jti - this is new one to me.

[ihoratos]

Where can I find a spec sheet that will list the details? Like what does jtiReputation 15 mean? PANIC time or RELAX. What IS JTI? a misspelling of GTI?

TIA

[ihoratos]

OH, and what does:

ThreatActionTaken="jticlient.would.blocked"

does that mean it blocked? If it meant would block would in not say would.block? But then if blocked, why have the "would" there? 

Love McAfee products, their documentation, eh, not so much.

[mmuthuga · Accepted solution]

Hi @ihoratos ,

ThreatActionTaken="jticlient.would.blocked" implies action taken is would block since it was not blocked because of ENS ATP observe mode been enabled. If observe mode is disabled then this will be blocked.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

[Former Member]

Hi @ihoratos 

JTI is not just a misspelling of GTI 🙂
It belongs to ENS ATP. If you are seeing reports of jtiReputation 15, it means that our TIE rules have determined the item to be Most Likely Malicious.

[ihoratos]

Thank you - I now know what jtiReputation 15 means. How about all the others? Is there a document listing the different codes? Please provide a link of provide a list.

[Former Member]

Hi @ihoratos  

Could you elaborate on which others are you referring to? Where did you get this " jtiReputation 15" from? That may also help me answer your question more easily 🙂

[ihoratos]

in the ELM message from ePO to the SIEM. By which other I mean 15 = Mostlikely Malicious. What does 10 Mean? 11?12?5?100??

[Former Member · Accepted solution]

Ah I see, thanks!

I believe this KB article will assist you with the rest of those reputation levels:

https://kc.mcafee.com/corporate/index?page=content&id=KB84600

Take a look at TIE Reputation levels.

[ihoratos]

Thank you sir. That was EXACTLY what I was looking for.