New features and changes
This section describes new features in release 11.0.0.
New VX web UI now offers a comprehensive view of file analysis across the IVX cluster, including all submission types (manual, API, and sensor). It includes artifact downloads, a dashboard for key insights, and notifications for malicious submissions.
The new UI does not have Settings and About pages.
If VX is connected to CMS, you can access the Settings page through the CMS interface.
Alternatively, you can use CLI to configure settings.
now supports ICAP REQMOD.
icap-service reqmod enable — This command enables the processing of request modification for ICAP data. To disable, use no icap-service reqmod enable.
You can now exclude specific file types from being scanned during malware analysis in IVX Server using CLI commands.
no icap-service file-type and press Tab: Lists all available file types that you can exclude from scanning.
show icap-service file-type: Displays all file types for which scanning is already disabled or the file types that are already excluded.
icap-service file-type <file-type>: Manually start scanning a specific file type that was previously added to the bypass list.
no icap-service file-type <file-type>: Adds a specific file type to the exclusion list.
For example, to exclude the PDF file type from scanning, execute the following command:
no icap-service file-type PDF
Added support for backing up and restoring submission records across clusters using CLI commands. This ensures submission data is preserved even after cluster re-creation, allowing users to retain submission records. Without this, all previous records would be lost during cluster recreation.
mvx node cdbmgr backup— Initiates a backup of records present in IVX cluster.show mvx node cdbmgr backup— Lists available backups.no mvx node cdbmgr backup <backup_name>— Deletes a specified backup. If any background operation of this feature (backup/restore/delete) is in progress, this command will not execute.mvx node cdbmgr restore <backup_name>— Restores a specified backup. This command stops Cassandra DB services temporarily. The user must ensure no submissions are in progress.show mvx node cdbmgr backup-status— Displays the status of the last backup, restore, or delete operation, including PID and progress.
Support OS Upgrade to Alma Linux 9.2
The platform has undergone a base upgrade from CentOS 7 to Alma Linux 9.2 to ensure continuous support and deliver improved stability, security, and performance.
New CLIs are introduced to extend the retention capabilities for malicious and non-malicious data reports and artifacts, ensuring users can retain important data for a longer duration.
Malicious Files - Days Retention —
mvx analysis cleanup malicious data keep days <limit>Limits: Minimum = 2 days, Maximum = 90 days, Default = 30 days
Malicious Files - Size Retention —
mvx analysis cleanup malicious data keep size <limit>Limits: Minimum = 50GB, Maximum = 400GB, Default = 200GB
Non-Malicious Files - Days Retention —
mvx analysis cleanup non-malicious data keep days <limit>Limits: Minimum = 2 days, Maximum = 15 days, Default = 2 days
Non-Malicious Files - Size Retention —
mvx analysis cleanup non-malicious data keep size <limit>Limits: Minimum = 50GB, Maximum = 400GB, Default = 100GB
Information about the data cleanup configuration which includes malicious and non-malicious data with respect to number of days and size —
show mvx analysis cleanup config
Auto Enable/Disable of Broker role in MVX Cluster operations: system now automatically enables or disables the broker role when a user creates or deletes a cluster through CLI. This simplifies workflows, reduces manual steps, and minimizes configuration errors during cluster lifecycle management.
mvx cluster <cluster-name>— This command create a new cluster and automatically enables the broker once the node is ready.no mvx cluster— This command automatically disables the broker before deleting the cluster.
Upgrading IVX clusters: You cannot upgrade clusters directly from versions 9.1.x or 10.0.x to 11.0.0. you must first dismantle the cluster and then upgrade each IVX standalone node individually to version 11.0.0. For more information on how to upgrade IVX clusters, see Upgrade section.
IVX Server supports malware analysis using IVX CLI.
Submissions made through the IVX 10.0.4 web UI are not retained or displayed after upgrading to version 11.0.
Deprecated CLI commands
show mvx analysis cdb data-retentionmvx analysis cdb data-retention
Resolved Issues
The following issues were resolved in the 11.0.0 release.
