Trellix Intelligent Sandbox

What Trellix Intelligent Sandbox is

Trellix Intelligent Sandbox examines suspicious files and URLs to identify advanced, evasive malware and help security teams turn findings into protection. Its analysis draws on signatures, reputation, real-time emulation, sandbox behavior, static code analysis, and machine learning. Unpacking removes obfuscation so executable code can receive deeper static analysis. Reports can bring together MITRE ATT&CK mapping, disassembly, memory dumps, function call diagrams, API logs, PCAP data, and threat timelines for SOC investigations. Supported samples include PE, Adobe, Microsoft Office, image, archive, Java, Android package, and URL formats. Teams can configure analysis environments and interact with malware during investigation. The product connects with Trellix products, third-party email gateways, Zeek Network Security Monitor, and STIX/TAXII threat-sharing standards. Trellix Data Exchange Layer and REST APIs support product and threat-sharing integrations. Deployment options include on-premises appliances, virtual installations, and private or public cloud, with Azure Marketplace availability. The datasheet names ATD-3200 and ATD-6200 appliances and virtual deployment on ESXi 5.5–6.7 or Hyper-V with Windows Server 2012 R2 or 2016. Trellix lists Advanced Threat Defense 5.2.X with an end-of-life date of June 30, 2026.

Who it suits

It suits SOC teams that investigate suspicious files or URLs and need configurable analysis environments with detailed reports. Analysts who want interactive malware analysis and integrations with Trellix, email gateways, Zeek, or threat-sharing standards may also find it a fit.

Limits

Pricing is available on request. Trellix lists Advanced Threat Defense 5.2.X with an end-of-life date of June 30, 2026.

Getting started

1. Visit the Trellix Intelligent Sandbox website.
2. Request pricing or a demo from Trellix.
3. Choose an on-premises appliance, virtual form factor, or supported cloud deployment.
4. Connect product or threat-sharing integrations through supported APIs and standards.

Verdict

Choose Trellix Intelligent Sandbox for malware investigation that combines multiple analysis methods, detailed reporting, and flexible deployment. Teams comparing options should weigh its request-based pricing and the listed lifecycle date for Advanced Threat Defense 5.2.X.