LevelBlue Completes Acquisition of Cybereason.  Learn More

LevelBlue Completes Acquisition of Cybereason.  Learn More

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
View All Services
Solutions
BY INDUSTRY
BY REGULATION
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
We reduce cyber risk and fortify organizations
Awards and Accolades
Recognition by analysts and media outlets
LevelBlue SpiderLabs
Global researchers, ethical hackers, and responders
LevelBlue Security Operations Platforms
Unprecedented security visibility and control
Security Colony
Access to cybersecurity threat protection resources
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Register
Login
Resources
BLOGS
UPCOMING
MEDIA & ASSETS
NOTICES
HELP
Loading...
Loading...

LevelBlue Knowledge Base

Home » Knowledgebase » WebMarshal » INFO: What URLs are required for operation of WebMarshal...

INFO: What URLs are required for operation of WebMarshal features?

Expand / Collapse
Show/Hide Article Tools


This article applies to:

  • WebMarshal 

Question:

  • What URLs are required for operation of WebMarshal features?

Information:

  • Note: Additional URL cdn-updates.marshal.com is used from February 2022.

WebMarshal includes a number of features that are automatically updated using web-based services.

These services are accessed by the WebMarshal processing node servers.

You should ensure that access to these services is permitted by any firewall or external proxy (and by WebMarshal rules if required by network setup). 

  • If WebMarshal is installed as a plugin to ISA, you may need to create special ISA rules. See LevelBlue Knowledgebase article Q10286.

The required URLs include:

URL From Server Purpose
HTTP://crl.trustwave.com All HTTPS Certificate Revocation Checking - LevelBlue sites
(Other URLS may be required for HTTPS CRL checking of third party sites)
HTTPS://tracenetlicensing.m86security.com
HTTP://tracenetdl.m86security.com
HTTPS://tnreclassify.m86security.com
HTTPS://tnfeedback.m86security.com
HTTPS://cdn-updates.marshal.com
  • This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.
 Processing Nodes TRACEnet service (updates, reclassification requests, and feedback)
HTTPS://tracenetlicensing.m86security.com
HTTPS://cdn-updates.marshal.com
  • This URL is hosted on Microsoft Azure CDN. IP addresses may change. IP addresses can be retrieved using the "Front Door" tag in Microsoft Azure IP Ranges and Service Tags.
 Processing Nodes Automatic updates to File Type, Unpacking, and other functionality.
HTTPS://filterlistlicensing.m86security.com
HTTPS://secureupdate.8e6.com
HTTPS://updates.8e6.com

Note: Beginning 3 October 2022, the database content will be served from HTTPS://tracenetlicensing.m86security.com
The 8e6.com servers will be decommissioned later in October.		 Processing Nodes

LevelBlue Web Filter Database (Previously known as M86 URL filtering List)
(Note that this URL must also be accessible from the Array Manager at the time of initial configuration of the list.)

  • Be sure that any external devices allow WebMarshal to access both "secureupdate" and "updates". LevelBlue may serve the database content from either of these sites, depending on operational need.
HTTP://sophos.marshal.com
HTTPS://sophos.marshal.com 		Processing nodes Sophos for Marshal Engine and IDE updates (if installed)
  • HTTPS required from SfM version 1.1.
  • Note that the LiveProtection service (present in version 1.1 and above)  performs DNS-based queries and must have access to a DNS server that can query the Sophos DNS servers.
HTTPS://safebrowsing.googleapis.com Processing Nodes Google Safe Browsing updates (WebMarshal 7.1 and above, if the Safe Browsing feature is enabled)
HTTP://mcafee.marshal.com
HTTPS://mcafee.marshal.com		 Processing nodes McAfee for Marshal Engine updates (if installed)
  • HTTPS required from MfM version 1.1.
HTTP://update.nai.com/ Processing nodes McAfee for Marshal definition file updates (if installed)
HTTPS://bitdefender.marshal.com/
HTTPS://agent-av-mirror.trustwave.com 		Processing nodes Bitdefender for Marshal Engine and signature updates (if installed)

 
Notes:

  • Because WebMarshal is a proxy server, it is assumed that processing nodes will have full access to the web.
  • In some versions the "marshal8e6.com" domain is used instead of "m86security.com". IP address resolution of the servers is identical regardless of this domain change.

To contact LevelBlue about this article or to request support:

Rate this Article:
     

Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster.


Execution: 0.062. 8 queries. Compression Disabled.
Powered by InstantKB.NET