Hello @kristina.robinson ,
so let me try to answer your questions step-by-step
- Rootkit Scan: Yes we do. There is an own OnDemand Scan available on the endpoint. Thought this has been already fixed in the console.
- Potential Threats: What type of Events are shown exactly? And no, Secure Endpoint does not flag all .exe files as threats.
All Engines also include "guardrails" to prevent False/Positves. - File Scanning: The graphics below shows how Secure Endpoint protects against threats. For File Scanning the endpoint does several steps to detect malicious files. The Device Trajectory shows more information which engines processed a file and which engine triggered a detection. There are some aspects which have an impact on the detection. This can be the cache or configured exclusions.
So finally, Secure Endpoint does not mark executable code or office documents as threats. Especially system files, as we use the guardrails to prevent the system from false/positives. I would suggest to open a TAC case so someone takes a deeper look into your environment. Based on your description I cannot provide any reliable statement what is going on on your endpoint.
Greetings,
Thorsten
