If Intelligent Sandbox is enabled on the TIE server, the response to a reputation request includes a flag requesting the submission of the binary, if all conditions are met
If TIE server reputation response includes a flag with a sandboxing candidate tag, the endpoint sends the file to Threat Intelligence Exchange server. Then the TIE server sends the file to Intelligent Sandbox for scanning. Then, the TIE server polls for analysis reports until they are available.
You can enable Intelligent Sandbox sandbox reputation provider or both from the Policy Catalog page in ePO - On-prem.
Intelligent Sandbox scans the file and can send file reputation results to the TIE server through Trellix DXL. The server also updates the database and sends the updated reputation information to all TIE server-enabled systems to immediately protect your environment. The TIE server or any other Trellix product can initiate this process. In either case, the TIE server processes the reputation and saves it in the database.