Limitations

DHCP ― DHCP is not supported on the submission interface unless the management interface is ether1. Sensors communicate with the cloud broker and with each other through the submission interface using SSH over SSL (port 443). The default submission interface is ether1.

Jumbo frames ― Jumbo frames are not supported on SmartVision appliances.

High availability ― SmartVision is not supported on Network Security appliances that are configured as a high-availability pair.

Data exfiltration ― Data exfiltration is not supported for IPv6 traffic.

SmartVision alert notifications ― Distribution of SmartVision alerts using Trellix event notification methods (syslog messages, SMTP email, SNMP traps, and HTTP posts to Web servers) is disabled by default and must be explicitly enabled. See Configuring network event notifications.

Reports ― SmartVision Alert reports are available in PDF format only, and they can be generated, scheduled, downloaded, or deleted using the Web UI only.

SMB protocols ― SmartVision analyzes files transferred over SMB v1 and v2 protocols only.

Malware Object events ― If a SmartVision appliance detects malware binaries, it generates a Malware Object alert. Malware Object alerts are listed in the Hosts list and Alerts list. To download the MVX analysis record for a malicious binary, expand the entry in the Host Details page and click Download malware binary.

Average EPS ― Before you deploy a Classic edition appliance to a production environment, make sure that the average events per second (EPS) measured on the appliance does not exceed the recommended maximum EPS.

See Average EPS and recommended maximum EPS and Checking the average EPS using the CLI.

SmartVision Edition sensors, available in the following models:

SmartVision-enabled Network Security hardware appliances operating as sensors

SmartVision-enabled Network Security virtual appliances

TAP mode ― SmartVision edition appliances must be deployed out-of-band using a TAP device, and TAP operational mode is enforced by the product edition license. The FIREEYE_APPLIANCE license details for the Edition appliance specify Op Mode: tap (ok).

SmartVision is supported on Classic Edition appliances deployed in any operational mode.

Custom rules ― Custom rules files cannot be uploaded to SmartVision Edition appliances.

Callback activities ― Edition appliances do not track callback activities, which include signature matches and communications between an infected host and a Command and Control (CnC) server.

Malware Object events ― On SmartVision Edition appliances, information about Malware Object download events is based on malware objects detected in Web traffic transferred over SMB protocols in the core of the network (workstation to workstation or workstation to data center).

This is reflected in several areas:

Web Infection events ― Web Infection events and DNS-related events are not detected, and therefore are not reflected in dashboard or listed in any alerts lists.

Riskware events ― If riskware detection is enabled on a SmartVision Edition appliance, the appliance can detect riskware in Malware Object download events but not in Malware Callback or Web Infection events.

FUME ― On Edition appliances, the suspicious objects that Trellix Unified Multiflow Engine (FUME) sends to the virtual machine (VM) to detect multiflow attacks are limited to .exe and .dll files over SMB and SMB 2.

Trellix event notifications―Use the Edition appliance Web UI to view and configure Trellix event notifications for Malware Object alerts and Riskware Object alerts only. Use the CLI to view and configure these settings for events.

Alert suppression― Edition appliances cannot be configured to suppress the Malware Object alerts or Web Infection alerts that you believe to be false positives.

Trellix event notifications ― Use the SmartVision Edition appliance Web UI to view and configure Trellix event notifications for Malware Object and Riskware Object alerts. Use the CLI to view and configure these settings for events.

Alert suppression ― SmartVision Edition appliances cannot be configured to suppress the Malware Object alerts or Web Infection alerts that you believe to be false positives.

IPS events ― SmartVision Edition appliances do not detect IPS events

Forensic analysis integration ― You cannot integrate a SmartVision Edition appliance with packet analyzer applications (such as Solera Networks, RSA NetWitness, and TrellixPacket Capture Network Forensics Platform) that perform full packet capture and analysis for specific target and source IP addresses.

Splunk Enterprise integration ― You cannot integrate a SmartVision Edition appliance with a Splunk Enterprise server. SmartVision Edition appliances do not support the Layer 7 Metadata Event Exporter feature, nor the l7metadata-export CLI commands.

Internet Content Adaptation Protocol (ICAP) server―You cannot configure a SmartVision Edition appliance to act as an ICAP server.

Bot-tracker features

IOC custom feeds ― Central Management System appliances do not distribute indicators of compromise (IOCs) to managed SmartVision Edition appliances. The Central Management System command [no] custom content enable [on lms <NXhostname>] does not support managed SmartVision Edition appliances.

Network interfaces ― The number of network interfaces on a virtual appliance cannot be changed. If the hosting server lacks sufficient physical NICs to accommodate all of the monitoring interfaces, you can use VLAN tagging, assign unused interfaces to a virtual switch that is not bound to a physical NIC, or add physical NICs to the server.

Storage policies ― Changing storage policy and adding partitions is not supported.

Snapshots ― Storage snapshots are not supported. Content is encoded and decoded on each virtual appliance, and will not be decoded correctly on the snapshot.

If a managed appliance communicates with the Central Management System appliance using the default single-port address type, do not change the active DTI source. Single-port communication requires the managing Central Management System appliance as the DTI source.