Note
Release 11.0.0 is the current release after 10.0.4 for Network Security.
New features and changes
This section describes new features or enhancements in the Network Security 11.0.0 release.
Support OS Upgrade to Alma Linux 9.2
The Network Security platform has undergone a base upgrade from CentOS 7 to Alma Linux 9.2 to ensure continuous support and deliver improved stability, security, and performance.
NDR Sensor is now available for deployment
The NDR sensor is now available for deployment, offering robust network detection and response capabilities. It is a key component of Network Security, providing essential network visibility, threat detection, and response capabilities.
The conversion from Network Security to NDR sensor mode is license-driven. Existing customers with NX8600 or virtual 10500 can convert to NDR by purchasing and installing an NDR feature license.
For more details, see NDR Sensor Feature Guide.
Deploying virtual Network Security appliances on KVM Servers
You can now deploy a virtual 10500V Network Security appliance on KVM (Kernel-based Virtual Machine) servers. KVM is open-source hardware virtualization software through which you can create and run multiple Linux and Windows-based virtual machines simultaneously.
Note
The Network Security 10500V is supported only in L3 mode, with a maximum of two pairs of SR-IOV monitor interfaces.
For more details, see Deploying virtual NX appliances on KVM Servers.
IPv6 support for SSL intercept
The Network Security appliance can now decrypt IPv6 SSLi traffic along with IPv4 SSLi traffic. You can now update network policies based on both IPv4 and IPv6 addresses and mask using Classless Inter-Domain Routing (CIDR) notation for SSL interception by using the Network Security appliance Web UI or CLI.
For more details, see Configuring rules for a network policy for SSL interception.
Support for IPv6 addresses in alert policy exceptions
Alert policy exceptions enables you to override the actions defined by alert rules. These alert policy exceptions can now manage traffic for source host and destination IPv6 addresses or subnets.
For more details, see Alert policy exceptions.
Packet capture artifacts backup/cleanup configuration
You can now manage pcap artifacts for SmartVision, Bottracker EBC and NTAP EBC in a number of ways. This feature will help you have more control over the items included in your backup contents and the volume of backup:
Enable or disable backup for pcap artifact for the mentioned modules
Check sizes of the pcap artifacts on the Network Security appliance
Cleanup exceeding pcaps using the number of retention days CLI while performing the cleanup
For more details, see Database backup and restore.
Adding custom allowed and blocked lists functionality via the Web UI
The third-party feed tab now features dedicated "Allowed Lists" and "Blocked Lists" in the Network Security Web UI. You can now add URLs, MD5 or SHA-256 hashes, and regex URLs to both the allowed and blocked lists. These additions are designed to optimize the appliance's detection efficacy and expedite analysis times.
For more details, see Allowed and blocked lists.
Custom URL rules now support regex pattern matching
Regular expression pattern matching is now supported for custom blocklists and allowlists, enhancing the ability to define URL rules. This enhancement provides increased flexibility for improved threat management via both the Command Line Interface (CLI) and the Web User Interface (WebUI).
For more details, see Allowed and blocked lists.
Integration of external threat intelligence feeds through the TAXII protocol
Network Security now integrates third-party threat intelligence feeds from TAXII servers using STIX 2.x/TAXII 2.1 via the web UI and CLI. Upon configuration, the system automatically retrieves feeds, including URLs and file hashes, at scheduled intervals based on the configured synchronization frequency. Currently, Network Security supports the configuration of a single TAXII server, with customizable API roots, credentials, CA certificates, synchronization frequency, and STIX indicator types.
For more details, see Managing threat intel feeds using TAXII.
Integration with private Global Threat Intelligence (pGTI)
The Network Security appliance now supports Private Global Threat Intelligence (pGTI) integration, enabling it to leverage Trellix's private cloud server for URL and file reputation verdicts. pGTI, which uses REST APIs and certificate-based authentication, maintains reputations based on Trellix security platform submissions. Network Security can now query pGTI for file and URL reputation assessments during analysis.
