Follow these guidelines when adding file or folder path exclusions to the real-time indicator detection file and folder exclusion list:
Tip
Trellix recommends that you minimize the number of exclusions. You can reduce exclusions by using custom policies targeted at specific OS versions and configurations.
Caution
On macOS, the total number of all file and folder exclusions must not exceed 100. The xAgent will ignore additional entries.
There are two possible values that you can exclude from real-time event monitoring: excludedPath and excludedProcessName. See events Section Settings for more information.
Exclusion Value
Description
excludedPaths
This value excludes specific files or folders from real-time event monitoring. File and folder exclusions apply to file write events only.
excludedProcessNames
This value excludes specific processes from Windows real-time event monitoring, including registry, url, file, and image load events. You can specify the full path of the executable file you want to exclude from real-time event monitoring by entering the absolute file path, which may contain Windows System variables.
Important
The
excludedProcessNameskey does not support wildcard characters.Important
Certain classes of events (for example, DNS lookup events) are not included in excluded processes.
The
excludedProcessNameskey is available on macOS endpoints.UNC names are supported in excludedPaths.
On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (
C:) or UNC name (\\Server\Share).System environment variables are supported in excludedPaths:
%ProgramFiles%, %ProgramFiles(x86)%, %ProgramW6432%, %CommonProgramFiles%, %ProgramData%
%SystemDrive%, %SystemRoot%, %windir%
%ALLUSERSPROFILE%, %PUBLIC%
Important
Use care when specifying system environment variables in folder paths. Their expanded paths may vary based on the installed version of Windows. For complete information about Windows environment variables, refer to your Windows documentation (Microsoft TechNet).
User-specific environment variables are not supported because the Endpoint Security (HX) xAgent runs on the endpoint as
SYSTEM. For example,%HOMEDRIVE%\Users\*\Documents\*.*is an invalid path because it includes a user-specific environment variable.
Exclusions are case sensitive for MacOS endpoints.
The following table lists exclusion examples for excluding files and folders from real-time detection processing. Reference these rules when adding file and folder paths to your real-time detection exclusion list.
Exclusion Method
Exclusion Example
Exclude a specific file name.
myfileExclude a specific file name located in a specific directory.
C:\Users\Admin\Documents\myfile.txtExclude all files with a specific extension in all directories.
C:\*.TXTExclude all files and sub directories in a specific directory.
C:\Users\Admin\Documents\Exclude all files and sub-directories in a specific directory for all users directories.
C:\Users\*\Documents\orC:\Users\*\Documents\*.Both examples are equivalent
Exclude all files with a specific extension located in a specific directory for all users directories.
C:\Users\*\Documents\*.docExclude all files in a specific directory for all users directories.
C:\Users\*\Documents\*.*Exclude all files in a specific directory for all users directories.
%SystemDrive%\Users\*\Documents\*.*Exclude a specific file in all users directories that start with a name.
C:\Users\Name*\Documents\file.txtExclude a specific file in all users directories that start with a name followed by a single character.
C:\Users\Name?\Documents\file.txt