Excluding files from local malware analysis scan

[Daniel_Itenberg]

Hi all,

I have a specific file that i would like to whitelist. I have it in the allow list(by hash) but it still sometimes blocked by the "local analysis malware" due to having a different hash than the one in the allow list.

Is there a way to exclude a file from the scan via name, or any other way?

[eluis]

Hi @Daniel_Itenberg , 

have you thought of adding the signer as a trusted signer ? this will not take into account the hash. This is useful also for drivers from specific vendors that sign their software. 

Please check this doc on how to do it at the malware profile:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-prevent-admin/endpoint-security/endpo...

I wont recommend much to add a whole folder to the allow list since malicious actors might drop their malware there and go undetected. 

If hash and trusted signer do not work either of them, open a TAC support case to get a suex. 
Hope this helps 

KR, 

Luis

[Daniel_Itenberg]

What if the signature filed says "invalid signature"?

[eluis]

Hi @Daniel_Itenberg ,

I would open a TAC support case to see what is the issue here. Our TAC engineers will provide you help on this

KR, 

Luis

[MartinPfeil · Accepted solution]

If the file is always in the same location you can create a malware profile and exclude this location from scanning.

That is the easiest solution, as chaning hashes will invalidate the entires in the allow list

[Anil_Racharla]

Hii Eluis,
How to add a trusted signer .
How to sign a application which is internal built for organisation