TIE database growing massively

[AlexanderW]

Dear community,

I am using the latest TIE version which I connect to several McAfee Web Gateway appliances.

On McAfee Web Gateway I configured a rule which checks if a file TIE.Filereuptation is betweeen 1 and 30
If so it is blocked - otherwise the scanning is continued or stopped (because of good reputation).
If the scanning is continued I check with Gateway antimalware if the file is a possible threat - if yes the event "TIE: Report file reputation" is triggered and the cycle ends.
The ruleset works fine.

But on the ePO server, I can see that the TIE Reputations page is growing massively.
I recreated the TIE server database on Saturday and the database contains now round about 40.000 files (1.500 active clients).
If I navigate to "Queries & Reports > Database Type: TieServerSchma > Files: Files > Single Group Summary Table: Label Type" therer are over 2 million files.
(see screenshot attached).

This huge number of items makes the "Tie Reputations" page extremely slow.
I am sure that there is a wrong configuration here.

Looking at a file on the "TIE Reputations" page the "First Agent" is mostly (99% of the cases) one of our Web Gateway appliances.

How can I configure the TIE server to not store all Web Gateway files in his database?
I would like to have only the files stored that the antimalware module of Gateway reports.

[bbarnes · Accepted solution]

Hello AlexanderW, 

The issue you are experiencing is unfortunately not entirely uncommon. MWG has the ability to analyze many more file types (and in some cases not even files such as streaming video chunks, etc) for which TIE server will never have any actionable reputation data. The change that you need to make however is on the MWG side and not the side of TIE server. You may be able to get some clearer assistance from that product group as I am unfamiliar with MWG. With that said I can advise on what you need to accomplish, however without the specific how-to instructions. 

Within the MWG rule sets that evaluate against TIE, you need to include an additional condition or filter that only leverages TIE if the file type is executable or DLL. This will ensure that TIE is only asked, when the file type is one that will likely have reputation data available within TIE and by proxy, within GTI. 

Thanks

Brian

[AlexanderW]

Hello @bbarnes ,
Thanks for the answer.
Yes, that sounds kind of logical.
I will check our MWG to see if I can set a suitable filter.
I'll get back to you on this.

Edit:
What @bbarnes has written in his post is correct.
On the MWG the rule criteria
"MediaType.EnsuredTypes at least one in list Executables " is missing like described in this article:
https://docs.trellix.com/bundle/web-gateway-8.0.x-interface-reference-guide/page/GUID-861ED207-41ED-...