A Reputation filter associates an action set with one or more suspect IP addresses,
domains, URLs, or file hashes in the Reputation Database.
When the profile containing the Reputation filter is distributed to a device, the
specified actions are applied to traffic that matches the addresses of tagged entries
in the Reputation Database that have been screened using specified tag criteria.
When you create a Reputation filter using addresses from the Reputation Database,
any tag category associated with the address is included.
Learn more.
 |
ImportantYou can create an exception to prevent internal IP address from being used in a Reputation
filter.
|
Creating a Reputation filter consists of two steps. In the first step, you define
the general settings: the name for the filter, the state, the locked status, the action
set, and the type of Reputation Database entries. In the second step, you specify
the tag criteria to use when matching entries in the Reputation Database.
Entries retrieved from Trend Vision One will be tagged with the corresponding action
from Trend Vision One, using the tag
Vision One Scan Action. You can create a reputation filter using this tag to match entries and applying
the appropriate action set. |
NoteFile Hash Reputation does not support an action set with a Rate Limit flow control. For those entries, you can change the action set to one with a different
flow control type, or remove file hashes from the entry criteria.
|
If the tag criteria contains Does not have this tag, when you distribute the profile, the SMS sends all entries that do not have this
tag category to the device including Reputation DV, geographic, and user-provided
entries.