New, modified and deprecated CLI commands
New CLIs
The CLI commands in this section were added in this release. For more details about the following CLIs, please refer to the CLI Reference Guide.
pcap artifacts backup/cleanup configuration
[no] ntap pcap backup enable: Enable or disable NTAP pcap backup[no] smartvision ebc backup enable: Enable or disable SmartVision EBC pcap backup[no] bottracker ebc backup enable: Enable or disable Bottracker EBC pcap backupshow bottracker ebc backup config: Displays current configuration for Bottracker EBCshow ntap ebc pcap-size: Displays current size for NTAPshow smartvision ebc pcap-size: Displays current size for SmartVision EBCshow bottracker ebc pcap-size: Displays current size for Bottracker EBCntap pcap cleanup retain * days force: Cleans older pcap artifacts from directories. You can also configure the retention period ranging from 0 - 365 days, if required. Use the force option to cleanup the pcaps without confirmation.smartvision ebc cleanup retain * days force: Cleans older pcap artifacts from directories. You can also configure the retention period ranging from 0 - 365 days, if required. Use the force option to cleanup the pcaps without confirmation.bottracker ebc cleanup retain * days force: Cleans older pcap artifacts from directories. You can also configure the retention period ranging from 0 - 365 days, if required. Use the force option to cleanup the pcaps without confirmation.
Regex pattern matching in custom URL rules CLIs
[no] analysis custom blacklist regex url <pattern>: Adds a rule to a custom blacklist based on the regex URL with specified pattern.[no] analysis custom whitelist regex url <pattern>: Adds a rule to a custom whitelist based on the regex URL with specified pattern.show analysis custom blacklist regex urls: Displays the custom blacklist containing all the regex URLs.show analysis custom whitelist regex urls: Displays the custom whitelist containing all the regex URLs.
CLIs for managing threat intel feeds - TAXII
[no] taxii server <TAXII server name> api-root: Configures the API root for the TAXII server.[no] taxii server <TAXII server name>: Configures a TAXII server.[no] taxii server <TAXII server name> api-root collection-id: Configures the API root with a collection ID for the TAXII server.[no] taxii server<TAXII server name> api-root username password: Configures the API root username and password for the TAXII server.[no] taxii server <TAXII server name> discovery-url: Configures the TAXII server discovery URL.[no] taxii server <TAXII server name>enable: Enables the TAXII server.[no] taxii server <TAXII server name> pagination-limit: Configures the pagination limit for the TAXII server.[no] taxii server<TAXII server name> root-ca: Configures the root CA for the TAXII server.[no] taxii server <server name> root-ca ca-chain: Configures the root CA and CA chain for the TAXII server.[no] taxii server <TAXII server name> sync-frequency: Set the TAXII server sync frequency in minutes (10-1440).[no] taxii server <TAXII server name> username password: Configure the TAXII server username and password.[no] taxii server <TAXII server name> validate config: Validates the TAXII server configuration.[no] show taxii server: Displays the configuration of a TAXII server.[no]analysis custom stix indicator-type <type> enable: Enables the indicator type for STIX format intel feeds. Only the configured indicator patterns with indicator-type configured are synced.
CLIs for managing threat intel feeds - STIX format
[no]analysis custom stix indicator-type <type> enable: Enables the indicator type for STIX format intel feeds.show analysis custom stix indicator-types: Displays the indicator types for STIX format intel feeds.
Modified CLIs
The following existing CLIs were modified in this release:
pcap artifacts backup/cleanup configuration
show backup estimate profile full: The output has a new field,Estimated space required for pcap backup.show ntap config: The output has a new field,pcap_backup_is_enabled.show smartvision config: The output has a new field,Packet capture backup enabled.
IPv6 support for SSL intercept
policymgr ssl-intercept network ip <IPv4|IPv6>|<prefix>|<any> interface <port-pair-name> decrypt: Adds a rule to a network policy that decrypts HTTPS traffic based on IPv4 or IPv6 address and mask.policymgr ssl-intercept network ip <IPv4|IPv6>|<prefix>|<any> interface <port-pair-name> pass-through: Adds a rule to a network policy that bypasses traffic either to or from a specified IPv4 or IPv6 address and mask.
Support for IPv6 addresses in alert policy exceptions
show policymgr signatures: Output will now show entire IPv6 addresses.policymgr signature id: <any-v6> option added for both source and destination IP fields.
CLIs for pGTI integration
analysis pgti baseurl <pgti_url>: Configures the URL address of the pGTI serverno analysis pgti baseurl: Deletes the URL address of the pGTI serveranalysis pgti apikey certificate <cert_name> ca-list <ca-chain-cert_name>: Generates the API key for communicating with the pGTI server using the APIno analysis pgti apikey: Deletes the pGTI API key and the corresponding certificate name and ca_chain name config used for generating the certificates[no] analysis pgti enable: Enables/disables the integration with the pGTI servershow analysis pgti: Displays the configuration details regarding the pGTI integration
Resolved issues
The following issues were resolved in the Trellix Network Security 11.0.0 release.
