Issue: ATD fails to create VM profiles of the Windows 10 1909 where the build number is for example:

18363.1016
18363.900

Cause: We validated Windows 10 1909 build 18363.418 through 18363.778 as supported in ATD 4.10. The maximum supported build for Windows 10 1909 is 18363.778. The recent Windows 10 1909 builds, such as 18363.900 and 18363.1016, have additions that aren't yet supported by ATD. If you try to create a VM profile of Windows 10 1909 with one of these unsupported builds, it fails.

Workaround: Use Windows 10 1909 with a build number between 18363.418 and 18363.778 inclusive, for your VM profile.

Issue: If an application error occurs during sandbox analysis, the sample doesn't run correctly and you don't get the expected verdict. An example application error is that Acrobat Reader crashes. Examples of why the error occurs is improper installation, missing application dependencies, or security hardening settings.

Solution:

Issue: You can't apply the 4.8.0.17 Detection package to ATD through the manager manually (Manage, Image & Software, Content Update, Detection Pkg, Browse).

Solution: ATD 4.8.2 resolves this issue.

Workaround: Use the Auto Upload option or perform the upgrade using the CLI:
From the ATD Manager, perform the steps below:

From the CLI, perform the steps below:

Issue: Many email reports show attachments as unverified severity, and overall email verdict as -3: scan timeout.

Cause: Currently, the ATD Email Connector supports only one mail per SMTP session. When you configure more than one mail per session, it might result in mails being timed out.

Workaround: Configure your sender MTA as shown below for delivering emails to the ATD Email Connector:

IMPORTANT: We strongly recommend that you view the related article for more information.

Issue: There's incorrect documentation in the "Prerequisites and considerations" section in Chapter 7 of the ATD product guide. The first bullet in the "Prerequisites and considerations" section is incorrect.

Original description:
"You must use the eth-0 interfaces (management ports) of the Advanced Threat Defense Appliances for cluster communication. Also, for best performance, the eth-0 interfaces of all nodes must be in the same layer-2 network of the OSI reference model."

Correct description:
"You must use the eth-0 interfaces (management ports) of the Advanced Threat Defense Appliances for cluster communication.

NOTE: The eth-0 interfaces of all nodes must be in the same layer-2 network of the OSI reference model. This requirement is for better performance and to avoid network latency."

Solution: The ATD 4.8 product guide provides the correct information. The ATD 4.6 product guide has also been updated on the Product Documentation site.

Issue: The ATD cluster status becomes unstable. The Active director role flaps between a primary node and backup node.

Solution:

Issue: You see that the DXL status is DOWN after you migrate to ATD 4.2.

Solution: ​

Issue: You can't use the following IP subnet range addresses for ATD 4.0 network interfaces:

Solution: Don't use these subnets for ATD 4.0 network interfaces. This solution applies to both the physical and virtual ATD appliances.

NOTE: ATD is shipped with internal subnets for VMs (192.168.55.0/24 and 191.168.122.0/24 networks). ATD is shipped with a static routing table for these internal subnets. So, when you add ATD to your network, you must also add those subnets to your network. If your network already has the same subnet, you see a routing issue between ATD and your existing 192.168.55.0/24 and 191.168.122.0/24 networks.

Issue: After you upgrade to vATD 4.0.2.42, you can no longer connect to DXL.

Solution:

Issue: When you add a Gen3 model (ATD-3200, ATD-6200) node as a backup or secondary node to a hybrid ATD cluster with the Gen1/Gen2 hardware model (ATD-3000, ATD-6000, ATD-3100, ATD-6100) as a primary node, you see the error below:
 

Issue: You see different sandbox severity scan results against the same file over a period. You see different results when you scan the sample on different ATD nodes, or when you use a different VM profile.

Solution:

Issue: You access the ATD manager using only the host name. Sample submission using the REST channel or manager fails or times out with the error 401.
 

Workaround: Access the manager using either the FQDN or IP address.

Issue: You send an email and it's not delivered. You then see that there's no conversation log for this email.
 

Workaround: You must clear the cache from the Troubleshooting page in the ATD manager and resubmit the mail. You can then see the conversation log.

Issue: When you update to version 4.2.0.22: atd-application-img-4.2.0.22-4.2.0.x86_64.rpm, you see a pop-up message display the following notification:
 

Unknown error occurred, may be communication error during update.
 

Solution: This issue isn't an update failure. It occurs because the manager connection times out. You're advised to log back on to the ATD manager after a short time of 2–3 minutes. You then see that the update is successfully applied.

Issue: The serial console stops working after you upgrade to ATD 4.0.x.

Solution: Upgrade to ATD 4.2.0.

Workaround: Add the following line at the end of the file /opt/amas/scripts/atd.local before exit:

Issue: Validation fails for German operating systems. You see the following error:
 

You then see the following error:
 

 
Workaround: Ignore these error messages and continue with VM creation. You see the Host verification PASS report and creation work.