Consider these three severity definitions when overriding reputations: Informational rules, warning rules, and blocking rules.
Informational override rules inform the administrator of the impact of the override. For example, it informs the administrator that the reputation override impacts on prevalent items when at least a prevalent file or certificate is selected.
Warning rules alert the administrator of a possible inconsistency or a major impact on the ecosystem. For example, it warns the administrator that an override reputation conflicts with Trellix GTI reputation when you try to override a known trusted with a known malicious reputation in Trellix GTI. If you receive a warning message and still want to do the override, click the checkbox to continue.
Blocking rules prevent the administrator from running an override that might harm the ecosystem. If the administrator receives a blocking rule message, the override can't continue. For example, the override is blocked when the Trellix GTI reputation is known trusted.
Evaluates when | Severity | Message displayed | Applicable (when) | Impact description |
|---|---|---|---|---|
Override to Known Trusted Installer | Block | Reputation override and composite reputation are in conflict. | Override to Known Trusted Installer and existing composite is Unknown or Malicious. | Number of selected files affected, usually 1. |
Always | Warn | This reputation override will have significant impact. | Sum of all file's enterprise count is greater than 500 (prevalence default value). | Sum of enterprise count of all selected files. |
File that has local reputation | Warn | This reputation override is in conflict with local reputation. | Override to Trusted and local reputation is Malicious or the other way around. | Number of selected files affected. |
File that has GTI reputation | Warn | The reputation override is in conflict with GTI reputation. | Override to Trusted and GTI reputation is Malicious or the other way around. | Number of selected files affected. |
Only for signed files | Warn | The reputation override is in conflict with the signed certificate reputation. | Override to Trusted and Certificate Enterprise reputation is Malicious or the other way around. | Number of selected files affected. |
Only for files that have children | Warn | The reputation override is in conflict with children files with malicious reputation previously generated. | Children files have Not Trusted composite reputation. | Number of children files in conflict. |
Always | Informational | The reputation override will have the same value as the existing one. | Override reputation is the same as existing enterprise reputation. | Number of selected files affected. |
Always | Informational | The reputation override will be done on prevalent items. | Files/s selected are prevalent. | Number of selected prevalent items. |
Override to Known Trusted Installer and has children | Informational | This override will only apply to new child files created in the future. | Override to Known Trusted Installer and has children files. | Number of children files. |
Evaluates when | Severity | Message displayed | Applicable when | Impact description |
|---|---|---|---|---|
Override to Known Trusted | Block | The reputation override will not be done because the GTI reputation is Known Trusted. | Override reputation is different from existing GTI Reputation. | Number of selected certificates affected: 1 |
Always | Block | The reputation override will not be done because the certificate is not end entity. | The selected certificate is not an End Entity. | Number of selected certificates affected: 1 |
Always | Warn | The reputation override will have significant impact. | The sum of enterprise count of every file signed by the selected certificate. | Sum of enterprise count |
Certificate has GTI Reputation | Warn | The reputation override is in conflict with GTI reputation. | Override to Trusted and GTI reputation is Malicious or the other way around. | Number of selected certificates affected: 1 |
Always | Warn | The reputation override will be done on revoked items. | Certificate was GTI revoked | Number of selected certificates affected: 1 |
Always | Warn | Conflict between reputation override and some associated files. | Composite reputation of signed files is in conflict with new override reputation. | Number of selected certificates affected: 1 |
Override to Malicious reputation | Warn | The reputation override might imply that the endpoint will ask for the file reputation anyways. | Override to Known Malicious, Most Likely Trusted, or Unknown. | Number of selected certificates affected: 1 |
Always | Informational | The reputation override will be done on prevalent items. | Certificate selected is prevalent. | Number of selected certificates affected: 1 |
Always | Informational | The reputation Override will have the same value as the existing one. | Override reputation is the same as existing enterprise reputation. | Number of selected certificates affected: 1 |