Configuring Exceptions for Different Modules

[dhervasg]

Hello guys

I need to add exceptions for Windows HyperV servers.... and I have 2 questions:

Question 1

I need to add exceptions base on extensions...*.bin, *.vhdx, *.avhd.... etc, and exceptions base on process for instance Vmms.exe, VMwp.exe.... etc...

Can I configure the both types of exceptions and apply to the unique Profile or Policy to be applied to the Servers???

Question 2

When I add exception base on process, I can´t use it like this:

%systemroot%\System32\Vmms.exe

I just can write "Vmms.exe", is there any way to specify the patch with "%systemroot%\System32\Vmms.exe" ??

Thank you very much

David

[eluis]

Hi David, 

In your case after reading you, I believe that you need to create a Legacy Exception Profile and applying it to your desired Profiles (in your case the ones that you apply to your servers).

You need to select the modules or all modules you want your exclusion to be applied to.

Please check the picture and let me know if this works for you. 
Im attaching the documentation on how to create the exception profiles too:

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Set-up-endpoint-profi...

Feel free to click on like the answer if this helped you. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

KR, 

Luis

[dhervasg]

Hi Luis

Thank you for your help in advance.

I kno whow to create exceptios, for intstance for a specific process. I know I have to create e Legacy Agent Exception, then link this Legay Agent Exception with my Exceptions Profile, and then it will be applied to my policy.

The problem is that I don´t know how to create a Legacy Agent Exceptions wiht a mix of types (process, file extensions, etc...) for instance, I have to create a Exceptions for a HyperV environtment, and if we read the Microsoft recomendations, we have to create exceptions among many others for:

Files *.vhd

Files *.vhdx

Files *.bin

Process: %systemroot%\System32\Vmms.exe

Process: %systemroot%\System32\Vmwp.exe

as far as I know, I can create:

One Legacy Agents Exceptions for file extensions

A Second Legacy Agents Exceptions for process

But I can´t assign both to my Exceptions Profile. So I wolud need to "create" a unique Legay Agent Exceptions with all kind of exceptions (Process, paths, file extensions...) and the apply it to my Exceptiosn Profile.

Do you know what i Mean?

Exclusiones de antivirus recomendadas para hosts de Hyper-V - Windows Server | Microsoft Learn

thank you very much

David

[jmazzeo]

Hi @dhervasg,

You can add paths and files using wildcards, depending on which module you select when creating the exception. For the BTP module, you can add paths or file extensions:

From Palo Alto, we never recommend to create exceptions to any application before installing the agent. The best practice is to install the agent with all the Malware modules in "Prevent", if any alert is created about a well known application, then you can create the exception to be ready when you change to "Block" mode.