McAfee Advanced Threat Defense Release Notes

Transcription

1 Revision B McAfee Advanced Threat Defense Release Notes Contents About this release New features and enhancements Resolved issues Installation information Known issues Find product documentation About this release This document contains important information about the current release. We recommend that you read the whole document. New features and enhancements The current release of the product includes these enhancements and changes. McAfee Virtual Advanced Threat Defense on Azure You can now deploy Virtual Advanced Threat Defense on Azure from the Azure Marketplace. Increased Hypervisor support Microsoft Hyper-V: McAfee Advanced Threat Defense now supports Microsoft Hyper-V for the following platforms: Windows Server 2012 R2 Datacenter Windows Server 2016 Datacenter 1

2 As part of your Virtual Advanced Threat Defense package, we have included two script files. These script files make it easier for you to create your Virtual Advanced Threat Defense. VMware ESXi: McAfee Advanced Threat Defense now supports VMware ESXi 6.5. Integrate with TAXII 1.x server You can now integrate your McAfee Advanced Threat Defense with your TAXII 1.x server. Integrate with Bro Network Sensor You can integrate your Bro Network Sensor with McAfee Advanced Threat Defense. Enhancements to Analyzer Profile Runtime Arguments Include command-line parameter for the submitted file on execution. This allows you to review the actual payload of malware. Analyze archive contents individually Allows Advanced Threat Defense to send ZIP and 7zip files directly to a sandbox for analysis. Previously, Advanced Threat Defense extracts the files from these archive files and send the files individually for analysis. Universal migration package Migrate from Advanced Threat Defense 3.8 or 4.0 to 4.2 or Virtual Advanced Threat Defense 3.10 or 4.0 to 4.2 using the migration package. The migration package is equipped to help you migrate to 4.2 with ease and also ensures that all your physical or virtual appliance data, configurations, and certificates are backed up and restored. VM Builder Tool The VM Builder Tool allows you to create analyzer VMs on ESXi version 6.0 and 6.5. You can download the tool from the download site or Advanced Threat Defense web interface. VM Provisioner Tool The VM Provisioner Tool prepares VMware ESXi and Microsoft Hyper-V analyzer VMs. This tool replaces the VMDK Preparation Tool. Register multiple Syslog servers You can now register two Syslog servers in your Advanced Threat Defense. You can also send the same syslog events to multiple syslog servers. Increased file type support for analysis You can now submit Ichitaro word processor files for analysis. Advanced Threat Defense can now perform static and dynamic analysis on.jtd and.jtdc files. New documentation portal Information for Advanced Threat Defense is now provided on the new McAfee Documentation Portal. After clicking the Help icon on the user interface, you are directed to the portal where you can search across all documentation that is provided for Advanced Threat Defense. You must have Internet access to be able to go to the documentation portal. 2

3 Enhanced Connector Advanced Threat Defense now offers Offline Mode for Connector. This allows you to configure your Secure Gateway to send copies of to Advanced Threat Defense, which processes and deletes the copy. Advanced Threat Defense records the envelope information, the verdict on the malware, and the analysis Report and IoCs. Enhanced Deep Neural Network The Deep Neural Network analysis in Advanced Threat Defense now supports non-pe files. Enhanced Malware DNS Configuring Malware DNS is now mandatory for public domain or Internet access during activation and sample analysis. Ease of support Telemetry can now collect crash dump and debug data for your Advanced Threat Defense. Resolved issues The current release of the product resolves these issues. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. General , , Fixes an issue with backup of analysis reports and configuration Fixes and issue with disk cleanup Fixes an issue with use of custom web certificate in XMODE Fixes an issue with syslog configuration where the user is allowed to configure loopback IP address , , Fixes issues with Malware DNS and Malware interface Fixes an issue with CSV export of the analysis result Fixes an issue with content update configuration file Fixes an issue with analyzer VM refresh Fixes an issue with Windows 8.1 VM creation Fixes an issue with Ethernet port link speed Fixes an issue with validation of non-english analyzer VMs Fixes an issue with DNS name resolution for Connector Fixes an issue with duplicate node entry in epo of Advanced Threat Defense , Fixes an issue with serial console redirection. Baud rate of 9600 is now supported Fixes an issue with MAR integration self-recovery Fixes an issue with QEMU core generation , Fixes an issue with DXL channel unstability Fixes an issue with analysis report having double byte characters in sample name. 3

