Intelligent Sandbox (formerly Advanced Threat Defense) tries to access the skyhigh.cloud domain for DAT updates

Technical Articles ID: KB95799
Last Modified: 2023-02-24 10:33:08 Etc/GMT

Environment

Trellix Intelligent Sandbox (TIS) 5.0
Advanced Threat Defense (ATD) 4.x

Problem

IS, formerly known as ATD, is designed to access the tau.mcafee.com domain for DAT and Engine updates. But, update infrastructure redirects the access under the skyhigh.cloud domain, as listed in KB65496 - Secure Web Gateway download servers.

Cause

Trellix/Skyhigh Security maintains update infrastructure for backward compatibility to cover products that are hard coded to use McAfee Enterprise infrastructure. ATD/IS is one such product, and accesses tau.mcafee.com for DAT and Engine updates.

The tau.mcafee.com advertises the URL of the second-stage download servers, which distributes the contents of the DAT and Engine per geolocation information of the client, with FQDNs within the skyhigh.cloud domain.

Solution

Configure your firewall and web proxy to allow ATD/IS to access the following update servers:

tau.mcafee.com (primary update server)
All servers under the skyhigh.cloud domain, as listed in KB65496 Secure Web Gateway download servers

NOTE: ATD/IS uses the same update servers as Secure Web Gateway for DAT and Engine updates.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Intelligent Sandbox (formerly Advanced Threat Defense) tries to access the skyhigh.cloud domain for DAT updates

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Intelligent Sandbox (formerly Advanced Threat Defense) tries to access the skyhigh.cloud domain for DAT updates

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title