cancel
Showing results for 
Search instead for 
Did you mean: 

GTI Refresh for Not Set files

How often is a GTI reputation refresh is being fired on the TIE server for files that once has been introduced in the TIE DB, but had no reputation in the GTI, and has been introduced to the GTI using GetClean?

We need to refresh GTI reputation manually for files in the TIE, that hasn't returned the reputation for earlier queries, and has been delivered with the GetClean for analysis and marked Known Trusted at the end in the GTI. A manual refresh works, but why should we do it manually?

Labels (2)
7 Replies
McAfee Employee aguevara
McAfee Employee
Report Inappropriate Content
Message 2 of 8

Re: GTI Refresh for Not Set files

HI pavelekg

Please take a look at the below article:

How to change the GTI reputation refresh frequency for the Threat Intelligence Exchange Server

https://kc.mcafee.com/corporate/index?page=content&id=KB84089

Highlighted

Re: GTI Refresh for Not Set files

"Records that have a status of Not Available for the GTI reputation will not be refreshed."

What about those that had reported the Not Available from the GTI, and got delivered by the GetClean in a later time.

McAfee Employee aguevara
McAfee Employee
Report Inappropriate Content
Message 4 of 8

Re: GTI Refresh for Not Set files

GetClean should upload the status of a file to GTI and subsequently TIE will refresh the status within an hour, if it doesn then it will be best to ask this question here:

 https://community.mcafee.com/t5/Malware/bd-p/malware

Re: GTI Refresh for Not Set files

Hi

Why asking on a malware topic, if the TIE seems not to do his job properly?

I can share a few examples if you like.

McAfee Employee aguevara
McAfee Employee
Report Inappropriate Content
Message 6 of 8

Re: GTI Refresh for Not Set files

TIE is based on the information GTI has, if a reputation is not available then there are other methods for setting them (like an enterprise reputation) but in this scenario your question is how often the TIE server pulls data from GTI, that by default is 1 hour (it can be changed with the suggested article) but if Getclean uploads information to GTI then the malware guys will be on a better position to know how long does it take for that tool to reach the GTI servers

Re: GTI Refresh for Not Set files

The problem is that we get the mail confirmation that the analysis has been completed and once the manual GTI refresh is being triggered manually the reputation gets properly refreshed. 

But the automatic refresh of the GTI reputation doesn't take place.

Do you suggest opening a SR in this case?

McAfee Employee aguevara
McAfee Employee
Report Inappropriate Content
Message 8 of 8

Re: GTI Refresh for Not Set files

yes please so that we can take a look at the TIE logs, it will be best if you could enable GTI debug as described on the below article and then collect an MER from the TIE box:

https://kc.mcafee.com/corporate/index?page=content&id=KB88407

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community