Malware Analysis 11.0.1 Release Notes

This is the latest release of Trellix Malware Analysis

New features and changes

This section describes the new features in the Trellix Malware Analysis release 11.0.1.

FLOSS artifacts updates on Analysis page
On the Analysis page, FLOSS will be shown in the Artifact column whether it is enabled or not. FLOSS artifacts are disabled by default. Disabled FLOSS artifacts will not be displayed in the following situations:
- On expanding the alert details
- Inside a triage bundle
- On downloading artifacts from the API
Use the following CLIs to configure FLOSS artifacts.
- [no] analysis artifact floss enable: Enable or disable FLOSS artifact
- show analysis artifact floss: Display FLOSS artifact

Enhancements

Updated the default OpenID Connect (OIDC) issuer URL from the F-IAM issuer URL to the T-IAM issuer URL.
The default number of results displayed per page has been changed to 20 in the pagination settings. When set to 20, only 20 results are shown per page. When you select to display 50 results per page, all available results are displayed accordingly.
The Upload option on the Log Manager page for uploading archived files has been removed.
The appliance base components have been upgraded to fully support TLS 1.3 for management protocols, including the Web management interface. This enhancement enforces access rules when Web Client Certificate Authentication is enabled, client certificates are now required for all WSAPI calls, and there is no fallback to other authentication methods for Web Portal access.
The configuration jumpstart wizard now supports both pure IPv6 and dual-stack (IPv4/IPv6) configurations, enabling successful deployment in IPv6-only environments.
The TAXII client within the appliance is now correctly routed through the Fenet proxy (if configured), allowing for successful synchronization with the TAXII server.
The LDAP client now supports the automatic fetching of Certificate Revocation Lists (CRLs), along with existing manual updates feature.
You can now use enhanced configuration options for managing Certificate Authority (CA) lists when setting up secure (SSL/TLS) rsyslog consumers. This update provides greater control and introduces a dynamic default behavior for including CA certificates.
Support local time streaming for events
The streamingd service now supports the configuration of event timestamps to reflect the local time zone set on the appliance, rather than the default Coordinated Universal Time (UTC).
This enhancement enables system administrators to ensure event timestamps streamed via streamingd are consistent with timestamps on files submitted through the appliance. Use the following CLIs to configure the time zones:
- datastreaming submission local-timestamp enable - Enable the streaming of event timestamps in the appliance's local time zone.
- no datastreaming submission local-timestamp enable - Revert the streaming of event timestamps back to the default UTC format.
- show datastreaming submission - View the status of this new "Streaming in Local Time" feature, use existing CLI.
Enhanced data streaming configuration guidance for TLS Syslog
You can now follow updated guidance for configuring secure (SSL/TLS) syslog for data streaming. This guide provides the specific settings required to ensure your TLS syslog server (typically on port 6514) is compatible with the standard RFC 5424 format.
- datastreaming configuration protocol rsyslog consumers <consumer-name> output-type Syslog-TLS: Specifies that the data stream consumer will use the secure Syslog-TLS protocol for output.
- datastreaming configuration protocol rsyslog consumers <consumer-name> msg-style ietf: Ensures the syslog messages are formatted according to the IETF standard (RFC 5424).
The CLI, datastreaming configuration protocol rsyslog consumers <consumer-name> ssl ca-list <option>, now has updated CA list options:
- builtin-only: no supplemental list, can only use built-in one.
- default-ca-list: default supplemental CA certificate list.
- undefined: Implements dynamic logic to determine inclusion/exclusion automatically.
- based on context: For example, configuration defaults to default-ca-list when SSL is disabled.

Resolved issues

The following issues were resolved in the Malware Analysis 11.0.1 release.

Tracking number	Summary
COM-63528	Resolved an issue where the AX appliance's management interface (ether1) was incorrectly attempting to establish connections for sandbox analysis.
COM-63130	Removed the diffie-hellman-group14-sha1 Key Exchange (KEX) cipher from our supported CC and FIPS cipher lists.
WEBUI-14964	The STIX feed upload now accepts only valid STIX 1.0 (XML) and STIX 2.0/2.1 (JSON) formats.
WEBUI-30013	Addresses remote code execution vulnerability in the web UI. An attacker could exploit this vulnerability to execute commands on the underlying operating system by viewing malware artifact details in the Alerts view.

Known issues

The following issues are known in the Malware Analysis 11.0.1 release.

Tracking number	Summary
COM-63593	Custom Blacklisted Md5sum and SHA256sum are not preserved after upgrade from 915.
COM-63635	Compliance mode appliances are logging too much noise with SSL_ERROR_WANT_READ informational status.
COM-63684	Floss artifact will be displayed on artifact column on Analysis page whether the floss is disabled or not.
WEBUI-30212	Deleted certificate reappears after page reload when cert authentication was enabled.

