creat exception profile with file extension

[Mostafa.Elsayed]

my customer has a service that requires to be excluded from Cortex XDR agent activities. he gave me some processes and file extensions and paths. where can I do this on Cortex console? 

[dfalcon]

Hi @Mostafa.Elsayed-

You will do this at the profile level.  Go to Endpoints > Policy Management and select the Profiles option.  From there, select the malware profile and add the exceptions as whitelist entries.

For the exploit side, go to Endpoints > Policy Management > Global Exceptions and enter the process information there.  You can then select the Exploit Prevention Modules that you wish to disable.  

[Mostafa.Elsayed]

Hi @dfalcon

How you make exception for file extension? also if you have only the process name, how you would fill the parent process box?

[James.Harrison]

I am seeing high memory usage on a database server with XDR being the offender.   I need to exclude all scanning/ monitoring from the directories where my data and log files live on that drive.   Please provide the detail of what and how to accomplish that task.