how I add exclusion based on for an specific process (license.exe) for specific endpoint

Prashanta — Wed, 27 Mar 2024 04:31:14 GMT

Hi family

How I add an exclusion based on for a specific process allow (license.exe) for specific endpoint on cortex xdr. wildfire are blocking this process many times so i want to allow for this service for specific endpoint.

thanks, and regards.

Re: how I add exclusion based on for an specific process (license.exe) for specific endpoint

jmazzeo — Wed, 27 Mar 2024 13:52:53 GMT

Hi @Prashanta, thanks for reaching us using the Live Community.

This is the overall process:

- Create a new Exceptions Security Profile: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-Legacy-Exception-Rule

- Create a new legacy exception rule in Settings - Exceptions Configuration.

We recommend to select only the protection module that is blocking the process, you can see it in the Alert details.

Select the previously created Exceptions Profile.

- Now create the Policy Rule to apply the profile to the required Endpoint.

You can copy your production policy with right click - Save as New

Change the Exceptions Profile to the new created one with the exception assigned.

And then select the endpoint in the Target menu using the filters.

Please check it and let us know how it goes.

If this post answers your question, please mark it as the solution.

topic Re: how I add exclusion based on for an specific process (license.exe) for specific endpoint in Cortex XDR Discussions

how I add exclusion based on for an specific process (license.exe) for specific endpoint

Re: how I add exclusion based on for an specific process (license.exe) for specific endpoint