The Sensor integrates with Trellix GTI server to obtain real-time reputation ratings for IP addresses. The ratings obtained from IP Reputation for an IP address are used to drop or quarantine traffic from the host based on the configuration. The reputation score indicates the risk level.
When IP Reputation is enabled, the Sensor uses the reputation of the source host as an additional factor for blocking, which in turn enhances SmartBlocking.
Note
Reputation is determined using a combination of IP address and port. The same IP address might therefore have a different reputation depending on the port currently in use.
Refer to Trellix Intrusion Prevention System Integration Guide for more details.