Heads Up :
The post you are writing will appear in a public forum. Please ensure all content is appropriate for public consumption. Review the employee guidelines for the community here.
If you open a TAC case, they can collect some logs and recommend specific Exploit Prevention exclusions that would allow you to use the engine but exclude a specific DLL. You might also want to try upgrading to a newer version of the connector. The i...
This is likely caused by the Exploit Prevention engine. Even in Audit mode it performs memory monitoring tasks for alerting that could potentially interfere like this. I suggest disabling the Exploit Prevention engine to test and see if the issue is ...
There is no way to achieve this through the UI, but you can use the /v1/computers/{connector_guid}/trajectory API endpoint. More information is available here:https://developer.cisco.com/docs/secure-endpoint/v1-api-reference-computer/Thanks,
Matt
Looks like we made a change early last month for this. The previously applied exclusions should work with no changes but any new changes would require the update.
-Matt
@Ken Stieers CSIDL_PROGRAM_FILES/Cisco/AMP seems to work just fine in my environment. CSIDL_BASEDIR as in your photo looks like it needs a / at the end to be taken. You can see the same with FOLDERID.
Thanks,
Matt