Smart Protection Technology

Trend Micro smart protection technology is a next-generation, in-the-cloud protection solution providing File and Web Reputation Services. By leveraging the Web Reputation Service, Threat Discovery Appliance can obtain reputation data for websites that users are attempting to access. Threat Discovery Appliance logs URLs that smart protection technology verifies to be fraudulent or known sources of threats and then uploads the logs to TMSP for report generation.

Threat Discovery Appliance does not use the File Reputation Service that is part of smart protection technology.

Reputation services are delivered through smart protection sources, namely, Trend Micro Smart Protection Network and Smart Protection Server. These two sources provide the same reputation services and can be leveraged individually or in combination. The following table provides a comparison between these sources.

Smart protection sources

Basis of Comparison	Trend Micro Smart Protection Network	Smart Protection Server
Purpose	A globally scaled, Internet-based infrastructure that provides File and Web Reputation Services to Trend Micro products that leverage smart protection technology	Provides the same File and Web Reputation Services offered by Smart Protection Network but is intended to localize these services to the corporate network to optimize efficiency
Administration	Trend Micro hosts and maintains this service.	Trend Micro product administrators install and manage this server.
Connection protocol	HTTPS	HTTP
Usage	Use if you do not plan to install Smart Protection Server. To configure Smart Protection Network as source, see Web Reputation.	Use as primary source and the Smart Protection Network as an alternative source. For guidelines in setting up Smart Protection Server and configuring it as source, see Setting Up Smart Protection Server.

Setting Up Smart Protection Server

Perform the following tasks to set up a Smart Protection Server:

Install Smart Protection Server on a VMware ESX/ESXi server.

Installation reminders and recommendations:

For information on the Smart Protection Server versions compatible with Threat Discovery Appliance, see Integration with Trend Micro Products and Services.
For installation instructions and requirements, refer to the Installation and Upgrade Guide for Trend Micro Smart Protection Server.
Smart Protection Server, Threat Discovery Appliance, and the VMware ESX/ESXi server (which hosts the Smart Protection Server) require unique IP addresses. Check the IP addresses of the VMware ESX/ESXi server and Threat Discovery Appliance and ensure that none of these IP addresses is assigned to Smart Protection Server.
If you have previously installed a Smart Protection Server for use with another Trend Micro product (such as Threat Mitigator), you can use the same server for Threat Discovery Appliance. While several Trend Micro products can send queries simultaneously, the Smart Protection Server may become overloaded as the volume of queries increases. Ensure that the Smart Protection Server can handle queries coming from different products. Contact your support provider for sizing guidelines and recommendations.
Trend Micro recommends installing multiple Smart Protection Servers for failover purposes. Threat Discovery Appliance checks The Smart Protection Server list configured in the web console to determine which server to connect to first, and the alternative servers if the first server is unavailable.

Configure Smart Protection Server settings from the Threat Discovery Appliance console. For details, see Web Reputation, starting in step 3.