Trellix Global Threat Intelligence is a global threat correlation engine and intelligence base of global messaging and communication behavior, which enables the protection of the customers against both known and emerging electronic threats across all threat areas. The communication behavior includes the reputation, volume, and network traffic patterns.
You get complete integration with Trellix Global Threat Intelligence (Trellix GTI) in exchange for sending detailed alert information to Trellix. You can report, filter, and sort hosts involved in attacks based on their network reputation and the country of the attack origin by this integration.
GTI cloud provides comprehensive, real-time, cloud-based threat intelligence services and the Trellix IPS fetches the following intelligence information from the GTI cloud. Trellix GTI has the following components:
- Web reputation — URL and web domain reputation service to protect against web-based threats
- Web categorization — URL and web domain categorization service to take policy-based action on user web activity as well as protect customers against both known and emerging web-based threats
- Network connection reputation or IP reputation — IP address, network port, and communications protocol reputation service to determine granular reputation intelligence for protection against network threats
- File reputation — Comprehensive, real-time, cloud-based file reputation service to protect against both known and emerging malware-based threats
Each of these technologies work together to provide information about the threats and vulnerabilities, which gives GTI the ability to predictively adjust reputations across all threat areas and thereby avoid attacks.