Threat Emulation, Threat Extraction, and Zero-Phishing Exclusions

Threat Emulation, Threat Extraction, and Zero-Phishing Exclusions

You can exclude specific folders, domains or SHA1 hashes from the Threat Emulation, Threat Extraction and Zero-Phishing protection.

Domain exclusions

• Relevant only for Endpoint Security extension for Browsers.

• To exclude an IP, in the Element field, enter IP address followed by subnet mask in the format <X.X.X.X>/ <subnet mask >. For example, to exclude a computer with IP address 192.168.100.30, enter 192.168.100.30/24.

• Domain exclusions must be added without http, https or any other special characters except asterisk (*).

  Domain exclusions can be added with or without www.

• Sub-domain exclusions are supported.

  Exclusion of a domain will exclude all its subdomains as well.

For example:

SHA1 exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

  For Endpoint Security version E86.40, SHA1 exclusion is supported on Endpoint Security extension for browsers as well (not including Internet Explorer). SHA1 can be used to exclude downloaded files from File Protection and local HTML files from Zero Phishing.

• It is not supported with Internet Explorer.

• File Reputation exclusions are set by SHA1.

• Macro exclusion - To exclude the office files which includes a macro, set exclusions for the SHA1 hash of the macro.

  For example, if an exclusion is set to SHA1 hash of the macro, all the files which includes this macro are excluded.

  ../../Images/Notes/Note.png

  Notes - This is supported with Endpoint Security Client version E88.00 or higher. To view the hash of a macro, see the Description in the Forensic Details section in the Card of the event. For more information see, Adding Exclusions from Logs.

Folder exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

• Folder path cannot contain environment variables.

• When you exclude a folder, enter the folder as a windows path. For example:

  C:\Program Files\MyTrustedDirectory\

• If the path of created file begins with exclusion, it will be excluded.

• For Endpoint Security Client version E87.10 or higher, if the value of exclusion start with FileEx:\\ then the value will be treated as path to the file.

  To exclude specific type of files in a folder, use the following format:

  FileEx:\\<Path_to_directory>\*.<file_extension>.

  For example, FileEx:\\D:\mydir\*.xls will exclude all XLS files in D:\mydir folder.

• Folder exclusions support wildcards. These wildcards are supported:

  ? - Each question mark masks one character.

  * - Each star masks zero or more characters.

• It is not advised to add * in the middle of path exclusions, as it may hurt the performance.

• Exclude network files by path \\ServerName\Share\folder\.This excludes all files located under \ServerName\Share\folder\\.