Here are answers to frequently asked questions.
Firewall Options settings in the Trellix GTI Network Reputation section enable you to block incoming and outgoing traffic from a network connection based on Trellix GTI reputation.
- What is Trellix GTI?
Trellix GTI is a global Internet reputation intelligence system that determines what is good and bad behavior on the Internet. Trellix GTI uses real-time analysis of worldwide behavioral and sending patterns for email, web activity, malware, and system-to-system behavior. Using data obtained from the analysis, Trellix GTI dynamically calculates reputation scores that represent the level of risk to your network when you visit a webpage. The result is a database of reputation scores for IP addresses, domains, specific messages, URLs, and images. For frequently asked questions about Trellix GTI, see KB53735.
- How does Trellix GTI work with Firewall?
- What do you mean by "reputation"?
For each IP address on the Internet, Trellix GTI calculates a reputation value. Trellix GTI bases the value on sending or hosting behavior and various environmental data collected from customers and partners about the state of Internet threat landscape. The reputation is expressed in four classes, based on our analysis:
Do not block (minimal risk) — This is a legitimate source or destination of content/traffic.
High Risk — This source/destination sends or hosts potentially malicious content/traffic that Trellix considers risky.
Medium Risk — This source/destination shows behavior that Trellix considers suspicious. Any content/traffic from the site requires special scrutiny.
Unverified — This site appears to be a legitimate source or destination of content/traffic, but also displays properties suggesting that further inspection is needed.
- Does Trellix GTI introduce latency? How much?
When Trellix GTI is contacted to do a reputation lookup, some latency is inevitable. Trellix does everything possible to minimize this latency. Trellix GTI:
Checks reputations only when the options are selected.
Uses an intelligent caching architecture. In normal network usage patterns, the cache resolves most wanted connections without a live reputation query.
- If Firewall can't reach the Trellix GTI servers, does traffic stop?
If Trellix GTI is not reachable, you can configure Firewall to either block all traffic by default or allow traffic unless firewall rules specifically block it.