Trellix appliances can download software updates (such as security content, system images, and guest images) from the Trellix Dynamic Threat Intelligence (DTI) network. With a two-way content license, the appliance can also upload threat intelligence information to the DTI network. The Central Management System appliance and standalone appliances have a direct connection to the DTI network. By default:
Helix Enterprise appliances managed by the cloud Central Management System appliance by default receive software updates from the Content Delivery Network (CDN).
Helix Enterprise appliances managed by an on-premises Central Management System appliance by default receive software updates from the DTI network through the Central Management System appliance.
If non-Helix Enterprise appliances are managed by the cloud Central Management System appliance, the DTI source needs to be changed from "CMS" to "CDN," as described in Configuring CDN as the DTI source.
Note
See the Trellix Device Deployment Guide for management path requirements, including information about environments that restrict outbound access to certain IP addresses, and domain-based Proxy ACL rules.