Technical Articles ID:
KB93324
Last Modified: 7/9/2021
Environment
McAfee Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
McAfee ENS Common 10.x
McAfee ENS Firewall 10.x
McAfee ENS Threat Prevention 10.x
McAfee ENS Web Control 10.x
Summary
Recent updates to this article
Date
Update
July 9, 2021
Added "amcore.rest.gti.mcafee.com" to the "Threat Prevention" section.
June 14, 2021
Added "avts.mcafee.com" to the "Threat Prevention" section.
March 24, 2021
Added clarification for proxied environments.
February 24, 2021
Added a note regarding *.cloudplatform.mcafee.com.
January 22, 2021
Added keywords to the Related Information section for search assistance.
Some components that ENS consumes perform off-box communication. The purpose of this article is to:
List the URLs used to perform off-box communication.
Describe the purpose behind the communication. The purpose depends on the ENS module (ATP, Common, Firewall, Threat Prevention, and Web Control).
IMPORTANT: The URLs might sometimes be blocked because of security restrictions or the network configuration. If these URLs are blocked, it adversely affects the functionality, efficacy, and intelligence of ENS. In environments where connections are proxied, lookups via port 53 (for file reputation) might fail because the proxy server can't correctly impersonate this DNS-like traffic.
NOTE: If you resolve any of the below URLs, you might see the following as part of the domain name mapping: *.cloudplatform.mcafee.com. This name is an expected alias. The below URLs can resolve to multiple and differing IP addresses at different times.
Contents
Click to expand the section you want to view:
