topic Re: how to exclude process without path in Endpoint Security

how to exclude process without path

Pruthvirajnasagoni89418 — Mon, 14 Sep 2020 10:38:18 GMT

how to exclude process without path

Re: how to exclude process without path

Matthew Franks — Mon, 14 Sep 2020 11:57:38 GMT

You can exclude a process by hash under Management > Exclusions. Create/edit an exclusion set, click Add Exclusion > File and you'll see the following message, "You can provide path and/or SHA-256. If you specify both a path and SHA-256 then both conditions must be met for the process to be excluded.". For more information, I suggest referring to the User Guide in the AMP Documentation Page.

Thanks,
Matt

Re: how to exclude process without path

Pruthvirajnasagoni89418 — Mon, 14 Sep 2020 17:21:56 GMT

If we don't know what is the Hash of process or full path , does is it work only by mentioning example ?

Re: how to exclude process without path

Matthew Franks — Mon, 14 Sep 2020 18:01:21 GMT

Can you clarify what you mean by mentioning example? I don't understand the question.

Re: how to exclude process without path

Troja007 — Tue, 15 Sep 2020 08:04:54 GMT

Hello @Pruthvirajnasagoni89418,

today you can only configure a process exclusion with the full patch to the executable. There is no option to classify an executable without path, so the exclusion would work independent from the executables path.

If the executable is located in several directories, sorry to say, you have to generate multiple exclusions. I would suggest generating an own exclusion list for this.

You may also ping your Cisco representative to open a Feature Request for this.

Greetings,
Thorsten