<> Trend Micro Incorporated June 2026 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ TrendAI™ Deep Discovery Director (Consolidated Mode) Version 5.6 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ NOTICE: This Readme file was current as of the date above. However, all customers are advised to check Trend Micro's website for documentation updates. GM release documentation: http://docs.trendmicro.com Patch/SP release documentation: http://www.trendmicro.com/download Contents ================================================================ 1. About Deep Discovery Director 2. What's New 3. Documentation Set 4. System Requirements 5. Installation or Upgrade 6. Post-installation Configuration 7. Known Issues 8. Contact Information 9. About Trend Micro 10. License Agreement ================================================================ 1. About Deep Discovery Director ======================================================================== TrendAI™ Deep Discovery Director is a management solution that enables the following: * Centralized deployment of hotfixes, critical patches, firmware, and Virtual Analyzer images * Configuration replication * Log aggregation * Realtime threat detection monitoring and correlation * Threat intelligence management and sharing To accommodate different organizational and infrastructural requirements, Deep Discovery Director provides flexible deployment. Deep Discovery Director also supports out-of-the-box integration with Deep Discovery Analyzer, Deep Discovery Email Inspector, Deep Discovery Inspector, Deep Discovery Web Inspector, and Deep Discovery Director - Network Analytics. 2. What's New ======================================================================== This product release includes the following new features: Multi Language Support for EUQ digest and EUQ console ----------------------------- Deep Discovery Director now supports EUQ digest content customization and multi-language display for EUQ console and digest notifications. Rebranding ----------------------------- The web console has been updated to reflect the new branding as TrendAI™ Deep Discovery Director. 3. Documentation Set ======================================================================== To download or view electronic versions of the documentation set for this product, go to http://docs.trendmicro.com - Online Help: The Online Help contains an overview of features and key concepts, and information on configuring and maintaining the product. To access the Online Help, go to http://docs.trendmicro.com - Installation Guide (IG): The Installation Guide contains information on requirements and procedures for installing and deploying the product. - Administrator's Guide (AG): The Administrator's Guide contains an overview of features and key concepts, and information on configuring and maintaining the product. - Getting Started Guide (GSG): The Getting Started Guide contains product overview, installation planning, installation and configuration instructions, and basic information intended to get the product 'up and running'. - Support Portal: The Support Portal contains information on troubleshooting and resolving known issues. - To access the Support Portal, go to http://success.trendmicro.com 4. System Requirements ======================================================================== ----------------- Virtual appliance ----------------- Virtual machine with the following minimum specifications: * Hypervisor: VMware vSphere ESXi 7.0 or Microsoft Hyper-V in Windows Server 2016/2019 * Virtual machine hardware version: 17 * Guest operating system: Red Hat Enterprise Linux 9 (64-bit) * Network interface card: 1 with E1000 or VMXNET 3 adapter * SCSI controller: LSI Logic Parallel * CPU: 1.8GHz (at least 2 cores) * Memory: 10GB * Hard disk: 150GB The minimum specifications are for a fresh installation. If you are upgrading from Deep Discovery Director 5.5 or later, you can use your current configuration with Deep Discovery Director 5.6. The minimum specifications are calculated using 30 days of detection log storage for 1 Deep Discovery appliance as basis. The CPU, memory, and hard disk requirements increase with the number of Deep Discovery appliances Deep Discovery Director is expected to aggregate detection logs from. For details, see the Recommended System Requirements topic in Chapter 2 of the Administrator's Guide. ------------------ Management console ------------------ * Google Chrome(TM) 46.0 or later * Mozilla(TM) Firefox(TM) 41.0 or later Recommended resolution: 1280 x 800 or higher 5. Installation ======================================================================== 1. See Chapter 2 of the Administrator's Guide for installation instructions. Important: Deep Discovery Director supports installation under legacy Basic Input/Output System (BIOS). * Changing the setting after installation causes Deep Discovery Director to be unable to boot. * Deep Discovery Director must be reinstalled to change the setting. 2. See the Firmware topic in Chapter 9 of the Administrator's Guide for upgrade instructions. Verify that there is 40GB free disk space before attempting to upgrade to Deep Discovery Director 5.6. Important: Deep Discovery Director 5.6 only supports upgrading from Deep Discovery Directory 5.5. If you have an earlier version, upgrade to 5.5 before upgrading to 5.6. 6. Post-installation Configuration ======================================================================== No post-installation steps are required. 7. Known Issues ======================================================================== Known issues in this release: #1 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director is unable to function correctly if the system is installed with multiple network adapters and if VMXNET is configured as the first adapter. Trend Micro recommends using a single network driver for all network interfaces. #2 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director does not support the VMXNET 2 (Enhanced) network adapter. #3 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Active Directory accounts without a User Principal Name (UPN) cannot be used to access the management console. #4 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director only supports certificates with the following attributes: * The file format is PEM. * The certificate and the private key are in the same file. * The private key uses the RSA algorithm and is not password-encrypted. * The certificate digest uses SHA-256 or higher. A certificate chain is not used. #5 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director is unable to connect to a global NTP server when proxy settings are configured. Use a local NTP