Tracking number | Summary |
|---|---|
CMS-32420 | The WebUI changes for SSL Inbound settings is now supported on Central Management System version 11.0.0. |
COM-26327 | Fixes vulnerability issues by upgrading the OpenSSH version to 7.4p1. |
COM-29440 | rsyslog is upgraded to 8.2102.0-117.el9. |
COM-31520, COM-31516 | Vulnerability Validation for CVE-2023-5869 Resolution for the vulnerability designated as CVE-2023-5869 was implemented in PostgreSQL 14.10 binaries. In the present release, version 11.0.0, PostgreSQL 14.11 is deployed, thereby incorporating the necessary fixes from version 14.10 and effectively mitigating the aforementioned vulnerability. |
COM-31572 | Fixes vulnerability issues caused by CVE-2023-48795. |
COM-31718 | Fixes a list o vulnerabilities issues. |
COM-31900 | Fixes vulnerability and execution issues caused by CVE-2024-2961. |
COM-62287 | The JAR versions have been updated to the latest to address multiple CVEs. |
COM-62311 | Fixes an issue where Network Security auditor users could not upload log archives from the CLI. |
COM-62330 | Fixes vulnerability issue caused by a list of CVEs. |
COM-62384 | Fixes Alert Notification changes. |
COM-62396 | Fixes Apache HTTPd vulnerability issues by upgrading Apache to version 2.4.62. |
COM-62451 | Fixes an issue in the email notification where different URLs appeared in the body and the attachment instead of the same URL. |
COM-62576 | When a URL is added to the custom blacklist, NX now automatically considers both HTTP and HTTPS versions of the URL. This ensures consistent behavior by handling both protocol variations during subsequent blacklist processing. |
COM-62584 | Fixes vulnerability issue caused by CVE-2024-6119. |
COM-62706 | Fixes an issue wherein certificate uploads to the Network Securityappliance were failing due to erroneous value inputs. |
COM-62717 | Fixes discrepancy issues in alert names between the Network Security WEB UI and the SIEM. |
COM-62720 | Fixes an issue where email notifications were being sent twice. |
COM-62752 | Vulnerability Validation for CVE-2024-10979 The reported vulnerability for CVE-2024-10979 is addressed by removing the plperlu extension reference and dependencies. |
COM-62823 | In the latest OS version, the 'ping' command response for non-registered hosts has changed from "unknown host" to the more generic "system error" to improve security hardening. |
WEBMPS-26852 | Fixes a crash that occurred due to high memory usage. |
WEBMPS-27033 | Fixes an issue with intermittent drops of internal FUME packets that was observed on the appliance. |
WEBMPS-53881 | Fixes an issue where the maximum and minimum values of the SMB graph in the monitoring traffic widget showed as 0 on upgrading the appliance to 10.0.1. |
WEBMPS-53889 | Fixes an issue where the virtual Network Security was rebooting while generating a log archive. |
WEBMPS-53903 | Fixes an issue where fragmented IP packets caused memory corruption in datapath. |
WEBMPS-53962 | Fixes an issue where the URL was not visible in the Alert details page. |
WEBMPS-53973 | You can now enable the time-base alert purging functionality on the LMS and CMS feature in the Network Security appliance. |
WEBMPS-54127 | Fixes an issue where users where unable to block files. |
WEBMPS-54134 | Fixes an issue where submissions were not appearing in Network Security 4500 appliance. |
WEBMPS-54144 | Fixes an issue where the SCSD did not refresh the certificate after license upgrade. |
WEBMPS-54146 | Fixes issues related to IPS policy count mismatch and applying policies. |
WEBUI-14759 | Fixes an issue where data disappeared from the custom dashboard geo visualisation widget report. |
WEBUI-15039 | Fixes and where on configuring web session timeout for more than 24 days caused immediate auto-logout during UI login. |
Known Issues
The following issues are known in the Trellix Network Security 11.0.0 release.
