Reverse AMP File Conviction

[ITGuyCSI25]

Hey People,

My Engineering department makes custom applications, and uses GIT sources for applications. Most of the time they're doing things as will, and AMP is convicting these applications as Malicious before I can whitelist the applications. How can i reverse the convictions? Adding the applications to the application allowed list doesn't stop the AMP from blocking them and quarantining the applications.

Any help would be appreciated, thanks.

[ppreenja]

Hello,

You might need to check on the event details to see which engine (such as MAP or Exprev etc.) is blocking the application.

You can try and make any of the below methods to avoid any conviction for the files:

• Scan Exclusions: Files/Path is not scanned, not hashed - related to any engine doing file scanning. 
• Process Exclusion: Anything done by a running process is not scanned. 
• Application Whitelisting: has an impact on two things
  • Behavioral Engines (e.g. Machine Learning) exclude the hash
  • The connector does no cloud lookup for the hash
• Engine specific process exclusions: The exclusion works for a specific engine

I hope the above helps.

Cheers,

Pratham