Added "amcore.rest.gti.mcafee.com" to the "Threat Prevention" section.
June 14, 2021
Added "avts.mcafee.com" to the "Threat Prevention" section.
March 24, 2021
Added clarification for proxied environments.
February 24, 2021
Added a note regarding *.cloudplatform.mcafee.com.
Some components that ENS consumes perform off-box communication. The purpose of this article is to:
List the URLs used to perform off-box communication.
Describe the purpose behind the communication. The purpose depends on the ENS module (ATP, Common, Firewall, Threat Prevention, and Web Control).
IMPORTANT: The URLs might sometimes be blocked because of security restrictions or the network configuration. If these URLs are blocked, it adversely affects the functionality, efficacy, and intelligence of ENS. In environments where connections are proxied, lookups via port 53 (for file reputation) might fail because the proxy server can't correctly impersonate this DNS-like traffic.
NOTE: If you resolve any of the below URLs, you might see the following as part of the domain name mapping: *.cloudplatform.mcafee.com. This name is an expected alias. The below URLs can resolve to multiple and differing IP addresses at different times.
Contents
Click to expand the section you want to view:
