Threat IntelligencePrivate Global Threat Intelligence
Trellix reputation intelligence for closed and air-gapped networks.
Some environments cannot phone home to a public threat cloud — compliance, sensitivity, or a genuinely closed network rules it out. Trellix Private Global Threat Intelligence (pGTI) is a packaged, single-tenant cloud solution that brings up-to-date File/IP/URL/Certificate reputation to closed or hybrid networks, and consolidates third-party feeds into one service. Faltrox deploys it so isolated environments still get living reputation data.
Overview
What Private Global Threat Intelligence is
Trellix Private Global Threat Intelligence (pGTI) brings up-to-date reputation intelligence to closed and air-gapped networks. Some environments cannot phone home to a public threat cloud — compliance, sensitivity, or a genuinely closed network rules it out. pGTI is a packaged, single-tenant cloud solution that delivers File, IP, URL, and certificate reputation to those networks, and consolidates third-party feeds into one service.
It is built on the same architecture as the public GTI cloud — which handles roughly 65 billion queries a day — so it scales from the largest enterprise deployments down to small offices, with a "quick-react" in-a-box option for temporary use. You can store up to 10 million of your own reputations that supersede the public defaults, and integrate via a certificate-secured REST interface. Faltrox deploys it so isolated environments still get living reputation data.
Coverage
What it protects
The platforms, threats, and surfaces this product is built to defend.
Closed & Air-Gapped Networks
Delivers reputation to networks that cannot use a shared public threat cloud.
Endpoints & Perimeter
Protects endpoints and the network boundary with up-to-date reputational services.
File / IP / URL / Cert
Near real-time reputation across files, IPs, URLs, and certificates.
Custom Reputations
Stores up to 10 million of your own reputations that supersede the public GTI defaults.
Third-Party Feeds
Consolidates external threat feeds into a single reputational service.
Enterprise to Small Office
Scales from the largest deployments to small offices, with a quick-react in-a-box option.
How it works
The mechanism
How the product moves from signal to protected state, step by step.
- 01
Deploy
A private, single-tenant-dedicated cloud stands up on-premises or off-premises for closed or hybrid networks.
- 02
Consolidate
Trellix global reputation and third-party feeds are combined into one service, delivering maximum coverage without manual integration.
- 03
Serve
Products across the enterprise query File, IP, URL, and certificate reputation at the boundary and endpoints.
- 04
Customise
You add and override reputations locally — up to 10 million — so your analysts’ convictions take precedence in your environment.
- 05
Integrate
A certificate- and API-key-secured REST interface connects third-party and custom analyst tools, with singular or bulk query.
Capabilities
Key capabilities
Closed-Network Reputation
Delivers Trellix File, IP, and URL reputations to products protecting your endpoints and perimeter inside closed networks that cannot use the public cloud.
Custom Reputations
Stores up to 10 million of your own reputations that supersede GTI public cloud reputations, so local knowledge overrides the global default where you need it to.
Single-Tenant Dedicated
A private cloud, single-tenant-dedicated environment lets you tap threat intelligence and share it across the enterprise without exposing queries to a shared service.
RESTful Interface
A certificate- and API-key-secured REST interface integrates third-party protection tools and custom analyst tools, with singular or bulk query and insert of reputations.
Analyst Research Access
Analysts query billions of File/Certificate/IP/URL reputations through web-based and command-line interfaces, with metadata tagging to enrich research.
Full Telemetry Access
Complete access to your pGTI query logs for advanced analytics, so you can hunt for advanced threats in your own reputation-lookup history.
Proven-Scale Architecture
Built on the GTI public cloud architecture that handles ~65 billion queries a day, scaling from the largest enterprise deployments down to small offices.
Quick-React Deployment
pGTI "in-a-box" installs for temporary network deployments, training sessions, and smaller offices where a full cloud footprint is not warranted.
Specifications
Technical detail
- Deployment
- Packaged cloud for closed or hybrid networks; on-premises and off-premises options
- Tenancy
- Private cloud, single-tenant dedicated
- Custom Reputation Store
- Up to 10 million reputations (supersede public GTI)
- Reputation Types
- File, Certificate, IP, URL
- Integration
- RESTful interface with certificate and API-key security
- Proven Scale
- Architecture handles ~65 billion queries/day
Works with
Part of the platform
Trellix products this pairs with, and the Faltrox services that operate it.
Trellix products
Faltrox services
Delivery
You buy the outcome, not the console
Managed by Faltrox
Faltrox licenses, deploys, and tunes Trellix Private Global Threat Intelligence for your environment, then runs it as part of a managed service, so you get the protection without staffing another security console.
FAQ
Common questions
01Why not just use the public GTI cloud?
Because some environments cannot. Organisations with compliance or sensitive-security requirements, or genuinely closed and air-gapped networks, cannot send lookups to a shared public cloud. pGTI brings the same reputation intelligence into a private, single-tenant environment you control.
02Can we add our own intelligence?
Yes. pGTI stores up to 10 million of your own custom reputations that supersede the public GTI defaults, and lets you override reputations in your local instance — so your analysts’ convictions take precedence in your environment.
03Does it integrate with non-Trellix tools?
Its RESTful interface, secured with certificates and API keys, integrates third-party protection tools and custom analyst tools alongside the Trellix ecosystem, with singular or bulk query and insert of reputations.
04Can it handle enterprise query volume?
It is built on the same architecture as the public GTI cloud, which handles roughly 65 billion queries a day — on par with major social platforms — and scales from the largest enterprise deployments down to small offices.
05Is there a lightweight option for temporary use?
Yes — pGTI "in-a-box" can be installed for temporary network deployments, training sessions, and smaller offices, so you are not standing up a full cloud footprint for a short-lived or small-scale need.
Start an engagement
Secure what’s next.
Speak with the engineering team to define scope, walk through the methodology, and decide whether Faltrox is the right team to test and run your environment.
Contact us