McAfee Virus Definitions are the DAT files that McAfee anti-virus products, now maintained by Trellix for business customers, use to recognise malware. They are not a program you run on their own. The scan engine inside an installed McAfee or Trellix security product reads the DAT files. It compares what it scans against the threat data they contain. The definition packages are published mainly for Windows, with separate packages for Linux and Mac systems managed through ePolicy Orchestrator (ePO). Downloading them from Trellix requires a current technical support agreement for an entitled product.
How DAT files work with the scan engine
Detection in McAfee products is split into two parts. The scan engine is the code that opens files and inspects them; the DAT files hold the threat content the engine checks against. Trellix publishes new DAT files roughly once a day, while the engine is released as its own package. Fresh McAfee Virus Definitions therefore keep a system current without reinstalling the product.
Each DAT release carries a sequential number, and the security product reports the number and creation date of the content it has loaded. Content more than two days old should be updated before scanning a suspect system.
V2, V3 and platform packages
Trellix publishes McAfee Virus Definitions in more than one line, because different product generations read different content formats:
- V2 DATs come as a self-installing Windows executable and as a zip package for deployment through ePO. The V2 ePO package also supplies the DAT files used by Endpoint Security for Linux.
- V3 DATs are a separate Windows line with their own numbering and their own self-installing executable.
- MEDDAT is an ePO package of definitions for Linux and Mac systems.
Trellix Endpoint Security on managed networks receives its threat content as the AMCore Content Package. You choose this package type in the client update task alongside Exploit Prevention content.
A self-installing package detects the installed McAfee products, stops their services, copies in the new files and restarts the services, usually without a reboot.
Extra.DAT for urgent detections
Between regular releases, McAfee can issue an Extra.DAT file. It is loaded alongside the normal DAT files to add detection for a serious new threat before the next daily update includes it. Once the regular McAfee Virus Definitions cover that threat, the Extra.DAT is no longer needed. A negative Extra.DAT works the other way. When Trellix confirms a false positive, the negative Extra.DAT suppresses that detection until the next content update corrects it.
Distribution through ePolicy Orchestrator
In companies, McAfee Virus Definitions usually reach endpoints through ePO. A server task pulls the DAT and engine packages from the Trellix site into the ePO Main Repository. Client update tasks on the Trellix Agent then download them to managed systems.
The repository has three branches: Evaluation, Current and Previous. New definitions can be pulled into Evaluation first and sent to a test group of machines. After the test period, they can be copied to Current for the rest of the organisation. Each agent policy chooses which branch a group of systems takes content from. This lets test machines run the newest DAT while critical servers stay one or two releases behind.
If a definition release causes problems, the agent policy can allow DAT file downgrades so systems take the older DAT held in the repository. In that case, a client task can roll back the AMCore DAT directly. The AMCore Content Reputation option makes an endpoint check whether other systems reported problems with a content version. The endpoint rejects the update if they did.
