I just noticed that clicking “Don’t isolate again” for Auto-Containment puts file on its list with Ignore status and doesn’t also apply File Rating status of “Unrecognized” to it. Wouldn’t it make more sense to apply “Unrecognized” File Status to files excluded like this?
Because current default condition just ENTIRELY and totally puts that file on the ignore list. It will never ever again be “challenged” even if its status changes. However, if it had “Unrecognized” also applied as File Rating it would.
Because if it has no status condition it’s just 100% ignored. If it has “Unrecognized” condition it will only ignore it for as long as it’s unrecognized. If it changes status to Malicious at one point, it would still be detected and dealt with.