Module 01 — Overview
Course Overview & Learning Objectives
This training course provides a comprehensive foundation in Trellix Threat Intelligence Exchange (TIE) 4.7.x, equipping IT professionals with the knowledge required to deploy, manage, and optimize TIE within an enterprise security environment.
Learning Objectives
- Threat Intelligence Fundamentals — Understand the role of TIE in reducing threat response time from days to milliseconds
- Architecture & Components — Identify and describe the function of TIE clients, servers, and communication layers
- File Reputation Management — Explain how reputation scores are assigned, prioritized, and overridden
- Dashboard Operations — Navigate and interpret TIE dashboards for threat monitoring and analysis
- Sandbox Integration — Configure and utilize sandbox environments for deep file analysis
- Database Administration — Perform routine maintenance tasks to sustain TIE system health
Course Structure
- 7 Instructional Modules — Topic-focused content with practical context and technical depth
- Knowledge Checks — Per-module assessments to reinforce comprehension
- Audio Narration — Section narration available via the Listen button on applicable content blocks
- Final Examination — 15-question assessment covering all course material
- Certificate of Completion — Issued upon achieving a passing score of 80% or higher
Passing Requirement: A minimum score of 80% (12 out of 15 questions) is required on the final examination to receive a certificate of completion.
Module 02 — Introduction
Introduction to Threat Intelligence Exchange
Trellix TIE fundamentally changes the threat response model by enabling real-time sharing of threat intelligence across all endpoints in an environment, collapsing response time from weeks to milliseconds.
Core Value Proposition
TIE narrows the gap between threat detection and containment from days, weeks, or months down to milliseconds. When a file is identified as malicious on one endpoint, that intelligence is immediately propagated to all other endpoints across the environment, enabling simultaneous blocking without manual intervention.
TIE narrows the gap from detection to containment from days, weeks, and months down to milliseconds. When a threat appears on one computer, TIE instantly shares that information with all your other computers. Everyone blocks it at the exact same time.
Intelligent File Analysis
For each file execution attempt, TIE evaluates multiple data sources to determine whether the file should be permitted or blocked:
- Global Threat Intelligence (GTI) — Worldwide threat reputation data maintained by Trellix
- Enterprise Reputation Database — Local intelligence accumulated within the organization's environment
- Administrative Overrides — Manually defined trust or block decisions applied by authorized administrators
- Decision Output — Allow or block, enforced immediately across all connected endpoints
Supported Endpoint Types
TIE monitors and protects a broad range of endpoint categories within the enterprise:
- Cloud Workloads — Virtual machines and cloud-hosted services
- BYOD & Mobile Devices — Personally owned devices accessing corporate resources
- Workstations & Laptops — Standard user computing devices
- Servers — On-premises and hosted server infrastructure
- Network Appliances — Connected networking and security equipment
TIE isn't just for computers. It handles cloud systems, personal devices, regular computers, servers, and network equipment. All of them talk to TIE and share threat intelligence instantly.
Dual Intelligence Sources
- Global Threat Intelligence (GTI) — Trellix-maintained cloud database of worldwide threat signatures, continuously updated
- Local Enterprise Intelligence — Organization-specific reputation data derived from observed file behavior within the environment
Knowledge Check
Module 02 — Introduction to TIE
Q1. What is TIE's primary operational advantage over traditional security response models?
Q2. Which two intelligence sources does TIE combine to evaluate file reputation?
Module 03 — Architecture
TIE Architecture & Core Components
TIE is composed of four primary components that work in concert to deliver real-time threat intelligence: the TIE Client, TIE Server, Trellix DXL, and the Global Threat Intelligence (GTI) service.
TIE Client
The TIE Client is deployed on endpoint devices as a component of Trellix Endpoint Security Adaptive Threat Protection (ENS ATP). It serves as the primary enforcement layer within the TIE architecture.
- File Execution Monitoring — Intercepts and evaluates every file execution attempt on the host
- Reputation Queries — Communicates with the TIE Server to retrieve current reputation data
- Allow/Block Enforcement — Applies policy decisions based on returned reputation scores
- Telemetry Reporting — Reports observed file activity and findings back to the TIE Server
The TIE Client is part of Trellix Endpoint Security Adaptive Threat Protection. It watches every file trying to run, checks it against the TIE Server's database, decides to allow or block it, and reports back any interesting findings.
TIE Server
The TIE Server functions as the central intelligence repository and decision authority within the TIE architecture.
- Reputation Storage — Maintains a local database of file and certificate reputation data
- Intelligence Aggregation — Combines local enterprise data with GTI cloud reputation feeds
- Administrative Override Management — Stores and applies manually defined reputation decisions
- Real-Time Notification — Propagates updated threat intelligence to all connected endpoints instantly
- Execution Tracking — Records which files executed on which systems for forensic and investigative use
The TIE Server is the central intelligence hub. It stores reputation data about files and certificates, combines local and global intelligence, lets admins override reputations, instantly notifies all endpoints when something bad is found, and tracks which files ran on which systems.
Trellix DXL — Data eXchange Layer
DXL is the messaging fabric that enables real-time communication between all TIE components and integrated security products.
- Broker Architecture — Clients connect to DXL brokers that manage message routing across the environment
- Real-Time Delivery — Threat intelligence is pushed to all endpoints simultaneously upon update
- Firewall/NAT Compatibility — Functions across network boundaries without requiring direct connectivity
- Bidirectional Messaging — Supports both event publishing and request/response communication patterns
OpenDXL
OpenDXL is the open-source extension of the DXL framework, enabling third-party products and custom integrations to participate in the TIE communication fabric.
- Vendor-Agnostic Integration — Connects non-Trellix products to the DXL messaging bus
- Accelerated Development — Reduces integration timelines from months to days
- Full Message Participation — Third-party products can publish events, subscribe to feeds, and invoke actions
OpenDXL is the open-source version of DXL. It lets Trellix and third-party products integrate quickly. Integrations take days instead of months. All products can publish events, receive events, ask questions, and take actions.
Global Threat Intelligence (GTI)
GTI is Trellix's cloud-based threat reputation service, providing continuously updated file and certificate reputation data sourced from Trellix's global sensor network.
- Continuous Updates — Threat signatures and reputation data refreshed in real time
- Deployment Models — Available as public shared cloud or private cloud instances
- Automatic Synchronization — TIE Server pulls GTI updates automatically without manual intervention
Knowledge Check
Module 03 — Architecture & Components
Q1. Which component is responsible for intercepting file execution attempts on an endpoint and enforcing allow/block decisions?
Q2. What is the primary function of the DXL messaging layer?
Q3. What capability does OpenDXL provide beyond standard DXL?
Module 04 — Reputation System
File Reputation System
The TIE reputation system assigns a trust score to each file and certificate based on data aggregated from multiple sources. These scores, combined with administrator-defined policies, determine whether a file is permitted to execute.
Reputation Score Classifications
TIE assigns one of five standardized reputation classifications to each file:
- Known Trusted — File is confirmed safe; execution permitted
- Most Likely Trusted — File is likely safe based on available data; execution typically permitted
- Unknown — Insufficient data to classify; policy-dependent action
- Most Likely Malicious — File exhibits malicious indicators; execution typically blocked
- Known Malicious — File is confirmed malicious; execution blocked
Every file gets a reputation rating. Known trusted means the file is safe, run it. Most likely trusted means probably safe. Unknown means we don't know yet. Most likely malicious means probably bad. Known malicious means definitely bad, block it. Your TIE policies then decide whether to allow or block the file.
Reputation Source Priority Hierarchy
When multiple reputation sources provide conflicting assessments, TIE resolves the conflict using the following priority order (highest to lowest):
| Priority | Source | Description |
|---|---|---|
| 1 | Admin Override | Manually defined by an authorized administrator; supersedes all automated sources |
| 2 | Enterprise Reputation | Locally derived reputation data specific to the organization's environment |
| 3 | Trellix GTI | Cloud-based global threat intelligence maintained by Trellix |
| 4 | Sandbox Analysis | Behavioral analysis results from TIS, IVX, or IVX Cloud sandbox environments |
| 5 | Third-Party Sources | External data sources including VirusTotal integration |
Key Principle: Administrative overrides carry the highest priority in the reputation hierarchy. If an administrator designates a file as Trusted, that designation will take precedence over a GTI classification of Known Malicious, and vice versa.
