Smart Exclusions

With Smart Exclusions, administrators can:

  • Set exclusions to all capabilities and operating systems at once.

  • Use standard syntax across all exclusion types.

  • Use a wider range of wildcard characters for nuanced and customized exclusion patterns.

  • Easily enable or disable exclusions with a simple toggle button, without the need to delete exclusions temporarily.

Note:

Smart Exclusions are supported only with Endpoint Security Client version E87.52 and higher for Windows, and E87.50 and higher for macOS.

Adding Exclusions to a Specific Rule

  1. Go to Policy > Threat Prevention > Policy Capabilities.

  2. Select the rule for which the exclusion is to be created.

  3. In the Capabilities & Exclusions pane, click Exclusions Center.

  4. Click Go to Smart Exclusions.

  5. Click Create New Exclusion.

  6. Select the exclusion type:

    • Single-method exclusion - Add an exclusion for only one exclusion type.

    • Multi-method exclusion - Add exclusions for multiple types of exclusions.

  7. Enter a name for the exclusion and make sure the status is Enabled.

  8. Apply the exclusion to all supported capabilities, or select Select specific and choose the required capabilities from the Capabilities list.

  9. (Optional) To enable Chained Exclusions, in the Chained Exclusion are available for section, turn on Inherit exclusion to child processes.

    This automatically excludes all the child processes of the excluded process.

    Note:

    With the Endpoint Security Client version E88 and higher, Chained Exclusions support only the Forensics Monitoring capability.

  10. Enter the exclusion details and click OK.

    Note:

    For supported syntax and capabilities for exclusion types, see sk181679.

  11. Click Save & Install.

Note:

A Single-method exclusion can be changed to a Multi-method exclusion. See Managing Exclusions.

Adding Global Exclusions

  1. Go to Policy > Threat Prevention > Global Exclusions.

  2. Click Go to Smart Exclusions.

  3. Click Create New Exclusion.

  4. Select the exclusion type:

    • Single-method exclusion - Add an exclusion for only one exclusion type.

    • Multi-method exclusion - Add exclusions for multiple types of exclusions.

  5. Enter the required exclusion details.

  6. Click Save.

    The exclusions are automatically enforced on the client without installing the policy.

Note:

A Single-method exclusion can be changed to a Multi-method exclusion. See Managing Exclusions.

Migrating Legacy Exclusions

Important:

Best Practice - Check Point recommends following these steps before migrating to Smart Exclusions:

  1. Go to Policy > Threat Prevention > Policy Capabilities.

  2. Pick a rule to test the migration and clone the rule.

  3. Place the newly created rule at the top.

  4. Under Applied To, select a test group.

  5. Click Exclusion Center for the newly created rule and export the legacy exclusions for backup purposes.

  6. For the newly created rule, migrate to Smart Exclusions.

  7. Click Save and Install.

  8. Go to Logs and filter the logs for the computer in the test group. Verify there are no false positives and all the detections are excluded correctly.

  9. If there are issues, contact Check Point Support.

  10. Perform the steps for each rule one at a time.

  11. Repeat the process for Global Exclusions.

To migrate legacy exclusions for a rule

  1. Go to Policy > Threat Prevention > Policy Capabilities.

  2. Select the rule.

  3. In the Capabilities & Exclusions pane, click Exclusions Center.

  4. To migrate legacy global exclusions, go to Policy > Threat Prevention > Global Exclusions.

  5. Click Go to Smart Exclusions.

To migrate all legacy exclusions

  1. Click Migrate from Legacy Exclusions (available only if there are no exclusions), or click All exclusions from legacy. The Import All Legacy Exclusions window appears.

  2. (Recommended) To remove all the legacy exclusions after migrating to Smart Exclusions, select Remove all the imported exclusions from legacy.

  3. Click Import.

To migrate specific exclusions

  1. Click Select exclusions from legacy. The Transfer from Legacy - Select Exclusions window appears.

  2. Select the exclusions.

  3. Click OK. The exclusions are added to Smart Exclusions.

  4. For a specific rule, click OK and Save & Install.

  5. For global exclusions, click Save. The exclusions are automatically enforced on the client without installing the policy.

Importing and Exporting Exclusions

Exclusions can be imported or exported in the JSON format, either for a specific rule or as global exclusions.

  1. To import or export exclusions for a rule, go to Policy > Threat Prevention > Policy Capabilities, select the rule, and in the Capabilities & Exclusions pane, click Exclusions Center.

  2. To import or export global exclusions, go to Policy > Threat Prevention > Global Exclusions.

  3. Click Go To Smart Exclusions.

  4. To import exclusions, click Import Files, browse, and select the import file in the JSON format.

  5. For a specific rule, click OK and Save & Install.

  6. For global exclusions, click Save.

    The exclusions are automatically enforced on the client without installing the policy.

  7. To export exclusions, click the export icon. The file is exported in the JSON format.