How Trellix IPS -GTI integration for IP Reputation works

The Manager integrates with the GTI IP Reputation to obtain the reputation scores on hosts and geo-locations that are displayed in Attack Log.

The Sensor requests reputation for hosts from GTI. The reputation score acts as an important factor in determining whether to block the host. The scores are cached for one hour. After an hour, the information ages out and if the information is required again, the Sensor makes the GTI request again.

Reputation scores:

After a High Risk External IP host is found, the traffic from that host can be blocked or the host itself can be quarantined.

The Sensor does not request reputation scores for hosts that have internal IP addresses. The following private IP address blocks are considered as internal IP addresses by the Sensor: