Dependencies, Limitations and Known Issues‌

It is not possible to mark an alert as false positive. However, the process can be added to Process Guard exclusion if deemed necessary to avoid receiving alerts.

Process Guard cannot detect or block processes from accessing LSASS if they run before the Process Guard module is initialized and running.

In some rare scenarios Process Guard can detect Endpoint Agent process xagt.exe and generate an event.

For a list of known issues in the current release, refer to the release notes.