For managed systems, you can enable proxy server settings to retrieve Trellix GTI reputation and update DAT for Threat Prevention. You can specify proxy server options in the Common policy settings.
Using the Common Policy settings, you can enable, disable, or configure the proxy settings for Trellix GTI. Once you configure the proxy settings, the Trellix GTI queries are sent to Trellix GTI through the proxy servers you configured. The software supports these proxy settings mechanisms:
With authentication
No authentication
Kerberos authentication
For the systems managed by ePO - On-prem, you can use the Use System Proxy option in the Common policy, and configure the script changes in the managed Linux endpoint's deamon process according to your environment. Once configured, the file ratings are derived from Trellix GTI through the proxy server.
Trellix GTI proxy is not supported on standalone Linux systems. You can't configure proxy settings for Trellix GTI proxy using the command line on standalone Linux systems. But, you can configure the deamon process to get Trellix GTIthrough the proxy server. For more information about configuring the deamon process for your environment, see Configure system proxy authentication on managed Linux endpoints.
For DAT update, the proxy in standalone machines can be set using this command-line:
/opt/McAfee/ens/tp/bin/mfetpcli --addproxy --type http --url "http://sampleproxy.url" --port 5678 --username "username" --password "password"
The Common Policy proxy settings provide three options:
No proxy server — Threat Prevention directly sends the request to the Trellix GTI server. For managed systems, this is the default option selected in the Common Policy settings. For standalone systems, the software always works in this mode.
User system proxy settings — Threat Prevention uses the proxy server settings configured in the managed Linux system. You must configure the managed Linux system with the proxy server settings, then enforce the policy from ePO - On-prem. Use the Enable HTTP proxy authentication option when the credentials of the proxy server are not defined in the managed Linux system.
Configure proxy server — Threat Prevention uses the proxy server settings such as IP address and credentials you define in the Common Policy.
HTTP address (must be DNS, IPv4, or IPv6) — Specifies the IP address of the proxy server.
Important
When you specify the IPv6 address, you must specify it with square brackets. For example,
http://[0000:0000:0000:0::00]: <port_number>. Otherwise, the IPv6 doesn’t work.Port — Specifies the port number. The default port number is 3128.
Exclude these addresses — Excludes the addresses specified in this list.
Enable proxy authentications — Enables proxy authentications for your managed Linux systems.
User name — Specifies the user name.
Password — Specifies the password.
Confirm Password — Confirms the password.