server instead. #6 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] The status of plans that were "pending" or "in progress" at the time of a backup, but that have been completed successfully while restoring the backup, may display as "unsuccessful" after the backup is restored and Deep Discovery Director receives plan status updates from appliances. #7 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Microsoft Internet Explorer is unable to connect to Deep Discovery Director because SHA512 is disabled in Windows. Apply the Microsoft Windows update to enable the signature and hash algorithm combination for RSA\SHA512 for the Transport Layer Security (TLS) 1.2 protocol. For details, see https://support.microsoft.com/en-us/kb/2973337. #8 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] The number of results shown on the "Affected Hosts" screen after searching for a specific host name, and the number of results shown on the "Affected Hosts - Host Details" screen after drilling down may differ because drill downs always use the IP address. Host names are not unique, and multiple host names may be associated with one IP address. #9 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Virtual Analyzer image files cannot be uploaded to Deep Discovery Director through shared network folders that are on endpoints that are located in a different subnet than Deep Discovery Director. Ensure that Virtual Analyzer image files are in valid shared network folders, or use SFTP to upload them. #10 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Virtual Analyzer image files cannot be uploaded to Deep Discovery Director through shared network folders that are on endpoints that use IPv6 addresses. Ensure that Virtual Analyzer image files are in valid shared network folders, or use SFTP to upload them. #11 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Firefox users may see an internal error screen if an error occurs when attempting to view the Virtual Analyzer report of a detection. Use another web browser to navigate the management console. #12 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] When a system service has to be restarted to recover from an error, Deep Discovery Director may not be able to recover detection logs that were corrupted. #13 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Folders and appliances cannot be moved in the Directory unless the user's account role has the "Administrator" permission and the root "Managed" folder selected. #14 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Tooltips that appear near the bottom of the screen may blink uncontrollably. #15 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] The file archivers built into Windows and macOS are be unable to extract files with very long file names from archive files generated by Deep Discovery Director. Use third-party archiving software to extract those files. #16 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Archive Utility built into macOS is unable to extract files from archive files generated by Deep Discovery Director. Use third- party archiving software on macOS to extract those files. #17 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Internet Explorer is unable to download archive files generated by Deep Discovery Director. Use another web browser to download those files. #18 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director is unable to restore configuration settings and database from backup files that take longer than 5 minutes to upload. #19 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Network and email security alerts may contain URLs in the body and the attached CSV file. Deep Discovery Director processes all URLs and replaces any "." with "[.]". This is done to prevent accidentally opening malicious URLs and flagging by antivirus programs on a user's computer. #20 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] When you enter two (00) or three (000) digit numbers as keywords to query MTA logs, the results may include entries where the timestamps match the keywords. #21 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director is unable to install a firmware upgrade if free repository disk space is insufficient. Add extra available disk space to Deep Discovery Director before installing firmware upgrades. #22 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] The "File and Network Activity" section of the Deep Discovery Director generated Virtual Analyzer Report for email message detections will look different from the Deep Discovery Email Inspector native Virtual Analyzer Report when the email messages have no-risk attachments. Deep Discovery Email Inspector does not include the information of no-risk items in the logs it sends to Deep Discovery Director. #23 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Opening the PDF version of Virtual Analyzer Reports in a Chrome web browser may cause the hyperlinks in the 'Analysis Overview' section to be not clickable. Use the bookmarks to navigate, or open the PDF file in a PDF reader or another web browser. #24 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director only sends trap messages for the status of the eth0 (management) port, even if multiple network interface cards are installed and port binding is configured. #25 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] When the Deep Discovery Director management console becomes unavailable because the system is powering off, restarting, undergoing maintenance, or other similar reasons, users that were logged on to the EUQ console will not be redirected to temporary status screens. A notification message informing them of the system status will be displayed instead. #26 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery appliances are unable to send their logs to Deep Discovery Director if Deep Discovery Director and its host machine's system time are different. Configure Deep Discovery Director and its host machine to have matching system times and restart Deep Discovery Director to resolve the issue. #27 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] FTP active mode causes the client and server IP addresses to be reversed in the correlation data results. This issue results in Deep Discovery Director - Network Analytics as a Service identifying the wrong IP address as the Interested IP. #28 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] In Deep Discovery Director, you can configure a Synchronized Suspicious Object (VASO) to never expire. However, maximum data retention for Deep Discovery Director - Network Analytics as a Service is 180 days. The report of a VASO that never expires will be deleted after 180 days. Deep Discovery