Exclusion or Executable page

You can exclude an executable from Access Protection at the policy level — or include or exclude an executable from Access Protection at the rule level.

Access Protection settings apply to Windows and Linux systems only.

When specifying exclusions and inclusions, consider the following:

You must specify at least one identifier: File name or path, MD5 hash, or Signer.
If you specify more than one identifier, all identifiers apply.
If you specify more than one identifier and they don't match, the exclusion or inclusion is invalid. For example, the file name and MD5 hash don't apply to the same file.
Exclusions and inclusions are case insensitive.
Wildcards are allowed for all except MD5 hash.
Access Protection exclusions don't apply to the Windows Services subrule type.

Option definitions
Section	Option	Definition
Properties	Name (Windows & Linux only)	Specifies the name that you call the executable. This field is required with at least one other field: File name or path, MD5 hash (Windows only), or Signer (Windows only).
	Inclusion status (Windows & Linux only)	Determines the inclusion status for the executable. Include — Triggers the rule if the executable violates a subrule. Exclude — Doesn't trigger the rule if the executable violates a subrule. Inclusion status only appears when adding an executable to a rule or the target for the Processes subrule.
	File name or path (Windows & Linux only)	Specifies the file name or path of the executable to add or edit. The file name or path can include wildcards.
	MD5 hash (Windows only)	Indicates the MD5 hash (32-digit hexadecimal number) of the process.
	Signer (Windows only)	Enable digital signature check — Guarantees that code hasn't been changed or corrupted since it was signed with cryptographic hash. If enabled, specify: Allow any signature — Allows files signed by any process signer. Signed by — Allows only files signed by the specified process signer. A signer distinguished name (SDN) for the executable is required and it must match exactly the entries in the accompanying field, including commas and spaces. The process signer appears in the correct format in the events in the log files. For example: `C=US, ST=WASHINGTON, L=REDMOND, O=MICROSOFT CORPORATION, OU=MOPR, CN=MICROSOFT WINDOWS` Note You can enter `S` for the state or ProvinceName object identifier, but the element automatically appears as `ST` in the log files. From Trellix ePO - On-prem Event Log, copy and paste the details from the Source Signer Process field from an Trellix ENS event.
	Notes	Provides more information about the item.