cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

jti - this is new one to me.

Jump to solution

Where can I find a spec sheet that will list the details? Like what does jtiReputation 15 mean? PANIC time or RELAX. What IS JTI? a misspelling of GTI?

TIA

2 Solutions

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 9

Re: jti - this is new one to me.

Jump to solution

Hi @ihoratos ,

ThreatActionTaken="jticlient.would.blocked" implies action taken is would block since it was not blocked because of ENS ATP observe mode been enabled. If observe mode is disabled then this will be blocked.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: jti - this is new one to me.

Jump to solution

Ah I see, thanks!

I believe this KB article will assist you with the rest of those reputation levels:

https://kc.mcafee.com/corporate/index?page=content&id=KB84600

Take a look at TIE Reputation levels.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

8 Replies

Re: jti - this is new one to me.

Jump to solution

OH, and what does:

ThreatActionTaken="jticlient.would.blocked"

does that mean it blocked? If it meant would block would in not say would.block? But then if blocked, why have the "would" there? 

Love McAfee products, their documentation, eh, not so much.

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 9

Re: jti - this is new one to me.

Jump to solution

Hi @ihoratos ,

ThreatActionTaken="jticlient.would.blocked" implies action taken is would block since it was not blocked because of ENS ATP observe mode been enabled. If observe mode is disabled then this will be blocked.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 9

Re: jti - this is new one to me.

Jump to solution

Hi @ihoratos 

JTI is not just a misspelling of GTI 🙂
It belongs to ENS ATP. If you are seeing reports of jtiReputation 15, it means that our TIE rules have determined the item to be Most Likely Malicious.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Highlighted

Re: jti - this is new one to me.

Jump to solution
Thank you - I now know what jtiReputation 15 means. How about all the others? Is there a document listing the different codes? Please provide a link of provide a list.
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 9

Re: jti - this is new one to me.

Jump to solution

Hi @ihoratos  

Could you elaborate on which others are you referring to? Where did you get this " jtiReputation 15" from? That may also help me answer your question more easily 🙂

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?
Highlighted

Re: jti - this is new one to me.

Jump to solution
in the ELM message from ePO to the SIEM. By which other I mean 15 = Mostlikely Malicious. What does 10 Mean? 11?12?5?100??
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 9

Re: jti - this is new one to me.

Jump to solution

Ah I see, thanks!

I believe this KB article will assist you with the rest of those reputation levels:

https://kc.mcafee.com/corporate/index?page=content&id=KB84600

Take a look at TIE Reputation levels.

Was my reply helpful?
If this information was helpful in any way, or answered your question, will you please select "Accept as Solution" in my reply, or give kudos as appropriate, so together we can help other members?

View solution in original post

Highlighted

Re: jti - this is new one to me.

Jump to solution
Thank you sir. That was EXACTLY what I was looking for.
You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community