Web Reputation
Threat Discovery Appliance leverages Trend Micro smart protection technology, a cloud-based infrastructure that determines the reputation of websites that users are attempting to access. Threat Discovery Appliance logs URLs that smart protection technology verifies to be fraudulent or known sources of threats. The product then uploads the logs to TMSP for report generation.
Logs are not available in the Threat Discovery Appliance web console.
For detailed information about smart protection technology, see Smart Protection Technology.
Complementary to smart protection technology is Smart Feedback, an opt-in subscription to the threat feedback system that is part of Smart Protection Network™. Smart Feedback collects information about new or potential threats and then sends the information to Smart Protection Network so that Trend Micro can analyze and address these threats. Your participation in Smart Feedback means that you are authorizing Trend Micro to collect network information, which is kept in strict confidence. Information includes:
This product’s name and version
URLs suspected to be fraudulent or possible sources of threats
URLs associated with spam or possibly compromised
Malware name for URLs that harbor malware
To configure web reputation settings:
Detections > Web Reputation
Enable web reputation.
Select the smart protection source. Threat Discovery Appliance connects to the smart protection source to obtain web reputation data. For detailed information about the different smart protection sources, see Smart Protection Technology.
Trend Micro Smart Protection Network: Select this option if you do not plan to set up a Smart Protection Server. Internet connection is required to connect to this Trend Micro hosted service.
Smart Protection Server: Select this option if you have set up one or several Smart Protection Servers. Network connection is required to connect to this server.
Type the Smart Protection Server's IP address.
You can obtain the IP address from the Smart Protection Server console by navigating to Smart Protection > Reputation Services > Web Reputation tab. The IP address forms part of the URL listed in the screen.
Click Test Connection to check if connection to the server can be established.
Type a description for the server.
Select whether to query the Smart Protection Network if the Smart Protection Server cannot determine a URL's reputation.
The Smart Protection Server may not have reputation data for all URLs because it cannot replicate the entire Smart Protection Network data. When updated infrequently, the Smart Protection Server may also return outdated reputation data.
Enabling this option improves the accuracy and relevance of the reputation data. However, it takes more time and bandwidth to obtain the data. Disabling this option has the opposite effects.
If you enable this option, do the following to optimize web reputation queries:
On the Smart Protection Server’s console, navigate to Smart Protection > Reputation Services > Web Reputation tab > Advanced Settings section. Disable Use only local resources, do not send queries to Smart Protection Network. This option prevents the Smart Protection Server from obtaining data from Smart Protection Network.
Update the Smart Protection Server regularly.
You can disable this option if you do not want your organization’s data to be transmitted externally.
If you have configured Proxy Settings for Threat Discovery Appliance and want to use these settings for Smart Protection Server connections, select Connect through a proxy server.
If you disable proxy settings,
Smart Protection Servers that connect through the proxy server will connect
to Threat Discovery Appliance directly. Under the Proxy
Connection column, the status is 
Proxy Unavailable.
Click Add. The Smart Protection Server is added to the Smart Protection Server list.
Add more servers. You can add up to a maximum of 10 servers.
Trend Micro recommends adding multiple Smart Protection Servers for failover purposes. If Threat Discovery Appliance is unable to connect to a particular server, it tries connecting to the other servers.
If you have added several servers, Threat Discovery Appliance connects to these servers in the order in which they appear in the list. Use the arrows under the Order column to move servers up and down the list.
Choose to enable or disable Smart Feedback.
Click Save.
To manage the Smart Protection Server list:
Detections > Web Reputation
To verify the connection status with a Smart Protection Server, click Test Connection.
To modify server settings:
Click the server address.
In the window that appears, modify the server's IP address, description, and settings.
When you specify a new IP address, click Test Connection to confirm the connection.
Click OK.
To remove a server from the list, click Delete.
Click Save.
See also: