Application WhiteListing

[jia_xuan]

I have an application that needs whitelisting.

Actions Done:

Add to Allow List

Add to Malware Profile, under specific module that triggered alert/incident.

It is still showing up in incidents when executed. Any idea what could be going on?

[aspatil]

Hello @jia_xuan ,

Thank you for reaching out on Live Community.

Could  you please confirm below:

1. Which Module is trigger alert?

2. What is the detection source, is it BPT, Local Analysis or Wildfire?

[jia_xuan]

1) Credential Gathering Protection

2) XDR Agent, Wildfire has marked detection benign.

[jia_xuan]

1) Credential Gathering Protection

2) XDR Agent, Wildfire has marked detection benign.

[aspatil]

Hello @jia_xuan ,

Thank you for providing the information.

You can create an Alert Exclusion and add that to the profile instead of Global. Or take the execution script and create the Custom Prevention Rule or add it to Legacy agent exception.

Once it is done, retrieve the alert data and open a TAC to check the reputation.

Hope this helps.

Regards