IVX is a signature-less, dynamic analysis engine that captures and confirms zero-day and targeted APT attacks. IVX identifies attacks that evade traditional signature-based defenses by detonating suspicious files, web objects, URLs, and email attachments within a proprietary hypervisor instrumented for over 2000 potential simultaneous executions. IVX accelerates incident response by enabling analysts to visualize how malware is behaving within the virtual image and securely interact with malware to test the effectiveness of countermeasures.
All TIE server instances (except Write-Only Primary and Reporting Secondary) can forward file samples to IVX for analysis. Although IVX will process any file type (with few limitations), ENS ATP will only send TIE PE files.
IVX has a file size submission limit of 100MB. TIE will check the file size before submission. If the file is over the submission limit, it will not be submitted to IVX.
IVX workflow
If the file is processing on IVX, TIE Server implements logic to ensure it doesn't submit the same file multiple times.
An endpoint requests a file reputation to the TIE services through DXL.
The endpoint receives all reputations available. If the reputation is unknown, the endpoint requests IVX for sandboxing.
The endpoint analyzes the content rules based on the response and determines whether the file should be submitted for sandboxing.
Note
By default, file's local reputation must be unknown and the file size less than 5 MB.
The endpoint submits the binary file directly to TIE Server.
TIE Server sends the binary file request to IVX for sandboxing.
The TIE Server intermittently polls IVX for the results of the sandboxing.
When the result is available, TIE Server stores the result and broadcasts the reputation over DXL to endpoints.