New features and changes

As Trellix continues our exciting evolution, our customers will begin to see our solutions reflect our new name and brand. In this release, we have updated the Malware Analysis Web UI with the Trellix logo and name. This rebranding change requires no effort from you.

All the supported artifacts are now generated for all submissions if the display of static information for malicious and non-malicious files and URLs on the Malware Analysis appliance Web UI is enabled. From this release, the display of static information is enabled by default.

md5sum and sha256 values are now populated in the show submission command output.

You can now configure datastreaming to Splunk servers.

Metadata streaming through an HTTP proxy is now supported.

The Malware Analysis appliance Web UI has adopted the MUSE design for UX improvements.

You can now set the number of days to retain data in the database. Data will be purged after the retention period. You can change the frequency and time of the data purge.

IPMI on the Malware Analysis 6th generation appliances is now compatible with IPv6 management network.

Upgrades to release version 10.0.0 will not be supported on Malware Analysis 4th generation appliances.

You can now restore a backup database belonging to a different appliance model of the same release version. This feature is useful when upgrading from one appliance model to another.

The existing FIPS and CC high-security cipher lists have been updated. For more details, refer to Malware Analysis User Guide.

The Health Services tab allows you to configure health monitoring parameters for all the available health services on the appliance.

You can now use previously used Malware Analysis settings for preferences and profiles when submitting a malware. You can set default preferences and save it for future use.

• Malware, non-malicious and riskware artifacts data downloaded as a zip file for any specified alert includes OS Change Graph data.

• All the supported formats for Rsyslog notifications are now displayed in the Malware Analysis Web UI.

• The Service Health Statistics Trend widget on the Malware Analysis appliance Web UI dashboard highlights the health status level in each category tile.

• Factory default certificate generation key size is changed to 3072 bits.

• You can now use previously applied Malware Analysis settings for preferences and profiles when submitting a malware. You can set default preferences and save it for future use.

• Localsig enhancements:

  • sh localsig url and sh localsig file-hash now lists all the active localsig entries.

  • Black listed URLs/Hashes will not be added to localsig.

  • Localsig also supports file hashes.

• The FAUDE URL screenshot is now generated along with other artifacts after successful submission.

• If you download security content from the DTI Offline Update Portal, you now use the SCNET-8.0 channel of the portal.

• Log-management functionality has been improved.

• You can now download artifacts data corresponding to the specified artifact types (if available for the specified UUID) as a zip file using the API.

• Alert type 'Riskware-Object' has been added for the report type 'Riskware Details' for both Static and Scheduled Reports in the Reports option on the Malware Analysis Web UI.