With this release of 10.1, Trellix IPS supports URL Reputation for Trellix's Global Threat Intelligence service. You can use this feature to obtain reputation scores for URLs present in the header fields of the HTTP and HTTPS traffic inspected by the Sensor.
The following new monitors are available in the Dashboard tab to view the URL Reputation details:
- Top Risky URLs: You can view the top risky URLs that are accessed from your systems
- Top Endpoints Using Risky URLs: You can view the top endpoint systems that are sending requests to risky URLs.
To enable URL reputation in the Manager, go to Policy → <Admin Domain Name> → Intrusion Prevention → Policy Types → Inspection Options. Double-click on any inspection policy and select Inspection Options → GTI Reputation Services → URL tab. From the URL Reputation Analysis drop-down list, select Inbound only, Outbound only, or Inbound and Outbound.