Managed Detection & Response · Trellix Platinum Partner
Detect, investigate, respond – around the clock, on your Trellix platform.
Trellix MDR monitors your endpoints and security sources 24x7x365, assesses every detection and intervenes when threats are confirmed. eyeT secure sets up the platform, integrates your environment and remains your German-speaking point of contact in operations.
- DetectionTrellix EDR reports a suspicious PowerShell execution with an encoded command on WS-0421.
- TriageThe MDR analyst groups three related detections into one case and rates it Critical.
- InvestigationProcess chain, outbound connections and persistence mechanisms are examined; the threat is confirmed.
- ResponseEndpoint isolated, process terminated, remediation recommendation sent, escalation according to the incident response plan.
Starting point
Detection is in place. What is missing is the time to follow up on every alert.
Most organisations already operate capable sensors. What they lack is a team that assesses every detection around the clock and acts immediately when an incident is real.
Detections without follow-up
EDR, sandbox and email security generate alerts every day. Without triage it remains unclear which of them are real incidents and what priority they have.
Attacks do not keep office hours
An incident at 02:14 does not wait for the start of the working day. Whoever reacts in the morning is no longer handling an alert but a loss.
Response instead of report
What matters is that an affected endpoint is isolated and a malicious process is stopped before an attack spreads – not the report afterwards.
Service components
Two Trellix MDR tiers, complemented by the services of eyeT secure.
Trellix describes two offerings in its MDR Service Description. eyeT secure takes care of licensing, technical setup and support during operations.
MDR for EDR
Managed Detection and Response for Trellix Endpoint Security
Monitoring of the managed endpoints – clients and servers – with Trellix EDR, managed via ePO. The MDR team analyses detections, groups and prioritises them into cases, investigates confirmed threats and executes response actions.
- 24x7x365 monitoring of endpoint telemetry
- Triage: analysis, grouping and prioritisation of detections into a case
- Investigation of confirmed threats by the MDR team
- Response: containment and disruption, endpoint isolation, remediation recommendations
- Pre-approved measures according to the "Pre-Approved Remediation Actions", escalation according to the incident response plan
| Detection Critical | 1 hour |
| Detection High | 2 hours |
| Detection Medium | 24 hours |
| General enquiries by email | Next business day |
MDR for SecOps
Managed Detection and Response for Trellix SecOps
Trellix Helix becomes the central platform: endpoint telemetry is correlated with Active Directory, Entra ID, Cloud Email Security, sandbox (IVX), firewalls and other agreed Trellix and third-party systems. Response measures beyond the endpoints are defined together with you.
- All services from MDR for EDR
- Correlation, case management and response via the Trellix Helix Security Operations Platform
- Onboarding of on-premises sources via Trellix Collectors, cloud sources via API
- Third-party systems with a data feed to Helix (e.g. firewall, directory services, email and web security)
- Response playbooks and automated workflows after agreement and approval
| Detection Critical | 1 hour |
| Detection High | 2 hours |
| Detection Medium | 24 hours |
| General enquiries by email | Next business day |
Making the platform MDR-ready
Connecting ePO to the cloud EDR tenant, checking in the EDR and forensics extensions, setting up the HX Cloud Console and the forensic server, policies for EDR with Forensics and a test deployment on a representative set of systems.
Your contact between you and the MDR team
Escalation route via eyeT secure, alignment of MDR policies with your applications – such as database, Exchange, print or Citrix servers – maintenance and optimisation of the platform and support during case handling.
The right Trellix licences from one source
Demand-driven licensing of Endpoint Security, EDR and Helix, quotation and ordering via distribution, handover of the grant letter and licence certificates.
Process
From licence activation to operational MDR.
The process follows the sequence proven in our onboardings: first access, event forwarding and inventory by the MDR team, then the integration day with eyeT secure.
Kick-off and documents
Trellix MDR team · customerWelcome email with contacts, Trellix MDR welcome package and kick-off meeting. Onboarding documents: ePO MDR On-boarding Questionnaire, incident response plan with escalation agreement and the list of Pre-Approved Remediation Actions.
Access and event forwarding
Customer · eyeT secureAdministrator access in ePO for the MDR team, plus VPN access for on-premises deployments. Setup of the event forwarder from ePO to the MDR team for the selected event types.
Inventory and MDR policies
Trellix MDR teamThe MDR team independently records policies and infrastructure in ePO and defines MDR-specific policies. These remain disabled until they have been agreed with you.
Integration day with eyeT secure
eyeT secure · customerEDR+Forensics and Cloud Bridge extensions in ePO, connection to the cloud EDR tenant, admin access and connection of the HX Cloud Console, forensic server, EDR+F policies for clients, deployment task and test on a small, representative set of systems.
Rollout and handover into operations
eyeT secure · Trellix MDR team · customerStaged rollout of the EDR+F clients, release of the MDR policies, anchoring of escalation paths according to the incident response plan and start of 24x7 monitoring with eyeT secure as your contact in operations.
Why eyeT secure
Platinum Partner with MDR qualification and 25 years in the Trellix ecosystem.
We do not sell a service we have not set up ourselves. Every MDR environment we hand over has been connected, integrated and aligned with the MDR team beforehand.
Trellix Platinum Partner and MSSP
Managed security services, Trellix licensing and professional services for enterprises and public-sector organisations in the DACH region.
MDR-qualified and proven in production environments
Several Trellix MDR environments delivered from service connection through onboarding into ongoing operations.
Trellix Partner Awards 2025 and 2026
"Fast Growing Partner of the Year – EMEA" (2025) and "Service Provider of the Year – EMEA" (2026).
On this platform since 2001
Around 25 years with McAfee, FireEye and Trellix – from ePO and ENS via EDR and forensics to Helix and NDR.
German-speaking project and operational support
The Trellix MDR team works in English. Alignment, escalations and documentation with eyeT secure take place in German.
Clear responsibility
Trellix delivers the MDR service and support. eyeT secure is responsible for advisory, licensing, setup, integration and operational support.
Questions and answers
What decision-makers want to know before getting started.
Who monitors my environment?
What are the prerequisites for my environment?
How long does onboarding take?
What happens on a critical detection?
Which actions may the MDR team take without asking?
Do I need my own staff around the clock?
Who is my contractual partner for the MDR service?
Contact
Request a first meeting on Trellix MDR.
In 30 minutes we clarify your starting point, the existing Trellix components and the right entry level – MDR for EDR or directly MDR for SecOps.
- Inventory of your Trellix components and security sources
- Recommendation: MDR for EDR or MDR for SecOps
- Licensing and onboarding roadmap with your responsibilities