Trellix GTI stores site ratings and reports for Web Control. If you configure Web Control to scan downloaded files, the scanner uses Trellix GTI file reputation to check for suspicious files.
The scanner submits fingerprints of samples, or hashes, to a central database server hosted by Trellix Advanced Research Center to determine if they are malware. By submitting hashes, detection might be available sooner than when Trellix Advanced Research Center publishes the updated content file.
You can configure Endpoint Security to use a proxy server to retrieve Trellix GTI reputation information in the Common settings.
For frequently asked questions about Trellix GTI, see KB53735.