information for Trellix EDR Cloud (October 4, 2023) in the "Product release information" section.
July 27, 2023
Made the following changes:
Added the release information for July 27, 2023 in the "Product release information" table
Edited the formatting of the Cloud release information
Added support for Red-Hat 9.2 and 8.8
May 24, 2023
Added EDR 4.1.1 for Linux information.
To receive email notification when this article is updated, click Subscribe on the right side of the page. You must be logged on to subscribe.
IMPORTANT: On macOS only. When installing EDR client 4.1.1, you must install or upgrade all Trellix products to the latest rebranded version for all products to function normally.
Upgrading any single product, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed.
For more information about installing or upgrading Trellix products on macOS, see KB96485 - Upgrade process for April 2023 Mac product releases.
Contents
Click to expand the section you want to view:
MVISION-EDR extension:
After you check in the MVISION EDR extension, all dependent extensions and packages are installed:
MVISION Cloud Bridge 2.0.0
MVISION-EDR-Client
MVISION EDR Endpoint Snapshot Tool
MVISION-EDR-Client-Package
MVISION-EDR
DXL extensions
Security Information
and Event
Management (SIEM)
MVISION EDR supports the following SIEM integrations:
Enterprise Security Manager (ESM) 10.0.0 or later.
NOTE: See the ArcSight statement below for 11.3.1 and earlier limitations.
11.3.2 and later natively support EDR without the ArcSight limitation detailed below. For integration steps, see the ESM Data Sources Configuration Reference Guide.
IMPORTANT: For 11.3.1 and earlier, ArcSight ESM and ESM integration is supported only for automating the creation of guided investigations. One of the following can be used:
An external FQDN
An external IP address
The host name or IP address of an endpoint that uses the MVISION EDR client
Splunk ESM 7.1.0 using the Common Information Model.
NOTE: You can feed detections from MVISION EDR into your SIEM tool by configuring your ESM to consume standard Syslogs.
Support is available on the functionality of the Activity Feed (AF) API; however, the ingestion of the AF API responses to your SIEM is out of the scope of Trellix Support. For more information on the AF API, see the "API sample for Activity feed" section of the Trellix Endpoint Detection and Response Product Guide on the Documentation Portal.
IMPORTANT: We don't support custom scripts from any other cloned or forked sites with changes.
IMPORTANT: IS reputation information and reports are available only with MVISION EDR on-premises extension 3.2.0.1 or later. This feature isn't supported on MVISION ePO.
Only a single appliance of IS in a single ePO is supported. MVISION EDR doesn't support a Multi-cluster ATD setup.
Threat Intelligence Exchange (TIE)
MVISION EDR supports TIE 2.3 or later.
IMPORTANT: TIE reputation information is available only with MVISION EDR on-premises extension 3.2.0.1 or later. This feature isn't supported on MVISION ePO.
Only bridged scenarios are supported; only one TIE is displayed in the Data Source list.
Endpoint Protection Platforms
MVISION EDR supports the following endpoint protection platforms only on Windows 10, 64-bit:
ENS 10.7 or later
MVISION Endpoint
NOTE: If using ENS 10.7 to provide EMC CAVA scanning capability, we currently recommend that EDR shouldn't be installed on the scanner. A fix to allow these products to coexist will be available in a future version of the product.
System Integrity Protection (SIP) must be enabled.
3
Ubuntu operating systems 18.04, 20.04, and 20.10 are End of Support and only provide LTSS support for security issues.
4
As of version 4.1.1, EDR client is also supported on Native M1 and M2 Apple hardware.
Virtual infrastructure software versions for EDR client
EDR client supports any virtualization solution, assuming that the following criteria are met:
EDR client and needed dependencies (DXL and MA) support the operating system being virtualized.
The virtualization solution is a supported solution from the virtualization solution vendor. The solution isn't EOL, beta, or an otherwise unsupported virtualization solution.
The virtualization solution supports the operating system being virtualized. To confirm operating system support, see the virtualization solution documentation.
The virtualization solution runs under full virtualization or paravirt mode, if supported.
Compatible ENS versions
Although ENS isn't a requirement, EDR and ENS share the Core Components (SysCore). So, there are certain versions with which it isn't compatible.
