Does Path Exclusion Also Exclude Processes Within It?

[AndyIT]

Hi All,

I have created some path exclusions on my AMP console but my question is this, within a path exclusion will this also exclude any processes from being scanned which launch from within said path?

Example:

Path Exclusion

C:\Program Files (x86)\Visual Studio 14.0\

a few folders deeper within that path there is an .exe will that be excluded from the scans and if so will any child process it calls up be excluded also?

Many Thanks.

[majacob2]

AndyIT,

These are 2 different types of exclusions, you would need PATH exclusions to exclude PATHs, Process Exclusions to exclude processes and child process exclusion is an option for Process Exclusions.

Thanks!

[Troja007 · Accepted solution]

Hello @AndyIT,

yes, a path exclusion will stop the connector to monitor (generating data for the backend engines) and scanning anything inside the configured path exclusion. From a security and visibility perspective, having as less as possible exclusions makes sense. 

For Development environments, i assume this is one, it is most time necessary to exclude developer tools.
From a best practice view:

• Configure as less as possible exclusions.
• Generate an own group, policy and exclusion list for Developer endpoints.

There are two tools available to figure out necessary exclusions on the endpoint:

• AMP tuning tool which processes diagnostic packages: https://github.com/CiscoSecurity/amp-05-windows-tune
• AMP Health Checker which gives you a live view into the connector: https://github.com/CiscoSecurity/amp-05-health-checker-windows

Greetings,
Thorsten