Trellix Intelligent Sandbox

What Trellix Intelligent Sandbox is

Trellix Intelligent Sandbox is a threat analysis product designed to detect advanced, evasive malware and turn threat information into protective action. Its analysis combines signatures, reputation, real-time emulation, sandbox behavior analysis, static code analysis, and machine learning. Unpacking features remove obfuscation to expose executable code for deeper static analysis. Reports can include MITRE ATT&CK mapping, disassembly, memory dumps, function call diagrams, API logs, PCAP data, and threat timelines. Integrations include Trellix products, third-party email gateways, Zeek Network Security Monitor, and STIX/TAXII threat-sharing standards; Trellix Data Exchange Layer and REST APIs are also supported. Deployment options include an on-premises appliance or virtual form factor, with private and public cloud support and Azure Marketplace availability. The datasheet lists multiple sample types and physical appliance models, as well as virtual deployment on specified ESXi and Hyper-V versions. Pricing is on request. Trellix lists Advanced Threat Defense 5.2.X with end of life on June 30, 2026.