topic Re: Unable to add multiple folders in exclusion list in Cortex XDR Discussions

Unable to add multiple folders in exclusion list

Lakshminarayan — Mon, 13 May 2024 06:53:27 GMT

Hi Team,

Am unable to add multiple folders under Exception configuration page. I have 20+ folders which i need to exclude in Cortex XDR, i went to Exception Configuration-->Disable Prevention policy-->Add Rule. I have to do this each every time for every folder which is cumbersome process. Is there a way to exclude all folders in one go.

Regards,

Lakshminarayanan

Re: Unable to add multiple folders in exclusion list

aspatil — Mon, 13 May 2024 08:27:41 GMT

Hello @Lakshminarayan ,

You can use wild card if all Folders exists in same drive, for example /var/lib/docker/*

Please refer below:
https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/adding-file-and-folder-exclusions/td-p/562296

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

Re: Unable to add multiple folders in exclusion list

Lakshminarayan — Mon, 13 May 2024 09:20:33 GMT

Hi Ashutosh,

I want to exclude different folders from same drive and different drive also.

Re: Unable to add multiple folders in exclusion list

jmazzeo — Mon, 13 May 2024 13:43:09 GMT

Hi @Lakshminarayan, if you use Legacy Exceptions you can configure multiple folders in the same rule.

As a Legacy exception it might be not as specific as the Disable Prevention rules.

If this post answers your question, please mark it as the solution.

Re: Unable to add multiple folders in exclusion list

Lakshminarayan — Wed, 15 May 2024 05:40:29 GMT

Hi,

I think both does the same job, because i dont see any major difference in the functionality.