File Metadata Factors
In addition to reputation scores, TIE considers supplementary metadata when evaluating files:
- File Age — The duration since the file was first observed; older files generally correlate with higher trustworthiness
- Prevalence — The number of distinct systems that have executed the file; higher prevalence is associated with lower risk
- First Instance — The first endpoint to observe a file; useful for tracing infection origin and propagation paths
Administrative Override Management
Administrators have full authority to modify the reputation of any file within the TIE environment:
- Override Scope — Changes apply across the entire enterprise environment immediately upon submission
- Custom Application Whitelisting — Internal applications flagged by GTI can be designated as Trusted to prevent false positives
- Malware Blacklisting — Newly identified threats can be immediately designated as Known Malicious organization-wide
- Bulk Import — Pre-populated reputation lists can be imported to accelerate initial deployment and policy configuration
Admins can manually change any reputation. Your company has a custom app that GTI marks suspicious? Change it to trusted. You found malware in your network? Change it to known malicious. Overrides apply instantly across your entire environment. You can even import entire lists of pre-known reputations.
Knowledge Check
Module 04 — File Reputation System
Q1. If an administrator designates a file as Trusted, but GTI classifies it as Known Malicious, which assessment takes precedence?
Q2. In the context of TIE's file reputation system, what does "prevalence" indicate?
Q3. From how many distinct source categories does TIE aggregate file reputation data?
Module 05 — Dashboards
Dashboards & Operational Monitoring
TIE provides a suite of purpose-built dashboards that offer visibility into threat activity, reputation changes, administrative configurations, and infrastructure health across the monitored environment.
Sandboxing Dashboard
Provides operational visibility into file analysis activity across integrated sandbox environments (TIS, IVX, IVX Cloud):
- Sample Volume Trending — Daily analysis throughput and submission volume
- Report Type Distribution — Breakdown of reputation lookups vs. full behavioral analysis reports
- Recent Activity Feed — New and recent sandbox submission results
- Top Prevalence Submissions — Files submitted most frequently for analysis
The Sandboxing Dashboard monitors file analysis happening in sandboxes. It shows daily trending count of analyzed samples, split of reputation and analysis reports, new and recent trends, and top prevalent submissions.
Threat Intelligence Dashboard
The primary threat visibility console, presenting a real-time overview of reputation activity across the environment:
- Reputation Distribution — File counts trending by classification (Trusted, Unknown, Malicious)
- GTI Change Tracking — New files and GTI reputation changes observed in the prior week
- Suspicious File Trending — Volume trend of files classified as suspicious
- Discovery Leaders — Endpoints with the highest rate of new file discovery
- Override Analytics — Distribution of administrative overrides by score classification
- Certificate Intelligence — Parallel reputation tracking for digital certificates
Overrides Dashboard
Provides operational visibility into the state of the administrative override repository:
- New Overrides — Recently added manual reputation decisions
- Active Overrides — Overrides that have been referenced during active reputation evaluations
- Redundant Overrides — Duplicate entries consuming unnecessary storage and processing
- Conflicting Overrides — Entries with contradictory definitions requiring administrator review
- Unclassified Files — Signed and unsigned files with Unknown reputation present in the environment
Monitoring Dashboard
Operational health and performance visibility for the TIE infrastructure:
- Infrastructure Monitor — DXL broker connectivity status, component version inventory, GTI synchronization counts
- Data Cleanup Monitor — Cleanup task execution history, new file ingestion rates, current database utilization
The Monitoring Dashboard shows health and performance. The Infrastructure Monitor shows DXL connectivity status, component versions on TIE servers, and GTI refresh counts. The Data Cleanup Monitor shows when cleanup tasks ran, how many new files came in, and the current database size.
GUID Tracking: Each managed endpoint is assigned a Global Unique Identifier (GUID). TIE uses GUIDs to maintain a complete audit trail of file execution events, enabling administrators to trace infection vectors and determine exactly which systems executed a given file.
