Analysis & Response Exclusions

Monitoring Exclusions

You can exclude these elements from monitoring:

  • Process - To exclude an executable by element, MD5 and signer.

  • Certificate - To exclude processes based on the company that signs the certificate.

Syntax:

  • Process can be excluded by name only, or by full path.

    For example C:\Program Files\MyTrustedDirectory\excludeMe.exe

  • Full path can contain environment variables.

  • Full path CANNOT contain wildcards

  • Certificate

    • Microsoft

  • md5:0123456789012345

    • Exclude a process by hash.

  • Excluding a Certificate / Process means thBAat files modified / created by a certain process will not be backed up, or monitored by Anti-Ransomware and Behavioral Guard.

Remediation

Excluding a file / folder / certificate from quarantine means that even if it is detected by one of the following blades: Threat Emulation / Anti-Ransomware / Anti-Bot, the file will not be quarantined:

  • Full path can contain wildcards (*).

  • Full path CANNOT contain environment variables.

Quarantine Exclusions

You can exclude a file or process from quarantine. You can define the exclusion by these criteria: certificate, file, folder, MD5 hash, SHA1 hash, and file extension. When an element is excluded from quarantine, even if there is a detection of malware, the file is not quarantined.