Threat Intelligence Exchange on Air Gap Environment
The McAfee TIE server uses data from Global GTI to make informative decisions about already known binaries. I will be working in an air gap environment. That being said, I'm wondering about the following requirements:
1. Can the GTI data be replicated on-prem instead of using the internet?
2. If the above is not possible and there is no connectivity to the internet, would TIE only provide reputation on local binaries (as long as the admin rates binaries in ePO)? In other words, what benefit would TIE have in an air-gap environment?