We do have a team of folks, called the Threat Research team, who go through all the unknowns in the database to classify them.  I'm not sure if they used data on what people have marked it manually in their console though, so let me find out.

---

Hello,

 

We do not have a process to automatically change the determinations of files that users create overrides for as you are describing. We do keep an eye out for Unknown files that have been seen on a large number of PCs in our user base, which is one of many ways that we identify files to be whitelisted. 

 

That a file is classified as Unknown should not be a concern, it simply means that the file has not been classified as Bad and has not been specifically whitelisted. Because our main focus is on classifying malicious files and not whitelisting, there will always be numerous files that remain Unknown. Files that are Unknown should only be a concern if there is a suspected infection or if the file is associated with an application that there appears to be an issue with. Support should be contacted and logs collected for analysis if there is suspected malware or application issues. If you our concerned about the Unknowns on your system you can send us your Undertermined software report through the support system.

 

-Dan

---

Thank you both for replies. I will need to think on how this changes how I manage my clients and the effort in making known files good.

 

Thanks

 

Mark

---