topic creat exception profile with file extension in Cortex XDR Discussions

creat exception profile with file extension

Mostafa.Elsayed — Sat, 04 Jul 2020 20:07:42 GMT

my customer has a service that requires to be excluded from Cortex XDR agent activities. he gave me some processes and file extensions and paths. where can I do this on Cortex console?

Re: creat exception profile with file extension

dfalcon — Wed, 15 Jul 2020 14:14:57 GMT

Hi @Mostafa.Elsayed-

You will do this at the profile level. Go to Endpoints > Policy Management and select the Profiles option. From there, select the malware profile and add the exceptions as whitelist entries.

For the exploit side, go to Endpoints > Policy Management > Global Exceptions and enter the process information there. You can then select the Exploit Prevention Modules that you wish to disable.

Re: creat exception profile with file extension

Mostafa.Elsayed — Thu, 16 Jul 2020 19:00:27 GMT

Hi @dfalcon

How you make exception for file extension? also if you have only the process name, how you would fill the parent process box?

Exclude directory or drive from scan

James.Harrison — Thu, 16 Jul 2020 22:53:43 GMT

I am seeing high memory usage on a database server with XDR being the offender. I need to exclude all scanning/ monitoring from the directories where my data and log files live on that drive. Please provide the detail of what and how to accomplish that task.