Release Notes McAfee Advanced Threat Defense 3.6.0 Revision C Contents About this release New Features Enhancements Resolved issues Installation and upgrade notes Known issues Product documentation About this release This release notes announces the availability of McAfee Advanced Threat Defense software version 3.6.0 for McAfee Advanced Threat Defense Appliance models ATD-3000 and ATD-6000. If you plan to integrate this version of McAfee Advanced Threat Defense and with other supported products, then the minimum software combination supported is as listed below: We strongly recommend you to upgrade your McAfee Advanced Threat Defense software to 3.4.2.32 or a later version to integrate with these products. Product Name McAfee Network Security Platform McAfee Web Gateway Version Network Security Manager: 8.0.5.9 or later Signature set: 8.6.18.10 or later M-series Sensor software: 8.0.3.10 or later NS-series Sensor software: 8.0.5.8 or later Virtual IPS Sensor software: 8.0.7.9 or later 7.4.0-16053 or later 1
Product Name McAfee Email Gateway Version 7.6.3 or later McAfee Next Generation Firewall (McAfee NGFW) 5.9.0 5.10.3 McAfee Data Exchange Layer 1.0.0.1070 or later McAfee Threat Intelligence Exchange 1.0.0.824 or later McAfee Security Information & Event Management 9.5.0 MR4 or later McAfee Enterprise Security Manager (McAfee ESM) 9.4.1 or later McAfee epolicy Orchestrator 5.1.1 [Build:357] McAfee Active Response 1.1.0.158 New Features This release of McAfee Advanced Threat Defense includes the following new features. Auto-synchronization of VM profiles in a load-balancing cluster With this release, upon adding a node to a cluster or upon modifying a VM profile of Primary node, VM configurations in Primary node are pushed to VMs in secondary nodes, thereby automatically synchronizing all the VMs in a cluster. Active Response integration McAfee Active Response is a threat detection and response tool. It provides real-time information about endpoints on your network. With this release, Advanced Threat Defense integrates with McAfee Active Response. The integration enables Advanced Threat Defense to identify all the endpoints in your network which are infected with a malicious file having a threat score of 3 and above. Use set mar-timeout to configure a timeout period after which Advanced Threat Defense stops querying MAR server for results. Use show mar-timeout to display a configured timeout period after which Advanced Threat Defense stops querying MAR server for results. Global whitelisting Whitelist database lists the MD5/SHA-256 hash values of trusted files, which need not be analyzed. With this release, you can use the Advanced Threat Defense web application to manage whitelisted records. Also, it is now possible for a user to whitelist VBA macros. Use the whitelistmerge command to manually copy the Global Whitelist database of the Active node onto Secondary/Backup nodes. This is only a one-time activity, after which the Whitelist database of Secondary/Backup nodes is automatically overwritten by that of the Active node at 0000 hours on a daily basis. Full Logic Path With this new functionality, Advanced Threat Defense can identify malicious actions that are triggered only under specific circumstances, for example on a particular day or when a certain file is present or when a certain command is received. This feature allows you to explore multiple execution paths thus revealing executable hidden logic and representing them in a graphical manner. It is an experimental 2
feature, so the following message appears once you select this feature: This feature is in Technical Preview mode, enabling it will adversely affect the processing speed of the device. Some limitations associated with this feature are listed as follows. It is available only for Windows 7 32-bit systems. VM with this feature enabled has results pertaining to Full Logic Path only and no other detection results. It is suitable only for deeper analysis as it has performance tradeoffs. Usability Following are the usability improvements achieved as part of this release. Prioritizing files for analysis You can select the priority for a sample file execution. The following options are available: Run now Add to queue Enhancements This release of the product includes these enhancements. Appliance performance improvements Following are the performance improvements achieved as part of this release. The sample analysis rate for Advanced Threat Defense increases by 25%. The sample submission rate in a cluster in a load-balancing scenario increases by 50%. Automatic synchronization of VM profiles in a LB Cluster. Usability Single File Submission to Multiple VMs You can submit a file to multiple VMs for analysis simultaneously. You can select multiple VM profiles in the Analyzer Profile. Maximum of 5 VM profiles can be selected for an Analyzer Profile. Support Bundle enhancements The user has the ability to selectively choose the log file categories to be downloaded and the number of most recent log files to be displayed. Also, the blocking call for downloading log files are now removed. Family Classification enhancements Family classification provides the categorization of malware into specific families based on their malicious behavior. The following family classification enhancements are achieved with this release. Family Classification for.net The functionality is extended to samples with.net extension as well. Family Classification for 64-bit samples Earlier the family classification functionality was supported only for 32-bit samples. With this release, the functionality is extended to 64-bit samples as well. 3
