Press CTRL+K to open search

Changing the active setting for a DTI service

  • Published on Aug 24, 2026
  • 8 minute(s) read
Prev Next

Appliances send requests for DTI services to the following servers:

  • Dynamic Threat Intelligence (DTI)—The Trellix DTI server. The DTI server addresses follow:

    • staticcloud.fireeye.com (Download source and virtual service)

    • up-staticcloud.fireeye.com (Upload destination)

    • mil-staticcloud.fireeye.com (MIL service)

    • unity.fireeye.com (FAUDE and AV-Suite services)

    • Helix full URL (Helix service)

  • Content Delivery Network (CDN)—A content delivery network server. The server address is cloud.fireeye.com or download.fireeye.com.

  • The Central Management System appliance (CMS)—Available only to managed appliances. The address is the Central Management System address.

  • A custom DTI server, if configured—A custom DTI server used only for managed appliances in a Network Address Translation (NAT) deployment in which the appliance uses the non-default dual-port address type to communicate with the Central Management System appliance, and an accessible address needs to be configured for the Central Management System appliance. A custom DTI server is also used in a cache proxy deployment. The address is the accessible Central Management System address. For details, see Configuring and activating an accessible DTI server address .

Each appliance has an active setting and available options for each DTI service. By default, CMS is the active setting for all DTI services on managed appliances. This is the default global setting, which means all appliances that are managed by the Central Management System appliance use this setting. You can change the global setting on the Central Management System appliance, and you can override the global setting for individual managed appliances.

You can also change the active download source setting for standalone appliances and the Central Management System appliance.

Reasons for changing the active setting for a DTI service include:

  • More effective detection and remediation. Trellix recommends a direct connection to unity.fireeye.com to prevent FAUDE and AV-Suite service timeouts and errors.

  • Cache proxy. When implementing a cache proxy deployment, the proxy server must be configured as a custom DTI source. For details, see Configuring the appliance as a cache proxy for DTI updates .

  • Faster download speed. A CDN server is typically geographically closer to standalone appliances than the Trellix DTI server. The DTI or CDN server could be closer to managed appliances than the Central Management System appliance.

  • Decentralization —You can limit the amount of traffic passing through the Central Management System appliance when requests for one or more DTI services go directly to the DTI network.

  • Security. Your security policies could require you to download the software updates directly from the Trellix DTI server.

  • HTTP proxy. You can use an HTTP proxy as an intermediary between an appliance and the DTI network. In this scenario, managed appliances using the single-port address type must use DTI. Managed appliances using the dual-port address type can use either CMS or DTI. For details, see Using an HTTP proxy for DTI service requests.

  • Network address translation. When the Central Management System appliance is behind a NAT gateway, an accessible IP address that the managed appliances can reach could need to be configured as a custom DTI source. For details, see Configuring and activating an accessible DTI server address .

Prerequisites

  • Admin access.

  • Appliances are in "online" mode and connected to the DTI network, or in "proxy" mode and connected to a Central Management System appliance that is acting as a cache proxy for DTI updates.

Changing the active source for a standalone appliance using the Web UI

Use the DTI Network Settings page to change the active DTI source setting for a standalone appliance.

nonCM_DTINetworkStandalone_scap.PNG
To change the active source setting:

  1. Click the Settings tab.

  2. Click DTI Network in the sidebar.

  3. In the Content Source list, select the DTI source the appliance will use for software updates.

  4. Click Apply Settings.

Changing the active source for a managed appliance using the Web UI

Use the DTI Network Settings page to change the active DTI source setting on a managed appliance.

nonCM_DTINetworkManaged2_scap.PNG
To change the active source setting:

  1. Select Settings > DTI Network.

  2. Clear the Obtain Settings from CM checkbox, if it is selected.

  3. In the Content Source list, select the new DTI source.

  4. Click Apply Settings.

Changing the active settings for DTI services using the CLI

Use the commands in this section to change the active source setting on a standalone appliance or to change the active setting for any DTI service on a managed appliance.

Changing the active source on a standalone appliance
To change the active source setting:

  1. Go to CLI configuration mode:

    hostname > enable

    hostname # configure terminal

  2. View the current active and available DTI sources:

    hostname (config) # show fenet dti configuration

  3. Change the active download source:

    hostname (config) # fenet dti source default {CDN | DTI}

  4. Verify your change:

    hostname (config) # show fenet dti configuration

  5. Save your change:

    hostname (config) # write memory

Changing the active settings for DTI services on a managed appliance

If the Central Management System appliance controls the active setting for a DTI service, you must move control to the managed appliance before you change the setting. Otherwise, the Central Management System appliance will maintain control and use the setting it uses for managed appliances.

