If Sandboxing is enabled on the TIE server, the response to a reputation request includes a flag requesting the submission of the binary, if all conditions are met
If TIE server reputation response includes a flag with a sandboxing candidate tag, the endpoint sends the file to Threat Intelligence Exchange server. Then the TIE server sends the file to Intelligent Sandbox, IVX or IVX Cloud for scanning. Then, the TIE server polls for analysis reports until they are available.
You can enable Intelligent Sandbox, IVX and IVX Cloud sandbox reputation provider or from the Policy Catalog page in ePO - On-prem.
Intelligent Sandbox scans the file and can send file reputation results to the TIE server through Trellix DXL. IVX or IVX Cloud doesn't send responses over DXL. TIE polls IVX, or IVX Cloud for the results of sandboxing. The server also updates the database and sends the updated reputation information to all TIE server-enabled systems to immediately protect your environment. The TIE server or any other Trellix product can initiate this process. In either case, the TIE server processes the reputation and saves it in the database.