Integrating with Global Threat Intelligence (GTI)

The Integration of NDR with the Global Threat Intelligence (GTI) server provides enhanced capabilities to determine the reputation of files using their MD5 hash/URL reputation. By leveraging GTI’s threat intelligence, NDR can quickly determine the potential risk caused by files entering or operating within the network. This integration allows NDR to generate alerts when files with a malicious reputation are detected in Packet Capture, Network Security, and IPS FileInfo events.

Note
Make sure that the NDR license is installed and available on NDR before enabling GTI.

Configuring GTI using CLI

Perform the following steps toconfigure GTI:

Log into the NDR CLI using a terminal window or SSH client:
1. Using the SSH protocol, log into the appliance with management interface's IP address or hostname.
```
$ ssh npadmin@<NDR IP address>
```
2. Enter the password when prompted. The hostname > prompt is displayed after you have logged in.
Enter privileged mode on the NDR CLI.
```
npadmin@hostname> enable
```
Enter the npadmin password, when prompted. The password can be 5 to 24 characters long.
```
[sudo] password for npadmin: <password>
```
Enter configuration mode.
```
npadmin@hostname# configure system
```
The prompt changes to npadmin@hostname(config)# on the terminal indicating that configuration mode is enabled. You can now proceed with the GTI configuration task.
Type gti at the terminal and press Enter.
The Configure Global Threat Intelligence (GTI) configuration options are displayed on the terminal. By default, the GTI server is disabled.
Type T to test the GTI server connection. A success message is displayed if the connection is successful.
Type E in the Enter your choice field and then press Enter to enable GTI server. The status changes to Enable.
Type Q and press Enter to save the changes and exit from the GTI configuration task.
Type C and press Enter to cancel and exit from all the configurations.