Forensics Monitoring Exclusions

Forensics -> Monitoring Exclusions

You can exclude these elements from monitoring:

• Process - To exclude an executable by element, MD5 and signer.

• Certificate - To exclude processes based on the company that signs the certificate.

Syntax:

• Process can be excluded by name only, or by full path.

  For example C:\Program Files\MyTrustedDirectory\excludeMe.exe

• Full path can contain environment variables.

• Full path CANNOT contain wildcards.

• Certificate

  • Microsoft

• md5:0123456789012345

  • Exclude a process by hash.

• Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.