Legacy Exclusions

By default, the Anti-Bot component inspects all entities except:

• Process - Name of an executable

• URL - Website URL

• Domain - Full Domain name

• Protection Name - Predefined malware signature

• IP range - Internal or external IP address

You can exclude specific domains from a rule. Click + to add the required domain you want to exclude from the rule.

Syntax

• * indicates a string or a character. For example, A* can be ADomain or AB or AAAA.

• ? indicates a character. For example, A? can be AA or AB or Ab.

For example:

Harmony Endpoint scans files when you create, open, or close them.

When you exclude a trusted process from inspection, it's file or network operation is not scanned. Exclude a process only if you are sure, it is not Malware.

Windows

You can exclude only .EXE files.

Syntax:

Fully qualified paths or an environment variable for the trusted executable.

Examples:

• C:\Program Files\MyTrustedDirectory\MyTrustedProgram.exe

• %programdata%\MytrustedProgram.exe

macOS

Syntax:

Fully qualified path for the trusted executable file.

Example:

/Applications/FileZilla.app/Contents/MacOS/filezilla

Files and Folder Exclusions are applied to all types of scans except contextual scan. The reason for configuring exclusions is to reduce the CPU usage of Anti-Malware.

Windows

Syntax:

Directory paths must end with a backlash.

Examples:

• Directory:

  • C:\Program Files\MyTrustedDirectory\

  • %programdata%\MyTrustedDirectory\

• Specific file:

  • C:\ProgramFiles\MyTrustedDirectory\excludeMe.txt

  • %programdata%\MyTrustedDirectory\excludeMe.txt

• File type:

  • *.exe

  • \\ServerName\Share\folder\file.txt or \\ip_addres\Share\folder\file.txt depending on a way file is attached.

  • C:\Program Files\MyTrustedDirectory**.exe(recursive exclusion - applies for all .exe in C:\Program Files\MyTrustedDirectory\ and all subfolders)

• For Harmony Endpoint client version E80.80 or higher, you can exclude MD5 hash from the scheduled malware scan. For example:

  • md5:0123456789012345

    • Exclude by hash in any folder

  • md5:0123456789012345:app.exe

    • Exclude by hash and exact file name

  • md5:0123456789012345:c:\folder\app.exe

    • Exclude by hash and full path

  • md5:0123456789012345:%ENV%\app.exe

    • Exclude by hash and environment variable

• For Harmony Endpoint client version E86.10 or higher, you can exclude URL from the scheduled malware scan. For example:

  • url:*.example.com

  • url:http://*.example.com

  • url:http://example.com/*

  • url:www.example.com/abc/123

  • url:*192.168.*

  • url:http://192.168.*

macOS

Syntax:

Directory path, a specific file, or a file type. Environment variables are not supported.

Example:

Trusted directory

• /Users/Shared/MyTrustedDirectory/

Specific file

• /Users/*/Documents/excludeMe.txt

File type

• *.txt

You can exclude some riskware files and infections from the scheduled malware scan on your computer.

Syntax

Infection name and protection name in your log.

Example:

• EICAR-Test-File

You can exclude specific folders, domains or SHA1 hashes from the Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE., Threat Extraction Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX. and Zero-Phishing protection.

Domain exclusions

• Relevant only for Harmony Endpoint extension for Browsers.

• To exclude an IP, in the Element field, enter IP address followed by subnet mask in the format <X.X.X.X>/ <subnet mask >. For example, to exclude a computer with IP address 192.168.100.30, enter 192.168.100.30/24.

• Domain exclusions must be added without http, https or any other special characters except asterisk (*).

  Domain exclusions can be added with or without www.

• Sub-domain exclusions are supported.

  Exclusion of a domain will exclude all its subdomains as well.

For example:

SHA1 exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

  For Harmony Endpoint version E86.40, SHA1 exclusion is supported on Harmony Endpoint extension for browsers as well (not including Internet Explorer). SHA1 can be used to exclude downloaded files from File Protection and local HTML files from Zero Phishing.