Additional Information

Upgrade support

The Trellix Malware Analysis 11.0.1 release requires a reboot for the update to take effect. You can upgrade your AX appliance to 11.0.1 from release 9.1.0 or later.

After an upgrade to version 11.0.1, the dashboard will not retain prior data for Analysis Statistics and File Analysis Statistics.

After an upgrade to version 11.0.1, the dashboard statistics may exhibit inaccuracies for the initial three-hour period. Scan statistics remain unaffected.

Previously created log archive files shall not be preserved during an upgrade to 11.0.1. It is recommended to secure a backup of logs before initiating the upgrade.

Important

After any upgrade to 11.0.1, the FireEye Advanced URL Defense Engine (FAUDE) will be activated if it was previously disabled in earlier versions. See "Enabling or Disabling Advanced URL Defense" in the Malware Analysis User Guide.

Note

After an upgrade to version 11.0.1, certain processes will be in a pending state until new security content is downloaded and installed. See the following section, "Download the security content bundle".

Important

When upgrading an X500 AX running in FIPS/CC compliance mode to version 11.0.1, you must reapply the compliance mode immediately after the upgrade. Use the CLI command compliance apply standard <standard name> and save the configuration using the CLI write memory.

After reapplying compliance mode, ensure that any necessary compliance options overrides are reasserted as needed. In rare instances, the appliance may become unresponsive before compliance can be applied. If this occurs, the appliance may need to be power cycled.

Download the security content bundle

After the upgrade, certain processes will be in a pending state until new security content is downloaded and installed. The security content is downloaded and installed automatically for online customers. Offline customers must manually download and install the new security content after upgrading appliances to release 11.0.1.

Downloading content from the DTI offline update portal

If acquiring Malware Analysis 11.0.1 security content from the DTI Offline Update Portal, utilization of the SCNET-9.0 channel is mandatory.

Caution

Deviation from this specific channel for security content retrieval will invariably precipitate a compromise in detection capabilities.

For details, see the Trellix DTI Offline Update Portal User Guide.

Upgrading IPMI 3.11 and BIOS 1.9 firmware for specific platforms

The AX 5550 model requires an upgrade to IPMI 3.11 and BIOS 1.9. You must install the IPMI upgrade before you upgrade the BIOS. (COM-25469)

For detailed instructions about upgrading IPMI, see the System Administration Guide.

To upgrade IPMI to version 3.11:

Note

IPMI network and password settings revert to factory defaults after this upgrade, and IPMI logs are deleted. Make a note of your settings and back up your IPMI logs.

Do not shut down or remove power from the appliance during the upgrade.

Go to CLI configuration mode.
hostname > enable
hostname # configure terminal
Begin the upgrade:
hostname (config) # ipmi firmware update latest
Confirm the upgrade:
hostname (config) # show ipmi

If the upgrade fails, try the steps again.

If IPMI functions are not fully restored, perform a full power cycle (cold shutdown) on the appliance:

Stop the reload process:
hostname (config) # reload halt
Disconnect all power cables for 2 minutes.
After 2 minutes, reconnect power cables and restart the appliance.

To upgrade the BIOS to version 1.9:

Go to CLI configuration mode.
hostname > enable
hostname # configure terminal
Begin the upgrade:
hostname (config) # system bios firmware update latest
Note
Do not shut down or remove power from the appliance during the upgrade.
Confirm the upgrade:
hostname (config) # show system bios
Stop the reload process:
hostname (config) # reload halt
Disconnect all power cables for 2 minutes.
After 2 minutes, reconnect power cables and restart the appliance.

YARA rules supported versions

YARA rule support has been updated to version 4.5.0. Prior to upgrading a Malware Analysis appliance to release 11.0.1, it is necessary to modify any custom YARA rules to comply with YARA 4.5.0. For detailed information regarding YARA 4.5.0, see YARA's Documentation, Release 4.5.0 by Victor Alvarez.

Enabling access to intel context

Advanced Threat Intelligence (ATI) is a cloud-based data collection and threat intelligence distribution feature that provides actionable information about MVX-verified events on appliances. The threat intelligence tells you who is the threat actor behind an attack, what has been targeted or breached, and (if known) how to mitigate the threat. The Trellix Research Labs team continually uploads the latest threat intelligence to the Trellix Dynamic Threat Intelligence (DTI) cloud. When an MVX-verified event triggers an alert, the appliance queries the DTI server for threat intelligence and stores the additional information in its database. When you display an ATI alert, the alert details include the threat intelligence.

Appliances now need access to the Amazon Web Services (AWS) cloud for ATI communication. The intel context service is hosted in multiple AWS regions and resolves to multiple IP addresses based on geographic location. To determine the IP addresses for your location, go to https://dnschecker.org. See the AWS IP address range documentation for information about adding the IP addresses to the allow list.