4 Analysis , , , , , , , , , , , , , , , Fixes issue of false negative , , , , , Fixes issue of false positive , , Fixes an issue with sample analysis having non ASCII characters in name Fixes an issue where URL is submitted with full logic path enabled Fixes an issue with URL analysis report Fixes an issue where URL contains blank space , , Fixes an issue with analysis of PDF sample , Fixes an issue with RAR sample analysis , , , , Fixes an issue with false Deep Neural Network analysis Fixes an issue with analysis when the user ID has a space Fixes an issue with sample analysis where the sample has Japanese characters in filename Fixes an issue with sample analysis where the generated reports were inconsistent. Integration Fixes an issue with inconsistent reports on MEG Fixes an issue with MEG integration of LB failover , Fixes an ipsservice crash Fixes an issue with the severity or reputation of certain samples for TIE Fixes an issue where epo reports the wrong host name Fixes an issue with DXL status being unstable. Security , Fixes an issue with validation of certificates Fixes an issue with sandbox evasion technique. 4

5 Installation information For information about installing or upgrading McAfee Advanced Threat Defense software, see these documents: McAfee Advanced Threat Defense 4.2 Product Guide McAfee Advanced Threat Defense 4.2 Migration Guide Tasks Compatible McAfee products on page 5 McAfee Advanced Threat Defense is compatible with these McAfee products. Supported upgrade paths on page 6 These are the possible upgrade paths from your current version of the McAfee Advanced Threat Defense software to the latest McAfee Advanced Threat Defense 4.2. Compatible McAfee products McAfee Advanced Threat Defense is compatible with these McAfee products. The supported McAfee product versions include only those versions of the products that are released on or before the date when this document is published. Product McAfee Network Security Platform McAfee Web Gateway McAfee Gateway Forcepoint Next Generation Firewall (Forcepoint NFGW) McAfee Data Exchange Layer (DXL) McAfee Threat Intelligence Exchange (TIE) Version McAfee Network Security Platform 8.3.x components (limited support) McAfee Network Security Manager: or later Signature set: or later M-series Sensor software: or later NS-series Sensor software: or later Virtual IPS Sensor software: or later McAfee Network Security Platform 8.2.x components (limited support) McAfee Network Security Manager: or later M-series Sensor software: or later NS-series Sensor software: or later Virtual IPS Sensor software: or later McAfee Network Security Platform 8.1.x components. McAfee Network Security Manager: or later M-series Sensor software: or later NS-series Sensor software: or later Virtual IPS Sensor software: or later or later or later and or later or later 5

6 Product McAfee Security Information & Event Management McAfee Enterprise Security Manager (McAfee ESM) McAfee epolicy Orchestrator (McAfee epo ) McAfee Active Response Version or later or later [Build:357] or later or later Supported upgrade paths These are the possible upgrade paths from your current version of the McAfee Advanced Threat Defense software to the latest McAfee Advanced Threat Defense 4.2. To upgrade to McAfee Advanced Threat Defense 4.2, you need to follow the migration process. For more information, see McAfee Advanced Threat Defense 4.2 Migration Guide. The migration process allows you to backup and restore the data, configurations, and certificates on your appliance. The migration process is applicable only if your physical appliance has McAfee Advanced Threat Defense or above, and your virtual appliance has Virtual McAfee Advanced Threat Defense 3.10 or above. If your appliance is using a previous version, you can choose one of the following: follow the upgrade path table to upgrade to 3.8.0, then use the migration process to upgrade to 4.2. In this process, your data is backed up and restored. do a clean install of the operating system and then install 4.2. In this process, you lose all the data on your appliance. For more information, see McAfee Advanced Threat Defense 4.2 Installation Guide. Starting McAfee Advanced Threat Defense version Upgrade Path » 3.8.0» » 3.8.0» » » » » Starting Virtual McAfee Advanced Threat Defense version Upgrade Path » » » » Known issues For a list of known issues in this product release, see KBxxxx. KB

7 Find product documentation On the ServicePortal, you can find information about a released product, including product documentation, technical articles, and more. Task 1 Go to the ServicePortal at and click the Knowledge Center tab. 2 In the Knowledge Base pane under Content Source, click Product Documentation. 3 Select a product and version, then click Search to display a list of documents. Product documentation Every McAfee product has a comprehensive set of documentation. McAfee Advanced Threat Defense Product Guide McAfee Advanced Threat Defense APIs Guide McAfee Advanced Threat Defense Release Notes Copyright 2018 McAfee, LLC McAfee and the McAfee logo are trademarks or registered trademarks of McAfee, LLC or its subsidiaries in the US and other countries. Other marks and brands may be claimed as the property of others. 0B00