• It is not supported with Internet Explorer.

• File Reputation exclusions are set by SHA1.

• Macro exclusion - To exclude the office files which includes a macro, set exclusions for the SHA1 hash of the macro.

  For example, if an exclusion is set to SHA1 hash of the macro, all the files which includes this macro are excluded.

  Notes - This is supported with Endpoint Security Client Application installed on end-user computers to monitor security status and enforce security policies. version E88.00 or higher. To view the hash of a macro, see the Description in the Forensic Details section in the Card of the event. For more information see, Adding Exclusions from Logs.

Folder exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

• Folder path cannot contain environment variables.

• When you exclude a folder, enter the folder as a windows path. For example:

  C:\Program Files\MyTrustedDirectory\

• If the path of created file begins with exclusion, it will be excluded.

• For Endpoint Security Client version E87.10 or higher, if the value of exclusion start with FileEx:\\ then the value will be treated as path to the file.

  To exclude specific type of files in a folder, use the following format:
  FileEx:\\<Path_to_directory>\*.<file_extension>.
  For example, FileEx:\\D:\mydir\*.xls will exclude all XLS files in D:\mydir folder.

• Folder exclusions support wildcards. These wildcards are supported:

  ? - Each question mark masks one character.

  * - Each star masks zero or more characters.

• It is not advised to add * in the middle of path exclusions, as it may hurt the performance.

• Exclude network files by path \\ServerName\Share\folder\.This excludes all files located under \ServerName\Share\folder\\.

You can exclude these elements from the Anti-Exploit protection:

• Protection Name - Predefined malware signature

• Process - To exclude an executable

Currently there are five different Anti-Exploit protections available. Following is a list of the protections per-name.

Syntax for exclusions:

Excluding a protection means that files will not be monitored by Anti-Exploit.

• Process and protection

  • C:\Program Files\MyTrustedDirectory\excludeMe.exe

  • Gen.Exploiter.ROP

• Protection

  • Gen.Exploiter.ROP

You can exclude these elements from the Anti-Ransomware and Behavioral Guard protection:

• Folder – To exclude a folder or non-executable files

• Process - To exclude an executable by element, MD5, and signer.

• Certificate - To exclude processes based on the company that signs the certificate.

• Protection - To exclude signature by it's name.

Syntax:

• Folder can contain environment variables

• Folder cannot contain wildcards (*)

• By default, sub-folders are included.

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

Windows

Syntax:

• You must specify the process name or full path to the process

• Exclusion can contain environment variables

• Wildcards are supported.

  Note - This is supported with Endpoint Security client version E86.70 and higher.

Examples:

• Full path

  • C:\Program Files\MyTrustedDirectory\

• Process

  • C:\Program Files\MyTrustedDirectory\ExcludeMe.exe

• Certificate

  • Microsoft

• md5: 0123456789012345

• Protection: win.blocker

macOS

Syntax:

• You must specify full path or wildcard

• Path or file name can contain wildcards

• Paths are case sensitive

Examples:

• Full path or Xcode exclusion:
  :/Appliations/Xcode.app/Contents?MacOS/Xcode

• To cover all Xcode-related executables (not only GUI app):
  /Applicatoins/Xcode.app/*

Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

You can exclude these elements from monitoring:

• Process - To exclude an executable by element, MD5 and signer.

• Certificate - To exclude processes based on the company that signs the certificate.

Syntax:

• Process can be excluded by name only, or by full path.

  For example C:\Program Files\MyTrustedDirectory\excludeMe.exe

• Full path can contain environment variables.

• Full path CANNOT contain wildcards

• Certificate

  • Microsoft

• md5:0123456789012345

  • Exclude a process by hash.

• Excluding a Certificate / Process means that files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

You can exclude a file or process from quarantine. You can define the exclusion by these criteria: certificate, file, folder, MD5 hash, SHA1 hash, and file extension. When an element is excluded from quarantine, even if there is a detection of malware, the file is not quarantined.