ATP (Real Protect Cloud) reputation not updated on TIE server

[iverbuyst]

Hello,

We recently implemented a TIE/DXL server into our McAfee infrastructure.

We've installed the latest ENS & ATP to some testcomputers and ran the RP-D-TestFile.exe to confirm that ATP & TIE are working properly.

We've noticed that the initial reputation of the RP-D-TestFile.exe is "UNKNOWN" and when executed the ATP (Real Protect Cloud) scanner gives it a "Known Malicious" reputation and acts accordantly. But the TIE reputation of the RP-D-TestFile.exe doesn't change and stays at "UNKNOWN". We would expect that on the TIE Server the  Local Reputation would be changed to "Known Malicious" but this never happens, even after 10 executions and hours of waiting.

Is this normal behaviour our are we missing something?

Best Regards,

Ivan

#TIE #ATP #Real Protect Cloud

[bbarnes · Accepted solution]

Hello iverbuyst, 

I do believe what you are seeing is expected. When it comes to creating test files for use in a solution like this we have to be careful to make sure one module does not prevent the test file from running in another. To use your own example there....If TIE were to adopt the malicious rating of the RP-D-TestFile.exe any future executions of that file would be blocked prior to them entering into RP analysis. Making the test file rather useless beyond one test per environment. This is because TIE reputations are evaluated earlier in the workflow. Malicious TIE reps would be actioned and the file would be removed before it ever went to RealProtect for analysis. 

If you would like to specifically test the workflow of latest local reputation making it back into TIE I can offer a test?

Create a self-extracting archive from a text file with some random characters in it. This will ensure it is a new unknown hash. Execute the file and ensure it shows up on the TIE Reputations page. Change the reputation to malicous... You should not only see the file actioned on the endpoint but the local rep and composite rep should update. 

Thanks

Brian