ENS Version
EDR Client Version
EDR
3.4.0
EDR
3.5.0
EDR
3.5.2
EDR
4.0.0
EDR
4.1.0
EDR
4.1.1
ENS 10.7.x
Yes
Yes
Yes
Yes
Yes
Yes
ENS 10.6.11
No
No
No
No
No
No
ENS 10.6
No
No
No
No
No
No
ENS 10.5.5
No
No
No
No
No
No
ENS 10.5.4
No
No
No
No
No
No
ENS 10.5.3 for RS3
No
No
No
No
No
No
ENS 10.5.2
No
No
No
No
No
No
ENS 10.5.1
No
No
No
No
No
No
ENS-TP for MAC 10.7.92
No
No
No
No
No
Yes
ENS-TP for MAC 10.7.5–10.7.8
Yes
Yes
Yes
Yes
Yes
No
ENS-TP for MAC 10.7.1
No
No
No
No
No
No
ENS-TP for MAC 10.7
No
No
No
No
No
No
ENS-TP for MAC 10.6.10
No
No
No
No
No
No
ENS-TP for MAC 10.6.9
No
No
No
No
No
No
ENS-TP for MAC 10.6.8
No
No
No
No
No
No
ENS-TP for MAC 10.6.7
No
No
No
No
No
No
ENS-TP for MAC 10.6.6
No
No
No
No
No
No
ENS-TP for MAC 10.6.5.x
No
No
No
No
No
No
ENS-TP for MAC 10.6.4
No
No
No
No
No
No
ENS-TP for MAC 10.6.3
No
No
No
No
No
No
ENS-TP for MAC 10.6.2
No
No
No
No
No
No
ENS-TP for MAC 10.6.1
No
No
No
No
No
No
ENS-TP for MAC 10.6
No
No
No
No
No
No
ENS-TP for MAC 10.5.0
No
No
No
No
No
No
ENS-TP for MAC 10.2.3
No
No
No
No
No
No
ENS-Linux 10.7.x
Yes
Yes
Yes
Yes
Yes
Yes
ENS-Linux 10.6.12–10.6.13
No
No
No
No
No
No
ENS-Linux 10.6.7
No
No
No
No
No
No
ENS-Linux 10.6.6
No
No
No
No
No
No
ENS-Linux 10.6.5
No
No
No
No
No
No
ENS-Linux 10.6.4
No
No
No
No
No
No
ENS-Linux 10.6.3
No
No
No
No
No
No
ENS-Linux 10.6.2
No
No
No
No
No
No
ENS-Linux 10.6.1
No
No
No
No
No
No
ENS-Linux 10.6.0
No
No
No
No
No
No
ENS-Linux 10.5.0
No
No
No
No
No
No
ENS-Linux 10.2.2
No
No
No
No
No
No
1
There's a known compatibility issue between ENS 10.6.1 July 2019 Update (or earlier) and EDR. The issue symptom is a general higher CPU utilization on systems. This issue is resolved in the ENS 10.6.1 October 2019 Update. For more information about this issue, see KB92058 - High memory consumption in mfetp.exe, or high general CPU when EDR is present.
2
IMPORTANT: On macOS only. When installing EDR client 4.1.1, you must install or upgrade all Trellix products to the latest rebranded version for all products to function normally.
Upgrading any single product, except Trellix Agent and Trellix Policy Auditor, removes all other products that were previously installed.
For more information about installing or upgrading Trellix products on macOS, see KB96485 - Upgrade process for April 2023 Mac product releases.
Mouse — Microsoft mouse or compatible pointing device
Monitor — 256-color or higher VGA monitor
CPU/RAM — The CPU requirement is a minimum of a Single Core. We recommend aDual Core Intel Pentium processor or compatible architecture.
The processor specifications are a recommended guideline, but aren't a hard requirement. Only x86 and AMD64 (x64) CPU architectures are supported. EDR doesn't support ARM processors.
DISK - Linux folder use:
/opt/McAfee/mvedr/
Usually requires less than 100 MB of space.
/var/McAfee/mvedr/data
Stores logs, trace.db, and file_hash.db. The folder isn't expected to exceed 3.5 GB.