Tracking number | Summary |
|---|---|
COM-30656 | Negation symbol '!' is not working before the hostname or the username in deny user list. |
COM-31165 | gisettings API is not restricting the maximum number of inputs for a field as 10. |
COM-63527 | Instead of originating from the designated live interface (ether2), the sandbox analysis traffic is incorrectly originating from the management interface (ether1). |
WEBMPS-24391 | In a virtual Network Security appliance on Hyper-V, modifying the MTU value affects inline traffic. The traffic is reinstated when fe_fastpath_mgr is restarted. |
WEBMPS-24484 | IPS alerts for brute force login attempts do not include the appID, although the appID is detected. |
WEBMPS-24541 | The CLI does not return any errors when you add a duplicate of an existing configuration for Whitelist and Homenet IP, or when you delete a configuration that does not exist. |
WEBMPS-54603 | Deleting 512 CIDR rules using the Delete All option takes longer than usual. |
WEBUI-14964 | The STIX feed upload must only accept valid STIX 1.0 (XML) and STIX 2.0/2.1 (JSON) formats. The current implementation incorrectly allows other file formats to be uploaded. |
WEBUI-29938 | QR Code badge does not appear for detected alerts on the Network Security Alerts page. |
WEBMPS-54675 | On upgrading the Network Security appliance to version 11.0.0, the appliance ignores the SSLi network bypass configuration. Please reach out to support for the hotfix. |
WEBMPS-54685 | High memory consumption is observed by one of the datapath processes, leading to a link flap issue. Please reach out to support for the hotfix. |
Product compatibility
This Trellix Network Security release supports the following Trellix products:
HelixConnect client
Central Management appliance
Models not supported in this release
The following Network Security models are not supported in the release 11.0.0 and later releases.
NX 900
NX 1400
NX 2400
NX 10000
NX 4500Vec2nitro (cloud)
Trellix recommends deploying the new cloud model and reconfiguring the routes.
NX 6500Vec2nitro (cloud)
Trellix recommends deploying the new cloud model and reconfiguring the routes.
Disable SAML in a Helix environment
SAML and HelixConnect are mutually exclusive. If the HelixConnect client is enabled on the Network Security appliance, you must disable SAML authentication and authorization. Otherwise, the appliance will not come up after a system reboot.
For more information, see the
Helix Integration Guide for Trellix devices
.
In the Software Requirements section, see “HelixConnect Client Software Requirements”.
In the HelixConnect Troubleshooting section, see “Disabling SAML Authentication and Authorization”.
Upgrade support
The Trellix Network Security 11.0.0 release requires a reboot for the update to take effect. You can upgrade your NX appliance to 11.0.0 from release 9.1.0 or later.
Note
After an upgrade to version 11.0.0, certain processes will be in a pending state until new security content is downloaded and installed. See the following section, "Download the security content bundle".
During this process there will be an impact in detection.
Note
Submissions from Network Security configured in hybrid mode will no longer be sent to Cloud MVX.
Network Security appliances configured in hybrid mode will offload overflow submissions to the connected on-prem cluster.
Migrating inline policy exceptions and IPS policy exceptions
For Network Security appliances configured with inline policy exceptions or IPS policy exceptions, the upgrade process automatically migrates the existing policy exceptions to the alert policy exceptions format introduced in release 9.0.2.
Download the security content bundle
After the upgrade, certain processes will be in a pending state until new security content is downloaded and installed. The security content is downloaded and installed automatically for online customers. Offline customers must manually download and install the new security content after upgrading appliances to release 11.0.0.
Downloading content from the DTI offline update portal
If you download Network Security 11.0 security content from the DTI Offline Update Portal, use the SCNET-9.0 channel of the portal.
Caution
Downloading security content from a different channel will result in a loss of detection.
For details, see the
Trellix DTI Offline Update Portal User Guide
.
YARA rules supported versions
YARA rules support version 4.5.0.
Important
Before you upgrade an Network Security appliance to the 11.0.0 release, modify any custom YARA rules to YARA 4.5.0. For details about YARA 4.5.0, see YARA's Documentation, Release 4.5.0 by Victor Alvarez.
Enabling access to intel content
Advanced Threat Intelligence (ATI) is a cloud-based data collection and threat intelligence distribution feature that provides actionable information about MVX-verified events on appliances. The threat intelligence tells you who is the threat actor behind an attack, what has been targeted or breached, and (if known) how to mitigate the threat. The Trellix Research Labs team continually uploads the latest threat intelligence to the Trellix Dynamic Threat Intelligence (DTI) cloud. When an MVX-verified event triggers an alert, the appliance queries the DTI server for threat intelligence and stores the additional information in its database. When you display an ATI alert, the alert details include the threat intelligence.
Appliances now need access to the Amazon Web Services (AWS) cloud for ATI communication. The intel context service is hosted in multiple AWS regions and resolves to multiple IP addresses based on geographic location. To determine the IP addresses for your location, go to https://dnschecker.org. See the AWS IP address range documentation for information about adding the IP addresses to the allow list.