cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

How file reputation is calculated?

Jump to solution

Hi Heroes,

Can you help provide more details for the below questions, thanks in advance!

1. File reputation is calculated by ENS ATP, TIE just stores the file reputation (also query GTI to get the reputation and deliver it via DXL ), is it correct?

2. If 1 is correct, may I know how exactly the file reputation is calculated by ATP? it's not done by just doing some kind of hash value calculating right? perhaps it maybe hard to explain the exact details, but I wish I can get more details here. thanks.

2 Solutions

Accepted Solutions
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: How file reputation is calculated?

Jump to solution

Hello @onedayoneapple 

Thanks for your post!

1. Correct.

2.Please check the below link:
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-adaptive-threat-protection-client-product-gu...

https://docs.mcafee.com/bundle/threat-intelligence-exchange-2.3.0-product-guide/page/GUID-A6A8C8F4-7...

You can also check the below community post to check more details:

https://community.mcafee.com/t5/Threat-Intelligence-Exchange-TIE/Trying-to-understand-TIE-2-0-reputa...

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

 

 

 

View solution in original post

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: How file reputation is calculated?

Jump to solution

The Reputation calculation is really a Math and it is very difficult to explain. ATP has it own calculation methodology to determine the file reputation. In general, a suspicious file is any program executable, Portable Document Format (PDF), or Android Application Package (.APK) file that has characteristics common to malicious files. 

Certain identifiers inside the executable to determine whether the program has particular characteristics normally associated with malware. 

ATP does the 5 level of scans before it classify a reputation. Pre.execution and Post execution

Pre Execution scan :

* OAS 
* JTI (rule based) BAL,Sec,PRod
* RP (real protect)

Post Execution scan :

* DAC (it creates a small container within the client machine to analyze the file)

* RP cloud (rp.gti.mcafee.com)

You can post your query in ENS forum, they may explain you in better about the process.

https://community.mcafee.com/t5/Endpoint-Security-ENS/bd-p/endpoint-security

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

View solution in original post

2 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 3

Re: How file reputation is calculated?

Jump to solution

Hello @onedayoneapple 

Thanks for your post!

1. Correct.

2.Please check the below link:
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-adaptive-threat-protection-client-product-gu...

https://docs.mcafee.com/bundle/threat-intelligence-exchange-2.3.0-product-guide/page/GUID-A6A8C8F4-7...

You can also check the below community post to check more details:

https://community.mcafee.com/t5/Threat-Intelligence-Exchange-TIE/Trying-to-understand-TIE-2-0-reputa...

Was my reply helpful?
If you find this post useful, Please give it a Kudos! l Also, Please don't forget to select "Accept as a solution" if this reply resolves your query!

 

 

 

View solution in original post

McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 3 of 3

Re: How file reputation is calculated?

Jump to solution

The Reputation calculation is really a Math and it is very difficult to explain. ATP has it own calculation methodology to determine the file reputation. In general, a suspicious file is any program executable, Portable Document Format (PDF), or Android Application Package (.APK) file that has characteristics common to malicious files. 

Certain identifiers inside the executable to determine whether the program has particular characteristics normally associated with malware. 

ATP does the 5 level of scans before it classify a reputation. Pre.execution and Post execution

Pre Execution scan :

* OAS 
* JTI (rule based) BAL,Sec,PRod
* RP (real protect)

Post Execution scan :

* DAC (it creates a small container within the client machine to analyze the file)

* RP cloud (rp.gti.mcafee.com)

You can post your query in ENS forum, they may explain you in better about the process.

https://community.mcafee.com/t5/Endpoint-Security-ENS/bd-p/endpoint-security

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

View solution in original post

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community