cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
676
Views
5
Helpful
1
Replies

File exclusions vs Folder (Directory exclsuions)

Hi Team,

 

As far i know with McAfee and Symantec, Exclusion consideration is like if you keep C:\Test ( File exclusion) , if you keep C:\Test\(Directory Exclusion) , How does it work in AMP? is this is the same ? does it make any different considerations

 

Note: If you have any special extension C:\Test\ .dll , C:Test\.exe need to specify that is i know.

 

C:\Test\* --> what make difference here as well --> does it exclude all files or all directories as well  or both ?

 

Regards

 

Pruthvi

1 REPLY 1
Troja007
Cisco Employee

Hello @Pruthvirajnasagoni89418,

AMP works in this way.

  • Path Exclusion: if configured, the path is excluded from all engines, regardless which process is accessing the path.
  • Process Exclusion: If configured, the process is excluded from all the engines.

You may also take a look on the Exclusions Best Practices Guide: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/213681-best-practices-for-amp-for-endpoint-excl.html

 

Greetings,

Thorsten

Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: ISE Demo (100%)

Content for Community-Ad