To change the active setting:

  1. Go to CLI configuration mode:

    hostname > enable

    hostname # configure terminal

  2. View the current active and available DTI servers:

    hostname (config) # show fenet dti configuration

  3. If the ACTIVE SETTINGS value includes Managed by CMS, move control of the setting to the managed appliance:

    • To move control of the download source setting:

      hostname (config) # no fenet dti source override enable

    • To move control of the upload destination setting:

      hostname (config) # no fenet dti upload destination override enable

    • To move control of the mil, faude, avsuite, helix, or virtual service setting:

      hostname (config) # no fenet dti <service> service override enable

  4. Change the setting:

    • To change the download source setting:

      hostname (config) # fenet dti source default {CDN | DTI | CMS}

    • To change the upload destination setting:

      hostname (config) # fenet dti upload destination default {DTI | CMS}

    • To change the mil, faude, avsuite, helix, or virtual service setting:

      hostname (config) # fenet dti <service> service default {DTI | CMS}

  5. Verify your changes:

    hostname (config) # show fenet dti configuration

  6. Save your changes:

    hostname (config) # write memory

Note

To move control of the active setting for a DTI service back to the Central Management System appliance, use the following commands:

  • fenet dti source override enable

  • fenet dti upload destination override enable

  • fenet dti <service> service override enable

Examples

In this example, the active download source on a standalone appliance is changed from DTI to CDN.

hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:

     Mode               :  online
     Download source    :  DTI (DTIUser@staticcloud.fireeye.com)
     ...
 
  AVAILABLE OPTIONS:
  --------------------------------------------------------------
  Download    User                     Address
  --------------------------------------------------------------
  CDN         DTIUser                  cloud.fireeye.com  
  DTI         DTIUser                  staticcloud.fireeye.com
  ... 
  --------------------------------------------------------------
hostname (config) # fenet dti source default CDN
hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
     Mode               :  online
     Download source    :  CDN (DTIUser@cloud.fireeye.com) 
     ...

In this example, the active download source on a managed appliance is changed from CMS to DTI.

hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:

     Mode               :  online
     Download source    :  CMS (DTIUser@10.2.3.4) - Managed by CMS
     Upload destination :  CMS (DTIUser@10.2.3.4) - Managed by CMS
     ...

hostname (config) # no fenet dti source override enable
hostname (config) # fenet dti source default DTI
hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:
  
  ACTIVE SETTINGS:

    Mode               : online
    Download source    : DTI (DTIUser@staticloud.fireeye.com) - Managed by Appliance
    Upload destination : CMS (DTIUser@10.2.3.4) - Managed by CMS
    ...
Changing global active DTI settings for managed appliances using the CLI

Use the commands in this section to change global active DTI settings for the appliances that are managed by a Central Management System appliance.

To change global active DTI settings:

  1. Go to CLI configuration mode:

    hostname > enable
hostname # configure terminal

  2. View the current active and available DTI sources.

    hostname (config) # show fenet dti configuration

  3. To change the active global source setting:

    1. Specify the active setting:

      hostname (config) # fenet dti source managed {DTI | CDN | CMS}

    2. Apply the setting to all managed appliances:

      hostname (config) # fenet dti source managed-sync

  4. To change the active global upload destination setting:

    1. Specify the active setting:

      hostname (config) # fenet dti upload destination managed {DTI | CMS}

    2. Apply the setting to all managed appliances:

      hostname (config) # fenet dti upload destination managed-sync

  5. To change the active global setting for the mil, faude, avsuite, helix, or virtual service:

    1. Specify the active setting:

      hostname (config) # fenet dti <service> service managed {DTI | CMS}

    2. Apply the setting to all managed appliances:

      hostname (config) # fenet dti <service> service managed-sync

  6. Verify your changes:

    hostname (config) # show fenet dti configuration

  7. Save your changes:

    hostname (config) # write memory

Examples

In this example, the active setting for the download source is changed to DTI for the appliances that are managed by this Central Management System appliance.

hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
     Mode               :  online
     Download source    :  CDN (DTIUser@cloud.fireeye.com)
     Upload destination :  DTI (DTIUser@up-staticcloud.fireeye.com)
     ...
  ACTIVE SETTINGS FOR MANAGED APPLIANCES:
     Download source    :  CMS
     Upload destination :  CMS
     ...
 
  AVAILABLE OPTIONS:
  --------------------------------------------------------------
  Download    User                     Address
  --------------------------------------------------------------
  CDN         DTIUser                  cloud.fireeye.com
  CMS         DTIUser                  10.2.3.4  
  DTI         DTIUser                  staticcloud.fireeye.com 
  --------------------------------------------------------------
  ...
 
hostname (config) # fenet dti source managed DTI
hostname (config) # fenet dti source managed-sync
hostname (config) # show fenet dti configuration

DTI CLIENT CONFIGURATIONS:

  ACTIVE SETTINGS:
     Mode               :  online
     Download source    :  CDN (DTIUser@cloud.fireeye.com) 
     Upload destination :  DTI (DTIUser@up-staticcloud.fireeye.com)  
     ...     
   
  ACTIVE SETTINGS FOR MANAGED APPLIANCES:     
     Download source    :  DTI
     Upload destination :  CMS
     ...
Related articles
Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
Products
Company
Top Features
Solutions
Existing Users
Connect With Us
Sales and Support
Copyright © Abc Inc. All Rights Reserved