VirusTotal Integration
TIE integrates with VirusTotal to provide supplementary threat intelligence directly within the TIE console:
- On-Demand Analysis — Any file in TIE can be submitted to VirusTotal for multi-engine analysis with a single action
- Corroborating Intelligence — VirusTotal results serve as a secondary validation source for reputation decisions
- Investigation Support — Accelerates incident response workflows by consolidating external intelligence
VirusTotal is a free online service that scans files for viruses. Click any file in TIE and see VirusTotal results instantly. This helps with investigation and remediation.
Knowledge Check
Module 05 — Dashboards & Monitoring
Q1. Which dashboard provides visibility into DXL connectivity status and infrastructure component versions?
Q2. How is VirusTotal characterized within the TIE architecture?
Module 06 — Sandboxing
Sandboxing & Behavioral Analysis
When a file's reputation is Unknown, sandbox analysis provides a controlled mechanism to evaluate behavior dynamically. TIE integrates with multiple sandbox environments to perform deep-dive analysis without exposing the production environment to risk.
Sandbox Analysis Overview
A sandbox is an isolated execution environment in which suspicious files can be safely detonated and monitored. All activity is contained and cannot propagate to the production network.
- Isolated Execution — File executes within a containerized environment, fully separated from production infrastructure
- Comprehensive Telemetry — All system interactions are recorded: disk writes, registry modifications, network connections, process spawning
- Risk-Free Observation — Malicious behavior can be analyzed without exposure to live systems
- Detailed Analysis Reports — Structured behavioral reports returned upon analysis completion
A sandbox is an isolated environment where files run safely. The file runs in a container isolated from your real network. Every action is recorded. You observe malware behavior without risk. Results come back in a detailed analysis report. The malware cannot escape to your real systems.
Sandbox Integration Workflow
- Submission — Administrator or automated policy triggers file submission to a configured sandbox
- Target Environments — TIE supports submission to TIS (on-premises), IVX (on-premises), or IVX Cloud (cloud-hosted)
- Behavioral Simulation — Sandbox executes the file and monitors all resulting system activity
- Report Generation — Analysis results returned as a structured behavioral report with a verdict (Malicious, Benign, or Suspicious)
- Intelligence Propagation — Resulting reputation updates are immediately distributed across all TIE-connected endpoints via DXL
Submission Policy Configuration
Administrators can define granular submission policies to optimize resource utilization:
- File Type Filtering — Restrict analysis to specific file extensions (e.g., .exe, .dll, .pdf)
- File Size Thresholds — Exclude oversized files from analysis where behavioral analysis is less practical
- Path-Based Scoping — Limit submissions to files originating from specified directory paths
- Deduplication Controls — Prevent redundant re-analysis of previously evaluated files
Built-In Reporting
TIE Server provides a suite of pre-built and customizable reports:
- Summary Report — High-level overview of threat activity, file intelligence, and sandbox operations
- Files Report — Detailed log of file executions observed within the environment
- Certificates Report — Certificate reputation data and status change history
- Custom Reports — User-defined queries for targeted data extraction
- Scheduled Distribution — Automated report delivery via email on a configurable schedule
TIE Server comes with built-in reports. Summary reports provide an overview of threats, files, and sandboxing activity. Files reports show details on files executed in your environment. Certificates reports provide info on certificate usage and reputation changes. Build custom reports with your own queries and schedule reports to send via email automatically.
Knowledge Check
Module 06 — Sandboxing & Reporting
Q1. What occurs when a file is submitted to a TIE-integrated sandbox?
Q2. Which sandbox environments does TIE support for file analysis?
Module 07 — Administration
Database Administration & System Maintenance
Maintaining TIE system health requires routine administrative tasks including database maintenance, health monitoring, and topology management. This module covers the operational procedures required to sustain reliable TIE performance.
Database Maintenance Operations
- Data Cleanup — Periodic removal of stale, unused file records to control database growth and maintain query performance
- Index Optimization — Rebuilding and maintaining database indexes to sustain lookup speed under high load
- Historical Data Archiving — Migrating aged data to archive storage to free active database capacity
- Growth Monitoring — Continuous tracking of database size to identify capacity issues before they impact operations
Database maintenance tasks include removing old, unused files from the database, keeping searches fast by maintaining indexes, moving historical data to archive storage, and monitoring database size to prevent running out of space.
