Legacy Exclusions

By default, the Anti-Bot Check Point Software Blade on a Security Gateway that blocks botnet behavior and communication to Command and Control (C&C) centers. Acronyms: AB, ABOT. component inspects all entities except:

• Process - Name of an executable

• URL - Website URL

• Domain - Full Domain name

• Protection Name - Predefined malware signature

• IP range - Internal or external IP address

You can exclude specific domains from a rule. Click + to add the required domain you want to exclude from the rule.

Syntax

• * indicates a string or a character. For example, A* can be ADomain or AB or AAAA.

• ? indicates a character. For example, A? can be AA or AB or Ab.

For example:

If you enter	It excludes these	It does not exclude these
www.domain.com	https://www.domain.com http://www.domain.com	https://domain.com http://domain.com https://sub.domain.com http://sub.domain.com
domain.com	https://www.domain.com http://www.domain.com https://domain.com http://domain.com https://sub.domain.com http://sub.domain.com	-
sub.domain.com	https://sub.domain.com http://sub.domain.com	https://sub2.domain.com
*.domain.com	Sub-domain of domain.com such as: https://sub1.domain.com http://sub2.domain.com

Harmony Endpoint scans files when you create, open, or close them.

When you exclude a trusted process from inspection, it's file or network operation is not scanned. Exclude a process only if you are sure, it is not Malware.

Best Practice - We recommend excluding a process if: It's behaviour is abnormal. It's performance is slow after you installed the Anti-Malware A component of the Endpoint Security client that protects against known and unknown viruses, worms, Trojan horses, adware, and keystroke loggers. blade. A false-positive is detected.

Windows

You can exclude only .EXE files.

Syntax:

Fully qualified paths or an environment variable for the trusted executable.

Examples:

• C:\Program Files\MyTrustedDirectory\MyTrustedProgram.exe

• %programdata%\MytrustedProgram.exe

macOS

Syntax:

Fully qualified path for the trusted executable file.

Example:

/Applications/FileZilla.app/Contents/MacOS/filezilla

Files and Folder Exclusions are applied to all types of scans except contextual scan. The reason for configuring exclusions is to reduce the CPU usage of Anti-Malware.

Note - Files and folders must be excluded only if they are located in a Trusted zone or are considered a low-risk target for viruses.

Windows

Syntax:

Directory paths must end with a backlash.

Examples:

• Directory:

  • C:\Program Files\MyTrustedDirectory\

  • %programdata%\MyTrustedDirectory\

• Specific file:

  • C:\ProgramFiles\MyTrustedDirectory\excludeMe.txt

  • %programdata%\MyTrustedDirectory\excludeMe.txt

• File type:

  • *.exe

  • \\ServerName\Share\folder\file.txt or \\ip_addres\Share\folder\file.txt depending on a way file is attached.

  • C:\Program Files\MyTrustedDirectory**.exe(recursive exclusion - applies for all .exe in C:\Program Files\MyTrustedDirectory\ and all subfolders)

• For Harmony Endpoint client version E80.80 or higher, you can exclude MD5 hash from the scheduled malware scan. For example:

  • md5:0123456789012345

    • Exclude by hash in any folder

  • md5:0123456789012345:app.exe

    • Exclude by hash and exact file name

  • md5:0123456789012345:c:\folder\app.exe

    • Exclude by hash and full path

  • md5:0123456789012345:%ENV%\app.exe

    • Exclude by hash and environment variable

• For Harmony Endpoint client version E86.10 or higher, you can exclude URL from the scheduled malware scan. For example:

  • url:*.example.com

  • url:http://*.example.com

  • url:http://example.com/*

  • url:www.example.com/abc/123

  • url:*192.168.*

  • url:http://192.168.*

Notes for URL exclusions- The * character replaces any sequence that contains zero or more characters. The www. character sequence at the beginning of an exclusion mask is interpreted as a *. sequence. If an exclusion mask does not start with the * character, the content of the exclusion mask is equivalent to the same content with the *. prefix. If an exclusion mask ends with a character other than / or *, the content of the exclusion mask is equivalent to the same content with the /* postfix. If an exclusion mask ends with the / character, the content of the exclusion mask is equivalent to the same content with the /*. postfix. The character sequence /* at the end of an exclusion mask is interpreted as /* or an empty string. URLs are verified against an exclusion mask, taking into account the protocol (http or https).

