- Home
- Malware Analysis Sandboxes
- Trellix Intelligent Sandbox
Trellix Intelligent Sandbox
San Jose, California, United States
What it is
Trellix Intelligent Sandbox analyzes files and URLs to detect advanced, evasive malware and turn findings into protective action. Its methods combine signatures, reputation, real-time emulation, sandbox behavior analysis, static code analysis, and machine learning. Unpacking removes obfuscation so executable code can receive deeper static analysis. Reports may include MITRE ATT&CK mapping, disassembly, memory dumps, function call diagrams, API logs, PCAP data, and threat timelines. Integrations include Trellix products, third-party email gateways, Zeek Network Security Monitor, and STIX/TAXII sharing standards. Trellix Data Exchange Layer and REST APIs support integrations. Deployment is available as an on-premises appliance or virtual form factor, with private and public cloud support and Azure Marketplace availability. Supported samples include PE, Adobe, Microsoft Office, images, archives, Java, Android packages, and URLs. Trellix lists Advanced Threat Defense 5.2.X with an end-of-life date of June 30, 2026. Pricing is on request.
For and against
For
- Combines multiple malware analysis methods
- Unpacks obfuscated executable code
- Produces detailed investigation reports
- Supports on-premises and cloud deployment
- Accepts varied file and URL samples
Against
- Pricing is available only on request
- Advanced Threat Defense 5.2.X reaches end of life June 30, 2026
- Virtual deployment lists specific older hypervisor versions
The verdict
Trellix Intelligent Sandbox provides layered analysis and detailed evidence for security investigations. Buyers should account for the listed product lifecycle date and deployment requirements.
Who it suits
It suits SOC and security teams needing configurable malware analysis, threat reporting, URL analysis, and integration APIs.
Plans and prices
Trellix Intelligent Sandbox
Pricing not stated; request a demo
Read 5 Oct 2026 · trellix.com
On the record
- Analysis
- Combines signatures, reputation, real-time emulation, sandbox behavior analysis, static code analysis, and machine learning.trellix.com · read 5 Oct 2026
- APIs
- The product supports Trellix Data Exchange Layer and REST APIs for product and threat-sharing integrations.trellix.com · read 5 Oct 2026
- Buyer fit
- The datasheet describes SOC investigation features, configurable analysis environments, and analyst-interactive malware analysis.trellix.com · read 5 Oct 2026
- Deployment
- It is available as an on-premises appliance or virtual form factor, with private and public cloud support and Azure Marketplace availability.trellix.com · read 5 Oct 2026
- Integrations
- Listed integrations include Trellix products, third-party email gateways, Zeek Network Security Monitor, and STIX/TAXII threat-sharing standards.trellix.com · read 5 Oct 2026
- Lifecycle
- Trellix lists Advanced Threat Defense 5.2.X with an end-of-life date of June 30, 2026.trellix.com · read 5 Oct 2026
- Purpose
- Detects advanced, evasive malware and turns threat information into action and protection.trellix.com · read 5 Oct 2026
- Reports
- Detailed reports can include MITRE ATT&CK mapping, disassembly, memory dumps, function call diagrams, API logs, PCAP data, and threat timelines.trellix.com · read 5 Oct 2026
- Specifications
- The datasheet lists physical ATD-3200 and ATD-6200 appliances and virtual deployment on ESXi 5.5–6.7 or Hyper-V with Windows Server 2012 R2 or 2016.trellix.com · read 5 Oct 2026
- Supported samples
- The datasheet lists PE, Adobe, Microsoft Office, image, archive, Java, Android package, and URL samples.trellix.com · read 5 Oct 2026
- Unpacking
- Its unpacking capabilities remove obfuscation to expose executable code for deeper static analysis.trellix.com · read 5 Oct 2026
