Different process exception on Exception Profile and Folder Allow List on Malware profile

[Muhammad-Rusli]

Hi Expert,

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.

The asessment from Sophos for agent existing my customer.

The example exclusion files like a below :

C:\Windows\System32\backgroundTaskHost.exe 

C:\Program FIles (x86)\Microsoft SQL Server\

*.txt

, more again

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?

[yalonso]

---

@Muhammad-Rusli wrote:

Hi Expert,

Please give me advice, So I have assesment for exclusion folder and file .exe and file etc extension.

The asessment from Sophos for agent existing my customer.

The example exclusion files like a below :

C:\Windows\System32\backgroundTaskHost.exe 

C:\Program FIles (x86)\Microsoft SQL Server\

*.txt

, more again

So my question is, where I can add the exclusion folder/files, Malware Profile or Exception Profile?

---

Hello Muhammad-Rusli,

It would be a best practice to first check the details of the incident and alarms within it to understand why the application was prevented, alert sources and the need for the exception. You can add more granular detail to your baseline policies configuring  an exceptions profile. (f.e  Process Exceptions, Support Exceptions, Behavioral Threat Protection Rule Exceptions, Local Analysis Rules Exceptions

Advanced Analysis Exception or Digital Signer Exceptions). With a Malware profile you can add files and folders to an allow list to exclude them from examination.

Endpoint Security Profiles:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/endpoint-...

Exceptions security profiles:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/exception...

[magarcias]

I'm also having a difficult time looking for file extensions exclusions if that is even possible?