TIE - PE Executable in excluded folder shown on TIE Reputation Page

[iverbuyst]

Hello,

We've excluded a folder in OAS to prevent ATP from getting trigged when an executable is executed from that folder.

When we execute an executable from that folder we see an entry in the AdaptiveThreatProtection_Activity log that the executable is excluded from scanning, which is as expected. But we see the executable appearing on the TIE Reputation Page as unknown.

Is it normal that a file that has been excluded gets an entry on the TIE server?

Best Regards,

Ivan 

[bbarnes · Accepted solution]

Hello iverbuyst, 

This question would likely be better answered in the ENS group as it is their functionality involved. Based on some quick testing I have done it appears that the file is skipped for TIE evaluation (No reputation request, etc) however the metadata of the file may be sent over to TIE server. Metadata submission is an out of band operation with reputation requests. 

Thanks

Brian 

[iverbuyst]

Hello @bbarnes ,

Thanks for testing and confirming the behavior that we see.

Best Regards,

Ivan