The TIE reports a composite reputation for a file as unknown when it doesn't have enough evidence to classify the file reputation as trusted or malicious.
Depending on the endpoint products available, the endpoint monitors files with unknown reputation. A sandbox engine might be used as well.
Age and prevalence of the file also affect its reputation since the file eventually increases its reputation to trusted if it is prevalent in the organization and if it is frequently used.
Application Control and Change Control > Application and Change Control 8.x > Trellix Application and Change Control 8.4.x - Windows Product Guide > Using the software > File and certificate reputation