File reputation indicates the reputation of a file. Process reputation indicates the reputation of a running process and can change over time.
Pre-execution scanning and reputation sources, such as the TIE server and Trellix GTI, determine the reputation of a file. Multiple factors, including the reputation of the primary executable of the process and its parent, and post-execution scanning, determine the reputation of a process. Post-execution scanning includes ML Protect behavioral scanning, ATP rules, Dynamic Application Containment, and reputation updates from the TIE server.
The reputation of a process starts as the lowest local reputation of the primary executable of the process and its parent. For example, if a processes' parent has a reputation of Unknown (50) and its primary executable has a reputation of Known Trusted (99), the reputation of the process is Unknown (50).
A processes' reputation changes over time due to reputation update events and usually goes down. For example, if a process loads a library that initially has a local file reputation of Unknown (50), the reputation of the process is reduced to Unknown (50). Similarly, if post-execution scanning later deems the file Known Malicious (1), the scanner recalculates the process reputation to Known Malicious (1) and ATP takes the configured action for that reputation level for the process.
If ATP scanning is blocking processes that you want to allow to run, you can exclude them from scanning. If the TIE server is available, you can change the reputation of the file to a level that allows it to run, like Known Trusted (99), instead of creating exclusions.