Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Configuring a custom network for internal Virtual Analyzer in Deep Discovery Inspector (DDI) 3.8

    • Updated:
    • 1 Nov 2017
    • Product/Version:
    • Deep Discovery Inspector 3.8
    • Platform:
    • N/A N/A
Summary

If users select internal Virtual Analyzer for testing suspicious files that DDI encounters, three network types can be selected and the selected network type determines the Internet connectivity of Virtual Analyzer.

When Management network is used, internal Virtual Analyzer connects to the Internet using the DDI management port. If Custom network is selected, internal Virtual Analyzer could connect to the Internet via another data port.

Details
Public

Recommendation

Since suspicious files analyzed by internal Virtual Analyzer might also trigger some malicious traffics, for instance, connecting back to the command and control servers, those traffics would be intercepted and will trigger certain DDI rules. To easily identify those detections that are from the internal Virtual Analyzer, Trend Micro recommends:

  • Setting up custom network and configuring a specific port for Virtual Analyzer traffic.
  • Testing the Internet connectivity whenever new settings are saved.

Configuration

To configure a custom network for internal Virtual Analyzer:

  1. On the Management console, go to Administration > Virtual Analyzer > Setup.

    Go to Setup

  2. Tick the Submit files to Virtual Analyzer checkbox then specify another data port, IP, or proxy settings for the Internet connectivity of Virtual Analyzer.

    Tick Submit files to Virtual Analyzer

  3. Click Save.

    Click Save

Premium
Internal
Rating:
Category:
Configure; SPEC
Solution Id:
1118693
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support


To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.