Enable reputation source
You can enable reputation source, such as Trellix GTI, using the policy to check the reputation of binary files before executing them.
To enable or disable Trellix GTI reputation in the unmanaged (standalone) and managed environment, follow these steps:
Unmanaged (standalone) environment
To enable Trellix GTI reputation, run the command:
sadmin features enable gti-reputation.To disable Trellix GTI reputation, run the command:
sadmin features disable gti-reputation.
Managed environment
To enable Trellix GTI reputation:
On the ePO - On-prem console, select Menu → Policy → Policy Catalog.
Select Solidcore 8.x.x → Application Control Options (Unix).
Click My Default policy to edit.
Select the Reputation option.
Trellix GTI Reputation-Based Execution Settings are selected automatically.
Configure the policy as needed and click Save.
To disable Trellix GTI reputation:
On the ePO - On-prem console, select Menu → Policy → Policy Catalog.
Select Solidcore 8.x.x → Application Control Options (Unix).
Select the policy to edit.
Deselect the Reputation option and click Save.
Enabling gti and cctl logs in loglevel
You can enable gti and cctl info and detail logs in loglevel to troubleshoot issues.
Unmanaged (standalone) environment
Run these commands:
sadmin loglevel enable gti info detail
sadmin loglevel enable cctl info detail
Managed environment
On the ePO - On-prem console, select Menu → Systems → System Tree.
Select a system, go to Actions → Agent → Run Client task Now.
Select Solidcore 8.x.x → SC: Run Commands → Create New Task
Enter these commands:
sadmin loglevel enable gti info detailsadmin loglevel enable cctl info detailClickRun Task Now.
Trellix GTI cache
The file reputation is cached locally after the first query to avoid multiple network lookups for the same file. The cache entries are invalidated based on their confidence and associated Time to Live (TTL).
The definition of TTL is based on the performance trade-off. The performance trade-off varies from 1 (low) to 5 (high).
Performance Tradeoff | Unknown reported by Trellix GTI | Clean reported by Trellix GTI | Malicious reported by Trellix GTI |
|---|---|---|---|
1 | 4 hours | 2 days | 5 days |
2 | 8 hours | 2 days | 5 days |
3 | 12 hours | 10 days | 5 days |
4 | 18 hours | 20 days | 5 days |
5 | 1 day | 30 days | 5 days |
Run these commands to set Performance Tradeoff:
sadmin config set "GTIPerformanceTradeoff=1"
sadmin config set "GTIPerformanceTradeoff=2"
sadmin config set "GTIPerformanceTradeoff=3"
sadmin config set "GTIPerformanceTradeoff=4"
sadmin config set "GTIPerformanceTradeoff=5"