Update Metadata Aggregation
TIE continuously refines its local intelligence through metadata aggregation from managed endpoints:
- Endpoint Telemetry Collection — File execution events and reputation changes gathered from all managed endpoints
- Pattern Aggregation — Collected data synthesized into organization-specific behavioral baselines
- Adaptive Intelligence — TIE's local reputation model improves over time as environment-specific patterns are established
- Anomaly Detection — Deviations from established baselines — such as a modified version of a known application — are flagged for review
TIE Server Health Monitoring
Administrators should monitor the following health indicators to ensure continuous TIE availability:
- Disk Utilization — Available storage capacity; critically low levels can interrupt database operations
- DXL Connectivity — Broker reachability status for all registered endpoint clients
- GTI Synchronization — Confirmation that reputation updates are being received from the GTI cloud service
- CPU & Memory Utilization — Server resource consumption under current workload
- Query Response Time — Latency metrics for reputation lookup operations
Alert policies should be configured to notify administrators proactively when any monitored metric breaches defined thresholds.
Monitor disk space available, DXL connectivity to reach all clients, GTI connectivity to get reputation updates, CPU and memory usage, and response time. If anything goes wrong, alerts notify admins.
Topology Synchronization
Enterprises operating multiple TIE Server instances can configure topology synchronization to maintain consistent reputation data across all nodes:
- Cross-Server Replication — Reputation data synchronized between geographically distributed TIE Server instances
- High Availability — Endpoint protection is maintained even if a single TIE Server becomes unavailable
- Multi-ePO Integration — Bridges multiple on-premises ePO environments within a unified TIE topology
Routine Administrative Tasks
- Cleanup Scheduling — Configure database cleanup tasks to execute during off-peak windows to minimize operational impact
- Growth Trend Analysis — Review database size trends regularly to plan for storage capacity requirements
- Failover Testing — Periodically validate failover behavior to backup TIE Server instances
- Health Log Review — Regular review of system health logs to identify emerging issues
- Certificate Authority Maintenance — Update certificate authority records as required to maintain accurate certificate reputation evaluation
Knowledge Check
Module 07 — Database Administration
Q1. What is the primary purpose of metadata aggregation in TIE?
Q2. Why is proactive TIE Server health monitoring essential in an enterprise deployment?
Module 08 — Assessment
Final Examination
This examination covers all topics presented in the course. A minimum score of 80% (12 out of 15 questions correct) is required to receive a certificate of completion.
Examination Instructions: Select the single best answer for each question. All 15 questions must be answered before submitting. Results will be displayed immediately upon submission. A score of 80% or higher is required to unlock the certificate.
Q01. By how much does TIE reduce threat response time compared to traditional security models?
Q02. Which TIE component is responsible for maintaining the central reputation database?
Q03. What is the correct expansion of the acronym DXL?
Q04. What operational advantage does OpenDXL provide over the standard DXL framework?
Q05. Which reputation classification represents the highest threat severity in TIE's classification framework?
Q06. In TIE's reputation model, what does the term "prevalence" refer to?
Q07. Which TIE dashboard provides visibility into DXL broker connectivity and infrastructure component versions?
Q08. What is the function of a GUID within the TIE architecture?
Q09. What occurs within a TIE-integrated sandbox during file analysis?
Q10. Which sandbox environments does TIE support for file analysis submission?
Q11. What is the primary function of metadata aggregation in TIE?
Q12. What is the correct expansion of the acronym GTI?
Q13. What is the operational effect of topology synchronization across multiple TIE Server instances?
Q14. How is VirusTotal classified within the TIE ecosystem?
Q15. Within TIE's reputation priority hierarchy, which source carries the highest precedence?
🎓
Certificate of Completion
Trellix Threat Intelligence Exchange (TIE) 4.7.x
Subject Matter Expert Training
Subject Matter Expert Training
This certifies successful completion of all course modules and the final examination, demonstrating proficiency in the following competency areas:
✓ Threat Intelligence Fundamentals
✓ TIE Architecture & Components
✓ File Reputation Management
✓ Dashboard Operations
✓ Sandboxing & Analysis
✓ Database Administration
0%
—