Resolved issues These issues are resolved in this release of the product. For a list of issues fixed in earlier releases, see the Release Notes for the specific release. Resolved McAfee Advanced Threat Defense Appliance software issues The following table lists the resolved high-severity issues: ID # Issue Description 1128141 The Advanced Threat Defense Appliance stops processing samples due to Android VM unmount failure. 1127422 The factorydefaults CLI command does not reset the LDAP configuration. 1122758 The XMode and Activation uses the default Advanced Threat Defense certificate even when the custom Web Certificate is uploaded. 1117520 The user interface stops using the custom Web Certificate after upgrading the Advanced Threat Defense Appliance from 3.4.8.142 to 3.4.8.178. The following table lists the resolved medium-severity issues: ID # Issue Description 1125988 The Advanced Threat Defense product guide has to be updated with contents for VM Profile column in the Analysis Results page. 1125902 Passwords containing ":" is printed in clear text in the Audit log. 1125813 The Advanced Threat Defense product guide has to be updated with file analysis sequence for heuristics, docfilter, and Skip files if previously analyzed. 1124054 The Advanced Threat Defense Appliance System Health toggles between Good and Bad states. 1120205 Random account is selected while editing a particular Advanced Threat Defense user account. 1115542 Some of the samples in queue are not picked for analysis after the Advanced Threat Defense Appliance reboots. 1109067 The first sample Status is displayed as Invalid for the ATD supported file type. 1106627 All the samples submitted shows invalid status when the zombie network virtual interface is activated. 1105761 The document URLs for Gateway Anti-Malware and Anti-Virus engines have to be updated in the Advanced Threat Defense product guide. 1077010 After reboot, the samples in queue submitted through URL and URL download are displayed as invalid. Installation and upgrade notes Review the following before you install Advanced Threat Defense in your network. If you have already deployed Advanced Threat Defense and you require information on how to upgrade to this release of Advanced Threat Defense, refer to step 4 below. 4
If you are installing Advanced Threat Defense, then review the steps below. 1 Review the Warnings and cautions and the Usage restrictions sections in the McAfee Advanced Threat Defense 3.6.0 Product Guide. 2 Refer to Before you install the Advanced Threat Defense Appliance section and Setting up Advanced Threat Defense section under Setting up the Advanced Threat Defense Appliance chapter in McAfee Advanced Threat Defense 3.6.0 Product Guide for information on how to install the Advanced Threat Defense Appliance. 3 You can also refer to the McAfee Advanced Threat Defense Quick Start Guide for information on how to set up the Appliance. 4 Refer to the Upgrade McAfee Advanced Threat Defense and Android VM section in the McAfee Advanced Threat Defense 3.6.0 Product Guide and upgrade the embedded McAfee Advanced Threat Defense software to 3.6.0. If the current version is below than 3.4.8 and you want to upgrade to 3.6.0, you need to upgrade the McAfee Advanced Threat Defense to 3.4.8 first. Refer to the sections listed below for guidance on upgrade to 3.4.8. Upgrade ATD software from 3.4.2.32 to 3.4.8 section under Managing Advanced Threat Upgrade ATD software from 3.4.4.63 to 3.4.8 section under Managing Advanced Threat Upgrade ATD software from 3.4.6 to 3.4.8 section under Managing Advanced Threat Defense chapter in McAfee Advanced Threat Defense 3.6.0 Product Guide If the current version is 3.4.8.190 or 3.4.8.193, you can directly upgrade to 3.6.0. Refer to the sections listed below for guidance on upgrade to 3.4.8. Upgrade ATD software from 3.4.8.190 to 3.6.0 section under Managing Advanced Threat Upgrade ATD software from 3.4.8.193 to 3.6.0 section under Managing Advanced Threat If the current Android version is 4.3, you need to upgrade to Android Analyzer VM 5.0. Refer to Upgrade the Android Analyzer VM section under Managing Advanced Threat Defense chapter in McAfee Advanced Threat Defense 3.6.0 Product Guide Before upgrading to version 3.6.0, we either need to remove the Android VM from the analyzer profiles or upgrade the Android VM to 5.0. This is a pre-requisite to create an Android VM. 5 Refer to McAfee Advanced Threat Defense 3.6.0 Product Guide and configure it for malware analysis. 6 To integrate with Network Security Platform, refer to the corresponding Network Security Platform release notes as well as the latest Network Security Platform Integration Guide. Recall that you need a Manager and a Sensor on version 8.1 or later. 7 To integrate with McAfee Web Gateway, you need McAfee Web Gateway 7.4.0-16053 or later. Refer to the McAfee Web Gateway 7.4.0 Product Guide. 8 To integrate with McAfee epo, you need version 5.1.1 or later. In order to integrate Advanced Threat Defense with McAfee Threat Intelligence Exchange (TIE), you need 5.1.1 or above version of McAfee epo. The information for this integration is in the McAfee Advanced Threat Defense 3.6.0 Product Guide. 5
Known issues McAfee Advanced Threat Defense software issues in this release: KB86947. Product documentation Every McAfee product has a comprehensive set of documentation. Find product documentation 1 Go to the McAfee ServicePortal at http://mysupport.mcafee.com and click Knowledge Center. 2 Enter a product name, select a version, then click Search to display a list of documents. 3.6.0 product documentation list The following software guides are available for Advanced Threat Defense 3.6.0 release: Quick Start Guide Product Guide API Reference Guide Copyright 2016 McAfee, Inc. www.intelsecurity.com Intel and the Intel logo are trademarks/registered trademarks of Intel Corporation. McAfee and the McAfee logo are trademarks/ registered trademarks of McAfee, Inc. Other names and brands may be claimed as the property of others. 00