Allow based on certifcate issuer?

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Allow based on certifcate issuer?

L0 Member

We are currently having an issue with our database disk images being blocked that are set on rotation cycles. The file name and the hash changes incrementally. All our disk images are signed, using a certificate by the issuer; this was used previously to stop these executables from being blocked.

Is there a way to exclude or allow based on the certificate issuer?

Chris Tunks
SecOps Engineer

L4 Transporter

Hi @mssp_ctunks,


Thanks for reaching out on LIVEcommunity.


I can definitely see how this issue would cause some headaches.  I would recommend adding the exception as a folder instead of a file since the names and hashes change.  If you can exclude the folder it should exclude any processes running within that folder.  I'd like to caution you to be mindful that anything nested in the folder will be excluded as well.  I'll leave some information about this right here


With the introduction of Cortex XDR 3.5 all of the exception have now been moved to the Global Exceptions Configuraiton which is accessible as seen below.


Screenshot 2023-06-27 at 11.24.14 AM.png


I would just caution that you test this method to verify it's validity before deploying to a production environment.


Lastly, If that doesn't work out properly.  I highly suggest reaching out to support  as they should be able to provide you with support exception to deal with your issue specifically.


I hope you find this information helpful.


Have a great day!

  • 1 replies
  • 78 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!