This article describes how to configure the value set for the TIE Server to refresh its Global Threat Intelligence (GTI) reputation. The refresh process affects only existing reputations. Records that have a status of
Not Available for the GTI reputation will not be refreshed.
The TIE Server checks for updates to GTI reputation values every hour. During this process all files and certificates that meet the following criteria will be updated:
- Known Trusted reputation values older than a week (default value)
- All other reputation values older than 12 hours (default value)
Depending on the number of files and certificates matching the criteria, this hourly process can cause a CPU spike on the master TIE Server.
NOTE: As of TIE Server version 2.1.0, the naming convention for Master and Slave operations changed to Primary and Secondary. For example:
Master becomes Primary
Slave becomes Secondary
Previous versions of TIE Server retain the original Master/Slave designations.
These default values are the recommended setting to properly balance resource usage and detection effectiveness. Having a higher value implies not getting reputation changes in time, a lower value implies more bandwidth usage against GTI plus higher load on the TIE Server.
If you want to change these frequencies, perform the following steps:
- Use SSH to connect to the TIE Server as root.
- Type the following command and press ENTER:
vi /opt/McAfee/tieserver/conf/tie.properties
- To override the non-trusted reputation frequency, find the following entry and change the 720 value (specified in minutes, default is 12 hours * 60 minutes/hour = 720 minutes) to the desired refresh frequency:
# Default refresh frequency (if not explicitly overridden), default is 12 hours
repRefresh.defaultFrequency=720
- To override the Known Trusted reputation frequency, find the following entry and change the 168 value (specified in hours, default is 7 days * 24 hours/day = 168 hours) to the desired refresh frequency:
repRefresh.frequencies=1:99:100:168:h;2:99:100:168:h
- Save the changes.
- Use the following command to restart the TIE service:
service tieserver restart
