McAfee Advanced Threat Defense
Advanced detection for stealthy, zero-day malware

Features & Benefits:

Ensure more accurate threat detection
Reduce the chances of missed malware or false positives. McAfee Advanced Threat Defense uses advanced static code and dynamic analysis (sandboxing) to provide the most detailed assessment and data on malware classification. Stealthy malware and zero-day threats are packed or obfuscated to evade detection. Advanced Threat Defense employs strong unpacking to break through evasive techniques, enabling thorough analysis and accurate classification. With broad operating system support, threats are analyzed under the same conditions as the actual host profile, so you catch more malware with fewer false alerts.

Respond to threats faster
Quickly and seamlessly move from advanced malware analysis and conviction to protection and resolution — a more comprehensive, efficient approach to the malware problem. Down selection — first using a mix of signatures, reputation, and real-time emulation — helps quickly identify a broad range of malware, producing fast detection results and reducing the number of files requiring more thorough sandbox analysis.

Lower TCO
Centralized deployment enables multiple McAfee network devices to share the same malware analysis appliance, reducing the number of required appliances, simplifying administration, and cost-effectively scaling security across your network. Advanced Threat Defense can leverage your existing McAfee security solutions, reducing the need for network rearchitecture and minimizing operational costs.

Leverage a single security vendor with tight product integration
McAfee offers all essential components to find advanced malware, freeze the threat, and initiate a fix. Offering an end-to-end solution that integrates advanced threat analysis, network products, and endpoint solutions, McAfee provides organization-wide visibility and context for threats, while reducing response time and simplifying remediation.

McAfee Advanced Threat Defense: Find Advanced Malware

McAfee Advanced Threat Defense detects today’s stealthy, zero-day malware with an innovative, layered approach. It combines low-touch antivirus signatures, reputation, and real-time emulation defenses with in-depth static code and dynamic analysis (sandboxing) to analyze actual behavior. Combined, this represents the strongest advanced malware security protection in the market and effectively balances the need for both protection and performance.

While lower analytical intensity methods such as signatures and real-time emulation benefit performance, the addition of full static code analysis to sandboxing provides detailed malware classification information and broadens protection against highly camouflaged, evasive threats and allows identification of associated malware leveraging code re-use. Delayed or contingent execution paths, often not executed in a dynamic environment, can be detected through unpacking and full static code analysis.

While lower analytical intensity methods such as signatures and real-time emulation benefit performance, the addition of full static code analysis to sandboxing provides detailed malware classification information and broadens protection against highly camouflaged, evasive threats and allows identification of associated malware leveraging code re-use. Delayed or contingent execution paths, often not executed in a dynamic environment, can be detected through unpacking and full static code analysis.

Since advanced and targeted attacks are often designed to evade detection when sandboxing is attempted, McAfee Advanced Threat Defense includes comprehensive techniques to ensure the most code execution possible during dynamic analysis.

Together, static code and dynamic analysis provide a complete evaluation and detailed information such as behavior summary, malware severity, malware family associations, execution paths, and percentage of code executed during dynamic analysis.

Target-specific sandboxing increases detection accuracy

McAfee further advances find capabilities by giving administrators the ability to upload and analyze objects through a collection of custom virtual machines or gold images. This enables organizations to analyze threats under the conditions of the actual host profile within the organization, rather than a generic image, providing a more accurate risk assessment.

McAfee further advances find capabilities by giving administrators the ability to upload and analyze objects through a collection of custom virtual machines or gold images. This enables organizations to analyze threats under the conditions of the actual host profile within the organization, rather than a generic image, providing a more accurate risk assessment.

Freeze the threat

Finding advanced malware is important. But if that is all a solution can do—provide a report on advanced malware that has already infected an organization—administrators are left with massive amounts of work and the network is still unprotected.

Tight integration between McAfee Advanced Threat Defense and network security devices, such as McAfee Network Security Platform, McAfee Email Gateway, or McAfee Web Gateway, enables immediate action when McAfee Advanced Threat Defense convicts a file as malicious. This tight and automated integration between find and freeze is critical.

McAfee network security solutions immediately block any other copies of this file coming into the network, without the need to send it on for further analysis. In addition, McAfee Network Security Platform can quarantine an infected host, preventing the spread of malicious activity in the network.

Initiate fix: From a single host to an entire network of machines

To fix an attack, coordination with endpoint solutions to remediate any damage done to the host is needed. Due to the stealthy nature of advanced malware, administrators must be able to look across all endpoints, assess where similar damage occurred, and take action. This is not simply searching for a specific malicious file (for example, file search across all endpoints). Looking for specific changes (for example, DLL or configuration changes) done to the host is also necessary to ensure you really fix the problem. After all, good malware does its best to hide its tracks.

Initiate fix with McAfee Real Time

From a central console, administrators can fix discovered issues related to malware found by McAfee Advanced Threat Defense within seconds. Immediate corrective action can be taken on all (or a subset) of the endpoints by simply clicking a button to target action to those machines. Corrective action can include:

• Kill the application or process.
• Delete/Modify/Create registry keys.
• Delete/Modify/Create file and/or directory.

Deployment

McAfee Advanced Threat Defense can be deployed either as a stand-alone malware appliance or one that seamlessly fits into your existing McAfee network security investment (McAfee Network Security Platform, McAfee Email Gateway, or McAfee Web Gateway). Files are sent directly from an existing network security device to McAfee Advanced Threat Defense, which is deployed as a proxy in the network. McAfee Advanced Threat Defense acts as a shared resource between multiple McAfee network devices, cost-effectively scaling across the network.

System Requirements:

McAfee Advanced Threat Defense is a self-contained device. There are no minimum software or hardware system requirements.

Appliance Hardware Components	ATD-6000	ATD-3000
Dimensions	2RU Rack Mountable 17.24"W x 3.43"H x 28"L	1RU Rack Mountable 17.25"W x 1.70"H x 29"L
Weight	50 lbs.	33 lbs.
Storage	Disk space HDD: 4 x 4TB SSD: 2 x 800 GB	Disk space HDD: 2 x 4TB SSD: 2 x 400 GB
Maximum Power Consumption	2x 1,600W	2x 750W
Redundant Power Supply	AC redundant, hot swappable
AC Voltage	100-240 V at 50–60Hz and 8.5 Amps	100-240 V at 50–60Hz and 5.8 Amps
Temperature	+10° to +35° C (operating) -40° to +70° C (non-operating)
Relative Humidity (Non-Condensing)	Operational: 10% to 90%; Non-operational: 50% to 90%
Altitude	0–10,000 feet
Safety Certification	UL 1950, CSA-C22.2 No. 950, EN-60950, IEC 950, EN 60825, 21CFR1040 CB license and report covering all national country deviations
EMI Certification	FCC Part 15, Class A (CFR 47) (USA), ICES-003 Class A

Documentation:

Download the McAfee Advanced Threat Defense Datasheet (PDF).