Intelligent Sandbox 5.0.x Release Notes

Intelligent Sandbox release introduces new features, enhancements or update platform support, and resolves known issues. It also addresses product rebranding changes.

Rating

The rating defines the urgency for installing this update. This release is recommended for all environments. Apply this update at the earliest convenience.

What's new in Intelligent Sandbox 5.0

This release introduces new features and enhances existing features.

New features

• Rebranding changes - This is solely for informational purpose, there is no action required. You can continue to secure your organization with Intelligent Sandbox as usual. You will notice the following changes in the software:        

  • Product Name - McAfee Advanced Threat Defense is renamed to Trellix Intelligent Sandbox. All features and options are renamed with the new product name.

  • Brand logo - McAfee logo is replaced with Trellix logo.

  • User interface - Color and typeface are updated and provide better user experience.

  • End User License Agreement and Copyright - The End User License Agreement and Copyright are updated as per legal requirements. Please read the agreement for details.

• Role-based access control (RBAC) — Role Based Access Control restricts access to ATD based on the role allocated to the users. An administrator can assign role-based permissions to other users to define their access levels in Intelligent Sandbox. Additionally, they can create multiple custom roles as required. The default roles available are:        

  • System Administrator — Manages the Intelligent Sandbox environment which also includes LDAP authentication and reset CLI password.

  • Standard User — Monitor the analysis reports and manual file submission.

  • Report Auditor — Audit reports and logs.

  • Config Auditor — View all configurations.

  • Integration Administrator — Administer integrated point products.

  • Analyst — Monitor the analysis report, dashboard, and manual submission of files. Analyst can also view policies and content updates.

• IPv6 protocol support — Intelligent Sandbox now supports IPv6 protocol along with IPv4. You can access Intelligent Sandbox web UI through a browser using IPv6 address. With this Intelligent Sandbox 5.0 release, you can perform the following:        

  • Configure IPv6 address, gateway, DNS, and route.

• Submit samples over IPv6 using REST APIs.

• Manually upload samples and view in X-Mode.

• Access SSH using IPv6.

• Integrate McAfee Web Gateway using the Intelligent Sandbox IPv6 address by configuring IPv6 in McAfee Web Gateway.

• Securely submit samples or transfer files using SFTP.

New CLI commands are added to configure appliance IP, gateway, route, and malware DNS. For more information, see McAfee Intelligent Sandbox 5.0.x Command Line Interface Reference Guide.

Memory dump of a sample file — When you submit a sample file for dynamic analysis on Windows VM, Intelligent Sandbox creates a memory dump. This memory dump is further converted into strings and any suspicious URLs found in the dump are validated against the GTI URL reputation. Intelligent Sandbox provides the ability to search through the memory dump for any suspicious strings, APIs, and URLs.

Enhancements

Behavior coverage — Intelligent Sandbox now includes these coverages:

• VBA downloader without no case

• Detection for Trojan_Shutdown

• Detection for ransomware_BlackBasta and bitpy_ransomware

• Detection for TrojanBootDel and Trojan Taskkill

• Detection for RURransom and Heramtic ransomware

• Detection for Emotet and Hive Ransomware

• Detection for redeemer malware and Ransom Notes

Updated platform, environment, or operating system support

This release extends support to additional platforms, environments, or operating systems:

• Support for Microsoft Windows 10 version 21H2 — Trellix Intelligent Sandbox 5.0 supports Windows 10 version 21H2, create VMs of Window 10 Professional version 21H2 and Window 10 Enterprise version 21H2. This version ranges from 19044.1526 to 19044.1586.

• Support for Microsoft Office 2019 — Trellix Intelligent Sandbox 5.0 supports Microsoft Office 2019 to analyze Microsoft Word, Excel, and Power Point files on virtual machines.

Resolved issues in 5.0

This release resolves known issues.

Platform

Content

Known issues

For a list of known issues in this product release, see For a list of current known issues, see Trellix Intelligent Sandbox 5.x Known Issues (KB95730).

Supported upgrade paths

These are the possible upgrade paths from your current version of the Trellix Intelligent Sandbox software to the latest version.