Intelligent Sandbox uses secure virtual machines, or analyzer VMs, for dynamic analysis. During dynamic analysis, Intelligent Sandbox executes suspicious files in the analyzer VM, then monitors the file behavior for malicious activities.
Note
The number of analyzer VMs you can create is limited by the following conditions:
The available Intelligent Sandbox Appliance disk space.
The disk space occupied by the operating system.
Intelligent Sandbox limits the maximum number of analyzer VMs you can use for analysis.
ATD-3000 — 29 analyzer VMs
ATD-6000 — 59 analyzer VMs
ATD-3100 — 29 analyzer VMs
ATD-6100 — 59 analyzer VMs
ATD 3200 — 29 analyzer VMs
ATD-6200 — 59 analyzer VMs
The number of concurrent licenses that you specify affects the number of concurrent active analyzer VMs.
Any security software or low-level utility tool on an analyzer VM can interfere with the dynamic analysis of the sample file. The sample-file execution can be closed during dynamic analysis. As a result, the reports might not capture the full behavior of the sample file. If you need to find out the complete behavior of the sample file, do not update the operating system of the analyzer VM or install any security software on it.
Important
Make sure that you upload the VMDK to your Intelligent Sandbox before activating your Microsoft Windows and Office. Use the Activation feature available in the Intelligent Sandbox Web interface. For more information, see Create VM profiles.
If you activate your Microsoft Windows and Microsoft Office on VMware Workstation, VMware ESXI Server, or Microsoft Hyper-V, your licenses are lost due to change in hardware.