Exclude single .exe on single endpoint

Showing results for 
Show  only  | Search instead for 
Did you mean: 

Exclude single .exe on single endpoint

L1 Bithead

Pretty simple need here....


Installing the latest version of WSUS Automated Maintenance from AJ Tek on our WSUS server and Cortex is blocking it with the description "Suspicious executable detected". How do I allow this to install? Is the best way to temporarily pause protection on the endpoint, install the software and then re-enable protection?


L3 Networker

I think can depend how your environment is setup. you potentially could use the "report verdict as incorrect" in the incident... or could whitelist the hash... now if your setup to not allow unsigned app and that is unsigned that would be different. sorry for being slightly vague but some of this depends on your environment. 

L3 Networker

Hi @cemcga 


As suggested above, you can add files hashes to your allow list. Adding files to the block list or allow list takes precedence of any other policy rules that may have otherwise been applied to these files.


In order to add file hashes to your allow-lists:

  1. Go to Incident Response → Response → Action Center → + New Action.
  2. Select Add to Allow List.
  3. Enter the SHA-256 hash of the file.

You can read more about managing file execution here.

If this helped, please click Accept as Solution!

Thanks for this. To make sure I understand, this would allow the file to be executed on any endpoint, not just the one server, correct?

Yes, you are correct. 

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!