Procedure

1. Go to Administration → Monitoring / Scanning → Web Reputation.
2. Select Enable Web Reputation.
3. Select a Smart Protection source:
   • Trend Micro Smart Protection Network™
     Trend Micro Smart Protection Network is a globally-scaled, cloud-based infrastructure providing reputation services to Trend Micro products that integrate Smart Protection technology. Deep Discovery Inspector connects to the Smart Protection Network using HTTP. Select this option if you do not plan to set up a Smart Protection Server.

     Important Selecting this option allows you to enable Retro Scan, a cloud-based service that scans historical web access logs for callback attempts to C&C servers and other related activities in your network. Web access logs may include undetected and unblocked connections to C&C servers that have only recently been discovered. Examination of such logs is an important part of forensic investigations and may help you determine if your network is affected by attacks. Trend Micro recommends enabling Retro Scan in step 4.

   • Smart Protection Server
     Smart Protection Server (standalone) does the following:
     • Provides Web Reputation Services, Certified Safe Software Service (CSSS), Mobile App Reputation Service (MARS), and Community File Reputation as offered by Smart Protection Network
     • Relays these services to the global Trend Micro Smart Protection Network for network efficiency
     As a Trend Micro product administrator, you must set up and maintain this server. Select this option if you have already set up a server.

     Important Selecting this option disables Retro Scan and deletes all previous Retro Scan detection logs.

4. (Optional) Enable Retro Scan.
   For details, see Enabling Retro Scan.
5. To select Smart Protection Server, configure the Smart Protection Server List.
   1. Type the Smart Protection server name or IP address.
      Obtain the IP address by going to Smart Protection → Reputation Services → Web Reputation on the Smart Protection Server console.

      The IP address forms part of the URL listed on the screen.
   2. (Optional) Click Test Connection.
   3. Type a description for the server.
   4. Update Smart Protection Server regularly.
      On the Smart Protection server console, go to Updates → Program → Update Schedule and click Enable scheduled updates.
   5. (Optional) If proxy settings for Deep Discovery Inspector have been configured for use with Smart Protection Server connections, select Connect through a proxy server .

      Note If proxy settings are disabled, Smart Protection Servers that connect through the proxy server will connect to Deep Discovery Inspector directly. Under the Proxy Connection column, the status displays No when proxy settings are disabled.

      Note On the proxy server, configure the following ports to allow a connection to Smart Protection Server: 5275 443

   6. Click Add.
      The Smart Protection Server is added to the Smart Protection Server List.
   7. (Optional) Add more servers.

      Note Add up to 10 servers. If multiple servers are configured, Deep Discovery Inspector connects to servers following the order in which they appear in the list.

      Tip Trend Micro recommends adding multiple Smart Protection Servers for failover purposes. If Deep Discovery Inspector is unable to connect to a server, it attempts to connect to other servers on the Smart Protection Server List.

   8. Use the arrows under the Order column to set server priority.
6. To filter excessive Web Reputation detections, check Exclude Spam and Adware detections to reduce detection volume.
   Most Web Reputation detections are related to spam and adware. Reduce detection volume by excluding spam and adware detections.
7. Click Save.