Note - For Windows, files and folder names are not case-sensitive.

macOS

Syntax:

Directory path, a specific file, or a file type. Environment variables are not supported.

Example:

Trusted directory

• /Users/Shared/MyTrustedDirectory/

Specific file

• /Users/*/Documents/excludeMe.txt

File type

• *.txt

Note - For macOS, files and folder names are case-sensitive.

You can exclude some riskware files and infections from the scheduled malware scan on your computer.

Best Practice: Exclude when the specific software is allowed. As a temporary exclusion when there is a false positive detection.

Syntax

Infection name and protection name in your log.

Example:

• EICAR-Test-File

Notes - The infection name is case-sensitive. If you get a file protection detection, share the file with Check Point to resolve the file protection.

You can exclude specific folders, domains or SHA1 hashes from the Threat Emulation Check Point Software Blade on a Security Gateway that monitors the behavior of files in a sandbox to determine whether or not they are malicious. Acronym: TE., Threat Extraction Check Point Software Blade on a Security Gateway that removes malicious content from files. Acronym: TEX. and Zero-Phishing protection.

Domain exclusions

• Relevant only for Harmony Endpoint extension for Browsers.

• To exclude an IP, in the Element field, enter IP address followed by subnet mask in the format <X.X.X.X>/ <subnet mask >. For example, to exclude a computer with IP address 192.168.100.30, enter 192.168.100.30/24.

• Domain exclusions must be added without http, https or any other special characters except asterisk (*).

  Domain exclusions can be added with or without www.

• Sub-domain exclusions are supported.

  Exclusion of a domain will exclude all its subdomains as well.

For example:

If you enter	It excludes these	It does not exclude these
www.domain.com	https://www.domain.com http://www.domain.com	https://domain.com http://domain.com https://sub.domain.com http://sub.domain.com
domain.com	https://www.domain.com http://www.domain.com https://domain.com http://domain.com https://sub.domain.com http://sub.domain.com	-
sub.domain.com	https://sub.domain.com http://sub.domain.com	https://sub2.domain.com
*.domain.com	Sub-domain of domain.com such as: https://sub1.domain.com http://sub2.domain.com

SHA1 exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

  For Harmony Endpoint version E86.40, SHA1 exclusion is supported on Harmony Endpoint extension for browsers as well (not including Internet Explorer). SHA1 can be used to exclude downloaded files from File Protection and local HTML files from Zero Phishing.

• It is not supported with Internet Explorer.

• File Reputation exclusions are set by SHA1.

• Macro exclusion - To exclude the office files which includes a macro, set exclusions for the SHA1 hash of the macro.

  For example, if an exclusion is set to SHA1 hash of the macro, all the files which includes this macro are excluded.

  Notes - This is supported with Endpoint Security Client Application installed on end-user computers to monitor security status and enforce security policies. version E88.00 or higher. To view the hash of a macro, see the Description in the Forensic Details section in the Card of the event. For more information see, Adding Exclusions from Logs.

Folder exclusions -

• Relevant only for Threat Emulation blade (File system monitoring).

• Folder path cannot contain environment variables.

• When you exclude a folder, enter the folder as a windows path. For example:

  C:\Program Files\MyTrustedDirectory\

• If the path of created file begins with exclusion, it will be excluded.

• Folder exclusions support wildcards. These wildcards are supported:

  ? - Each question mark masks one character.

  * - Each star masks zero or more characters.

• It is not advised to add * in the middle of path exclusions, as it may hurt the performance.

• Exclude network files by path \\ServerName\Share\folder\.This excludes all files located under \ServerName\Share\folder\\.