TIE Reputation - When is GTI Reputation updated?

[iverbuyst]

Hello,

We recently installed a McAfee TIE server and noticed in the TIE Reputation that for a lot of entries the GTI Reputation = "Not Available" but when we manually trigger the Refresh GTI Reputation for those entries the GTI Reputation becomes "Known Trusted".

We would expect this to be an automated proces but even entries older the 7 days have this. 

Did we miss something in the configuration oris this normal behaviour?

Best Regards,

Ivan

[Former Member]

Hello @iverbuyst 

Thanks for your post.

I would like to request you to please refer the below KB article:

FAQs for Global Threat Intelligence File Reputation

https://kc.mcafee.com/corporate/index?page=content&id=KB53735

Was my reply helpful?

If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

[iverbuyst]

@Former Member 

FAQ explains what GTI is but not why the GTI Reputation on the TIE Reputation page stays not available until I manually trigger it to refresh the GTI Reputation.

In the TIE Server documentation I've found that "Not Available" means that the GTI was not reachable when TIE tried to retrieve the file reputation.

When we monitor our Firewall we see connection being made from our TIE servers to tieserver.rest.gti.mcafee.com on port 443 so this is also ok. 

[AdithyanT]

Hi @iverbuyst,

Thank you for your post. Yes, you are right, we would need to investigate the part where your GTI connectivity is just fine, however, it does not refresh the status unless you manually do the same. I would recommend creating a Service Request to have this investigated and identify the behavior cause for the same.

[iverbuyst]

Hi @AdithyanT 

We've did some further investigation and noticed that 99% of the files that have a "Not Available" GTI Reputation also have "137 v3 - Identify unsigned DOTNet assemblies that Might Be Trusted" as last applied rule.

So it may be that this rule instructs the TIE no to check GTI, but then it would make more sense that the rule would set the initial GTI Reputation to "Not Set" so that it gets updated during the hourly GTI-Refresh which is not the case when the GTI Reputation is "Not Available".

[AdithyanT · Accepted solution]

Hi@iverbuyst,

That is indeed a very interesting inference. May I request you to kindly please have an SR created with your observation so that we can confirm this from our end as well by checking this with Engineering.

[iverbuyst]

Ok,

We'll submit a SR.

Best Regards,

Ivan