I have a few questions about the TIE Reputations in ePO. After running the TIEScanner, which is unsupported as I am aware, I have just under 45.000 files in my TIE database. Some of these files have a GTI reputation, others do not. At this point, it is unclear to me why some files have GTI reputation "Not Set" and others have a reputation of "Not Available". The GTI connection was always available during the TIEScanner process and almost all files in my TIE Server come from clean Windows 7 and Windows 8 installations. In other words, the whole setup is very stable and I imagine that GTI reputations are available for all files in fresh Windows installations as they are benign files that can be found on almost all workstations in the world.
Another thing that strikes me about the TIE Reputations is that when I sort the files in alphabetical order, I get around 275 files with no information as can be seen in the screenshot below:
Interestingly, there is no file name, no certificate information or anything else indicating which files I'm looking at. In some cases however, there actually IS a TIE reputation available for those files. That means there is a hash for it and sure enough, this is displayed under the file details. But there is no indication of which file this is. When I check the "Where Has File Run" option, it becomes clear that my Web Gateway has encountered these files (yeah, I connected that one too). I read that Web Gateway cannot publish any information to DXL yet, but the files are in the TIE database sure enough...
So these are my questions:
1. Why isn't there a GTI reputation for all default Windows files?
2. What's the difference between "Not Set" and "Not Available" reputations?
3. Is the Web Gateway file reputation going to improve in future releases? It would be very helpful if there was an easy way to identify files seen by specific products under TIE Reputations
4. Is it possible to remove reputation records from the TIE Database? In some scenario's, I think this would be helpful. For example to remove the MWG reputations that are pretty useless at this point in time, but in other cases as well.