Enhance your threat intelligence and detection platform by enabling an external reputation provider in your environment through OpenDXL.
If the endpoint doesn't detect a match from other reputation providers, it can allow or block files based on the trust level assigned to the external reputation provider as a fallback rule. This new external reputation provider allows you to differentiate between automated integrations and actual manual enterprise overrides. This is useful to avoid false-positives, as this new provider acts as a fallback and it will be considered only if there is no other definitive reputation for the file. Presently, an enterprise reputation has precedence over any other provider, potentially causing issues when Trellix GTI,Intelligent Sandbox, IVX or IVX Cloud have conflicting reputations.
If you already have an OpenDXL integration which sets enterprise reputations, it's advisable to migrate to external reputation.