ATP - PE Executable in excluded folder shown on TIE Reputation Page

[iverbuyst]

Hello,

We've excluded a folder in OAS to prevent ATP from getting trigged when an executable is executed from that folder.

When we execute an executable from that folder we see an entry in the AdaptiveThreatProtection_Activity log that the executable is excluded from scanning, which is as expected. But we see the executable appearing on the TIE Reputation Page as unknown.

Is it normal that a file that has been excluded gets an entry on the TIE server?

Best Regards,

Ivan 

[Pravioz]

What type of file is shown in TIE page 

Please follow the KB Article: https://kb.mcafee.com/corporate/index?page=content&id=KB90588  

[iverbuyst]

@Pravioz 

The file type shown on the TIE page is Windows Portable Executable.

In the ATP activity logs we see that scanning has been turned off for this file based in on the OAS exclusion, but the file info is visible on the TIE page. 

So we want to know if it's normal that files that are excluded using OAS get an entry in the TIE page?

Also we would like to know what's the best practice for these files. Should we handle them als normal executables and give them an Enterprise Reputation if GTI is Not Set, or can we leave them be because they are excluded from scanning anyways?

Best Regards,

Ivan