To remove process exclusions from a real-time indicator detection for selected host sets:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the custom policy you want to modify and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Processes from Real-time Indicator Detection, click the
.png "Policy_ServerAddress_Remove.png")
icon next to the process you want to remove.Click Save.