Private Global Threat Intelligence (pGTI) is a private cloud server utilized by Trellix security platforms. It stores URL and file reputation data for submissions made by these platforms. The reputation score is derived from the analysis conducted by Trellix appliances. pGTI communicates using REST APIs and uses certificates and private key for authentication.
Integrating pGTI with IVX allows to:
Fetch verdicts for URL and file submissions from the pGTI server.
Use the the private GTI database to validate submissions.
You must have Trellix certificates installed on all Intelligent Virtual Execution - Server nodes. Contact Support for more information.
Upload certificates - The root certificate, private key, and CA chain certificates must be uploaded.
Certificate access is restricted for Administrator users only and is disabled for Operator users.
CA Chain certificates:
Upload the CA Chain certificates to the appliances using the following CLI:
crypto certificate name <cert-name> public-cert pem <pem-string>
pGTI server certificates - upload the pGTI server certificates to the appliances using the following CLIs:
crypto certificate name <cert-name> public-cert pem <pem-string> crypto certificate name <cert-name> private-key pem <pem-string>
You must ensure that the PEM string is correctly formatted as listed below:
Double quotation marks and a new line
Begin delimiter string and a new line
ASCII block and new line
End delimiter string and a new line
Double quotation (" ")
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Store the URL address of the pGTI server using
mvx analysis pgti baseurl <pgti url>
Generate API key for communicating with the PGTI server using the API
mvx analysis pgti apikey certificate <cert_name> ca-list <ca-chain-cert_name>
This command validates the certificates, then generates and stores the API key and certificate name in the configuration.
Note
Upon generation, the API Key will always be in a PENDING state. You must send this API key to the PGTI team for approval.
Enable the IVX integration with the pGTI server using
mvx analysis pgti enable
Note
pGTI configuration is allowed only when the VX node is part of a cluster. If the node is detached from the cluster, the pGTI configuration will be automatically removed from that node. If the entire cluster is deleted, the pGTI configuration will also be removed. You must reconfigure pGTI when re-creating the cluster.
Verify the configuration status using
show mvx analysis pgti
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Disable the integration using
no mvx analysis pgti enable
Verify the configuration status using
show mvx analysis pgti
Other CLIs used are:
Delete the URL address of the pGTI server using
no mvx analysis pgti base url
Delete the pGTI API key using
no mvx analysis pgti apikey