Director displays a report not found error when a user tries to open a report of a VASO that never expires and the VASO has existed for longer than the retention date. #29 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Configuration changes will not be reflected on an existing correlation snapshot. When users want to view correlation events, they click on the "Correlated Data" icon in Deep Discovery Director to trigger the generation of the correlation data. In Deep Discovery Director - Network Analytics as a Service 5.0, a design change was made to save time for users waiting for the dynamic generation of the correlation data. In the design change, the correlation snapshot is generated prior to the user trigger. However, the side effect is that newly added configurations (such as adding the Trusted Internal Network List or Domain Exceptions list) won't be reflected in an already existing correlation snapshot. #30 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director allows you to add objects that you consider harmless to the Exceptions list. Deep Discovery Director - Network Analytics as a Service 5.0 does not consider the Exceptions list when correlating data. #31 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] Deep Discovery Director - Network Analytics as a Service is unable to display the Endpoint Analysis Report status of IPv6 endpoints. Apex Central currently does not support querying IPv6 endpoints for Endpoint Analysis Reports. #32 Known issue: [Reported at: DDD 5.0.0 GM - Patch 1 B2069] When a document is embedded inside a Word document, there are two SHA-1 hash values associated with the file - the SHA-1 hash value of the embedded document and the SHA-1 hash value of the parent document. When Deep Discovery Inspector (ATSE Engine) scans a file with an embedded document, Deep Discovery Inspector only returns the SHA-1 hash value of the parent document. In the Correlation Data screen, the SHA-1 hash value for the embedded document is displayed as zeros. Additionally, the embedded document will not be part of correlations. #33 Known issue: [Reported at: DDD 5.1.0 GM B1198] Deep Discovery Director 5.1 no longer supports SOCKS4/SOCKS5 protocol for proxy. The proxy setting will be disabled if SOCKS4 or SOCKS5 was selected before upgrading to Deep Discovery Director 5.1. Manually enable the proxy setting after upgrading. #34 Known issue: [Reported at: DDD 5.1.0 GM B1198] The number of results shown on the "Email Messages" screen after searching for a specific subject, and the number of results shown in the "Top Email Subjects" section of the Email Security report differ because Deep Discovery Director's search is not case sensitive. #35 Known issue: [Reported at: DDD 5.1.0 GM B1198] When viewing Virtual Analyzer Reports, clicking on a link in the "Notable Threat Characteristics" column of the "MITRE ATT&CK(TM) Framework Tactics and Techniques" section does not take you to the "Notable Threat Characteristics" section if the section is collapsed. Expand the section before clicking on a link in the "Notable Threat Characteristics" column. #36 Known issue: [Reported at: DDD 5.1.0 GM B1198] Deep Discovery Director cannot connect to the Trend Micro Email Encryption Server when a proxy server that uses Digest or NTLM is configured to connect to the Internet. Disable proxy settings or specify a non-Digest/NTLM proxy server to connect to the Internet. #37 Known issue: [Reported at: DDD 5.1.0 GM B1198] When viewing PDF files generated by Deep Discovery Director that contain tables, the header row of a table may be separated from the data rows if the table appears at the bottom of a page. #38 Known issue: [Reported at: DDD 5.1.1 Service Pack 1 B1040] Deep Discovery Director can export user-defined suspicious objects to a comma-, semicolon-, space-, or tab-separated CSV file for offline viewing. Import, however, is only supported from a comma-separated CSV file. Use a spreadsheet program such as Microsoft Excel to convert non-comma-separated CSV files before importing. #39 Known issue: [Reported at: DDD 5.1.1 Service Pack 1 B1040] The number of events displayed on the Triggered Alerts screen may differ from the number of records displayed on the Network Detections or Email Messages screens when drilling down from the Triggered Alerts screen because the related detection logs were not yet synced to Deep Discovery Director when the alert was triggered. #40 Known issue: [Reported at: DDD 5.3.0 GM B1249] After installing the Deep Discovery Director 5.3 Patch 1 package, Deep Discovery Director performs an initial data sync with any previously configured Microsoft Active Directory server. Active Directory accounts may become temporarily unavailable during the initial data sync procedure, with only local accounts able to log in. #41 Known issue: [Reported at: DDD 5.5.0 GM B1571] Deep Discovery Director 5.5 does not support Email Encryption function. Attempts to configure settings fail to update and synchronize with Deep Discovery Email Inspector. 8. Contact Information ======================================================================== A license to Trend Micro software usually includes the right to product updates, pattern file updates, and basic technical support for one (1) year from the date of purchase only. After the first year, you must renew Maintenance on an annual basis at Trend Micro's then-current Maintenance fees. Contact Trend Micro via fax, phone, and email, or visit our website to download evaluation copies of Trend Micro products. https://www.trendmicro.com/en_us/contact.html NOTE: This information is subject to change without notice. 9. About Trend Micro ======================================================================== Smart, simple, security that fits. As a global leader in IT security, Trend Micro develops innovative security solutions that make the world safe for businesses and consumers to exchange digital information. Copyright 2026, Trend Micro Incorporated. All rights reserved. Trend Micro, the t-ball logo, OfficeScan, Trend Micro Security (for Mac), Control Manager, Trend Micro Apex One, and Trend Micro Apex Central are trademarks of Trend Micro Incorporated and are registered in some jurisdictions. All other product or company names may be trademarks or registered trademarks of their respective companies. 10. License Agreement ======================================================================== View information about your license agreement with Trend Micro at: https://www.trendmicro.com/en_us/about/legal.html Third-party licensing agreements can be viewed: - By selecting the "About" option in the application user interface - By referring to the "Legal" page of the Administrator's Guide