As part of this release, we are introducing a new feature that directly polls malicious verdicts from the IVX On-prem server. TIE will poll and store these malicious verdicts, making them available for all TIE consumers. If the malicious data is already in TIE, Trellix Endpoint Security (ENS) will retrieve it, so there will be no need to send it to IVX for sandboxing. TIE will retrieve verdicts for samples that have been submitted via API. This applies to samples that have been successfully processed in IVX server, if the relevant file type is enabled and if the TIE server does not already have a IVX reputation for the sample.
The new server task ‘TIE Server Poll Malicious Verdicts from IVX Server’ is created to configure this feature. Initially this server task will be disabled by default. If the user needs to use this feature, enable the server task as follows.
In ePO - On-prem, select Menu → Automation → Server Tasks → TIE Server Poll Malicious Verdicts from IVX Server, then click Edit to modify the task configuration.
To edit the task, on the Schedule tab, configure how often and when you want to run the task. Click Next to continue.
On the Summary tab, verify the configuration is correct.
Click Save.