Adaptive Threat Protection doesn't apply 'Might be Malicious' reputation from Advanced Threat Defense

Technical Articles ID: KB93576
Last Modified: 2023-02-24 11:49:55 Etc/GMT

Environment

Advanced Threat Defense (ATD) 4.x
Intelligent Sandbox (IS) 5.x
Endpoint Security (ENS) Adaptive Threat Protection (ATP) 10.x
ENS Threat Prevention 10.x
Threat Intelligence Exchange (TIE) Server 3.x, 2.x

Problem

If ATD or IS provides the reputation 'Might Be Malicious,' ENS ATP doesn't apply that reputation on the local system. 'Might be Malicious' has a score of 30.
But, on the local system, ENS ATP enforces the reputation as 50 (Unknown).

Solution

The Joint Threat Intelligence (JTI) rule that enforces the ATD/IS reputation locally is Rule ID 234. This rule considers the ATD/IS reputation if the score is 15 and below, which is 'Most Likely Malicious' or 'Known Malicious.' JTI doesn't enforce the reputation 'Might be Malicious' provided by ATD/IS to avoid any false-positive behavior. This behavior is as per the design of Rule ID 234.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Adaptive Threat Protection doesn't apply 'Might be Malicious' reputation from Advanced Threat Defense

Environment

Problem

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Adaptive Threat Protection doesn't apply 'Might be Malicious' reputation from Advanced Threat Defense

Environment

Problem

Solution

Affected Products

Languages:

Choose your region

Title

Title