How does Field Effect determine if a file is malicious?

Field Effect combines high-confidence static signature scanning with a signatureless machine learning model that scores over 3,400+ characteristics of the file itself — trained against millions of known malicious and benign files. That verdict is then cross-referenced against a repository of cloud-based file data, so we can identify malicious files with a high degree of accuracy. Anything above Field Effect’s confidence threshold will result in an Alert. Depending on the severity, we’ll alert-only, create a remediation plan for manual execution, or auto remediation (file only with the option to remediation the bootstrap, if found). 

Any Alert can be escalated to an ARO, but only the high severity ones will automatically generate an ARO.