Private Global Threat Intelligence (pGTI) is a private cloud server utilized by Trellix security platforms. It stores URL and file reputation data for submissions made by these platforms. The reputation score is derived from the analysis conducted by Trellix appliances. pGTI communicates using REST APIs and uses certificates and private key for authentication.
Integrating pGTI with EX allows to:
Fetch verdicts for URL and file submissions from the pGTI server.
Use the the private GTI database to validate submissions.
To enable the pGTI service for your air-gapped environment, you must first upload its security certificates. Please contact the pGTI team to obtain the root certificate, private key, and CA chain specific to your environment.
Note
Certificate access is restricted for Administrator users only and is disabled for Operator users.
Upload the CA Chain certificates to the appliances using the following CLI:
crypto certificate name <cert-name> public-cert pem <pem-string>
Upload the pGTI server certificates to the appliances using the following CLIs:
crypto certificate name <cert-name> public-cert pem <pem-string> crypto certificate name <cert-name> private-key pem <pem-string>
Ensure that the PEM string is correctly formatted as listed below:
Double quotation marks and a new line
Begin delimiter string and a new line
ASCII block and new line
End delimiter string and a new line
Double quotation (" ")
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Store the URL address of the pGTI server using
analysis pgti baseurl <pgti url>
Generate API key for communicating with the PGTI server using the API
analysis pgti apikey certificate <cert_name> ca-list <ca-chain-cert_name>
This command validates the certificates, then generates and stores the API key and certificate name in the configuration.
Note
Upon generation, the API Key will always be in a PENDING state. You must send this API key to the pGTI team for approval.
Enable the EX integration with the pGTI server using
analysis pgti enable
Note
pGTI configuration is allowed only when the EX node is part of a cluster. If the node is detached from the cluster, the pGTI configuration will be automatically removed from that node. If the entire cluster is deleted, the pGTI configuration will also be removed. You must reconfigure pGTI when re-creating the cluster.
Verify the configuration status using
show analysis pgti
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Disable the integration using
no analysis pgti enable
Verify the configuration status using
show analysis pgti
Other CLIs used are:
Delete the URL address of the pGTI server using
no analysis pgti baseurl
Delete the pGTI API key using
no analysis pgti apikey