Intelligent Sandbox 5.2.2 Release Notes

This release introduces new features, enhancements or update platform support, and resolves known issues.

Rating

The rating defines the urgency for installing this update.

This update is mandatory for all environments. Failure to apply mandatory updates might result in a security breach. Mandatory updates resolve vulnerabilities that might affect product functionality and compromise security. You must apply these updates to maintain a viable and supported product.

What's new in Intelligent Sandbox 5.2.2

This release introduces new features and enhances existing features.

New features

Support for OneNote files — Intelligent Sandbox now supports dynamic analysis and behavior coverage for Microsoft OneNote files with the extension .one.
Improved detection capabilities — Intelligent Sandbox 5.2.2 has improved the detection capabilities for embedded HTML and RTF files.
Retrained Machine Learning model — Intelligent Sandbox 5.2.2 includes a retrained Machine Learning model for DLL samples running on Windows 10 operating systems.
Support for the common detection package across all versions — Intelligent Sandbox now supports a common detection package for all supported versions. RPM names begin with the latest build number. For example, atd-detection-img-5.2.2.xxxxx-5.2.2.x86_64.rpm.
Increased coverage of MITRE TTPs — Intelligent Sandbox now expands the coverage of MITRE tactics, techniques, and procedures (TTPs). For more information, see View latest MITRE ATT&CK techniques.
New CLI commands —Intelligent Sandbox 5.2.2 introduces the following new CLI commands.
- set sysloglimit — Use this command to set syslog message limit in the UI. The syslog message limit ranges from 1000-25000.
- show sysloglimit — Use this command to view the current syslog limit that is set by the set sysloglimit command.
- set clearblacklist enable|disable|status — When uploading a detection package, this command enables or disables the flag for clearing the blacklist from the database.
- clear emailcache — Use this command to clear the cache from an email-connector VM corresponding to a particular MD5 hash value.
- sync webcert — This command syncs web certificates from Primary[Active] or Backup[Active] node to all nodes in the load balancer cluster.
Support for Antimalware Scan Interface (AMSI) — now supports AMSI for logging events to decode obfuscated PowerShell, VBScript, JavaScript, VBA macros, Excel 4.0 macros and WMI scripts.
Rebranding changes — You will notice the following changes in the software:
- McAfee and ATD references have been removed from ePO extensions and the Threat Event Log page in the user interface.
- There is no change to the tag name.
- Trellix ePO extensions — Automatic Responses task created in Trellix ePO for TIS must be updated in the Detecting Product Name, Threat Type, and Threat Name fields. For more information, refer to Product Guide.

Updated platform, environment, or operating system support

This release extends support to additional platforms, environments, or operating systems:

Microsoft Edge support for Windows Server 2019 — Intelligent Sandbox now supports sample and URL analysis for the Microsoft Edge browser on Windows Server 2019.
Hyper-V support on Windows Server 2019 — Intelligent Sandbox supports Windows Server 2019 on Hyper-V for creating virtual machines and analyzing samples.
Intelligent Sandbox now supports the following updated software in Analyzer VMs.
Application
Supported versions
JDK-17
64-bit OS
Google Chrome
107.0.5304.107
Mozilla Firefox
105.0.2
Microsoft Edge
107.0.1418.42

Application	Supported versions
JDK-17	64-bit OS
Google Chrome	107.0.5304.107
Mozilla Firefox	105.0.2
Microsoft Edge	107.0.1418.42

Resolved issues

Resolution	Reference
ATD-11599	Non-ASCII characters in the VM Profile description cause issues when submitting samples. This issue is now fixed by reconfiguring the VM profile. For more information, see Edit VM Profiles in the Product Guide.
ATD-11600	Fixes the issue where the Analyst user was unable to view analysis details in the dashboard.
ATD-11618	Fixes the issue where selected columns were missing from the downloaded CSV report.
ATD-11721	Fixes an issue where multiple logins fail if the role type is Integration Administration and the integration type is TIE.
ATD-11727	Fixes the certification synchronization issue across the cluster.
ATD-11762	TLS 1.2 protocol now accepts upgraded ciphers.
ATD-11769	Fixes the issue where custom roles are unable to view analysis reports of other users.
ATD-11775	Fixes the issue of suppressing and deleting zero-byte MERs every four hours and deleting non-zero-byte MERs older than fifteen days.
ATD-11797	Fixes an issue where Trellix Agent updates the incorrect OS platform type for TIS.

Known issues

For a list of known issues in this product release, see Intelligent Sandbox 5.x Known Issues (KB95730).

Supported upgrade paths

These are the possible upgrade paths from your current version of the software to the latest version.

Trellix Intelligent Sandbox initial version	Upgrade Path
4.12.x	4.12.x » 5.0 » 5.2.0 » 5.2.2
4.14.x	4.14.x » 5.2.0 » 5.2.2
5.0.x	5.0.x » 5.2.0 » 5.2.2
5.2.x	5.2.0 » 5.2.2