Application WhiteListing

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

Application WhiteListing

L0 Member

I have an application that needs whitelisting.

 

Actions Done:

Add to Allow List

Add to Malware Profile, under specific module that triggered alert/incident.

 

It is still showing up in incidents when executed. Any idea what could be going on?

 

3 REPLIES 3

L5 Sessionator

Hello @jia_xuan ,

 

Thank you for reaching out on Live Community.

 

Could  you please confirm below:

1. Which Module is trigger alert?

2. What is the detection source, is it BPT, Local Analysis or Wildfire?

 

Ashutosh Patil

1) Credential Gathering Protection

2) XDR Agent, Wildfire has marked detection benign.

L5 Sessionator

Hello @jia_xuan ,

 

Thank you for providing the information.

 

You can create an Alert Exclusion and add that to the profile instead of Global. Or take the execution script and create the Custom Prevention Rule or add it to Legacy agent exception.

 

Once it is done, retrieve the alert data and open a TAC to check the reputation.

 

Hope this helps.

 

Regards

Ashutosh Patil
  • 692 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!