Allow based on certifcate issuer?

[mssp_ctunks]

We are currently having an issue with our database disk images being blocked that are set on rotation cycles. The file name and the hash changes incrementally. All our disk images are signed, using a certificate by the issuer; this was used previously to stop these executables from being blocked.

Is there a way to exclude or allow based on the certificate issuer?

[anlynch]

Hi @mssp_ctunks,

Thanks for reaching out on LIVEcommunity.

I can definitely see how this issue would cause some headaches.  I would recommend adding the exception as a folder instead of a file since the names and hashes change.  If you can exclude the folder it should exclude any processes running within that folder.  I'd like to caution you to be mindful that anything nested in the folder will be excluded as well.  I'll leave some information about this right here. 

With the introduction of Cortex XDR 3.5 all of the exception have now been moved to the Global Exceptions Configuraiton which is accessible as seen below.

I would just caution that you test this method to verify it's validity before deploying to a production environment.

Lastly, If that doesn't work out properly.  I highly suggest reaching out to support  as they should be able to provide you with support exception to deal with your issue specifically.

I hope you find this information helpful.

Have a great day!