How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode?

H.Eldessouki — Tue, 16 Jun 2026 05:53:44 GMT

Hi all, We get a false positive on Cortex XSIAM: Alert: Suspicious File Modification Module: Anti-Ransomware Protection Process: jpconsole.exe (OpenText Blazon), signed by Open Text Corporation, WildFire = Benign It is a legitimate app that modifies many files normally, so it looks like ransomware. We are in Report mode now and want to move to Block mode, but we are afraid the process will be killed. Question: How do I exclude this signed process so Anti-Ransomware does not block it in block mode? In Legacy Agent Exceptions there is no Anti-Ransomware module, and the path/signer allow-list only appears under other modules. Is there a way to allow-list by path or signer for ransomware? Thanks.

topic How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode? in GlobalProtect Discussions

How to exclude a legitimate signed process from Anti-Ransomware Protection (Suspicious File Modification) in block mode?