Tracking number | Summary |
|---|---|
COM-31520, COM-31516 | Vulnerability Validation for CVE-2023-5869 Resolution for the vulnerability designated as CVE-2023-5869 was implemented in PostgreSQL 14.10 binaries. In the present release, version 11.0.0, PostgreSQL 14.11 is deployed, thereby incorporating the necessary fixes from version 14.10 and effectively mitigating the aforementioned vulnerability. |
COM-31572 | Version 11.0.0 includes an update to OpenSSH 9.8p1, which remediates the security vulnerability identified by the relevant CVE. It is important to note that complete mitigation of this vulnerability requires corresponding updates to all connecting SSH clients. This is consistent with the publicly documented remediation steps for this CVE. |
COM-62287 | The JAR versions have been updated to the latest to address multiple CVEs. |
COM-62752 | Vulnerability Validation for CVE-2024-10979 The reported vulnerability for CVE-2024-10979 is addressed by removing the plperlu extension reference and dependencies. |
COM-62823 | In the latest OS version, the 'ping' command response for non-registered hosts has changed from "unknown host" to the more generic "system error" to improve security hardening. |
COM-63092 | Fixes the issue where the 'Advanced URL Defense' service on a VX appliance would enter a warning state due to an incorrectly reported high failure rate for requests. |
VX-2796 | Fixes the issue where VX appliance incorrectly returns a non-malicious verdict for known malicious files in Live mode. |
VX-2821 | Fixes the issue where the MVX Cluster displays "All service queue instances are failing" due to an initial RabbitMQ connection failure. |
VX-2869 | Fixes the issue where users were unable to deactivate notifications specifically for riskware policy rules. |
Known issues
The following issues are known in the 11.0.0 release.
Tracking number | Summary |
|---|---|
COM-63527 | Instead of originating from the designated live interface (ether2), the sandbox analysis traffic is incorrectly originating from the management interface (ether1). |
VX-2941 | The current version of the Web UI does not support file analysis in VNC. |
VX-2996 | The UI does not support downloading the complete report in PDF format. |
VX-3008 | Artifacts not generated for clean API/integration submissions. |
VX-3013 | In the new UI of IVX, only the first 1,000 submission entries are displayed. |
VX-3091 | Sample download icon appears after URL submission done through UI, but clicking it shows "sample not available." |
VX-3113 | The combined maximum threshold limit for retaining malicious and non-malicious artifacts on virtual VX appliances exceed the available disk capacity. |
VX-3201 | In the UI, live mode submissions are incorrectly labeled as 'sandbox' on the Running page. |
VX-3264 | The new UI experiences slowness and missing icons.
|
Upgrade support
The 11.0.0 release requires a reboot for the update to take effect. You can upgrade your appliance to 11.0.0 from release 9.1.x or later.
Note
You can upgrade appliances to 11.0.0 only if they are standalone nodes. For information on upgrading MVX clusters (MVX Smart Grid), see Upgrading MVX Clusters.
Note
After an upgrade to version 11.0.0, certain processes will be in a pending state until new security content is downloaded and installed. See the Download the security content bundle section.
Upgrading MVX clusters
Direct upgrade of MVX clusters (MVX Smart Grid) from a pre-9.1.0 release to 11.0.0 is not supported. See the Upgrading IVX Clusters to Version 11.0 section for more information.
Note
You cannot upgrade clusters directly from versions 9.1.x or 10.0.x to 11.0.0. To upgrade, you must first dismantle the cluster and then upgrade each IVX standalone node individually to version 11.0.0.
Download the security content bundle
After the upgrade, certain processes will be in a pending state until new security content is downloaded and installed. The security content is downloaded and installed automatically for online customers. Offline customers must manually download and install the new security content after upgrading appliances to release 11.0.0.
Downloading content from the DTI offline update portal
If you download 11.0.0 security content from the DTI Offline Update Portal, use the SCNET-9.0 channel of the portal.
Caution
Downloading security content from a different channel will result in a loss of detection.
For details, see the
Trellix DTI Offline Update Portal User Guide
YARA rules supported versions
Before you upgrade an appliance to the 11.0.0 release, modify any custom YARA rules to YARA 4.5.0. For details about YARA 4.5.0, see YARA's Documentation, Release 4.5.0 by Victor Alvarez.