The TIE reports a composite reputation for a file as unknown when it doesn't have enough evidence to classify the file reputation as trusted or malicious.
Depending on the endpoint products available, the endpoint monitors files with unknown reputation. A sandbox engine might be used as well.
Age and prevalence of the file also affect its reputation since the file eventually increases its reputation to trusted if it is prevalent in the organization and if it is frequently used.
For more information, see 000013593.