Folder and File exclusions wildcard question

[MatteoNatalicchio]

https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Add-a-New-M...

The docs says: 

(Optional) Add files and folders to your allow list to exclude them from the examination.

1. +Add a file or folder.

2. Specify the path and press Enter or click the check mark when done. You can also use a wildcard to match files and folders containing a partial name. Use ? to match a single character or * to match any string of characters. To match a folder, you must terminate the path with * to match all files in the folder (for example, c:\temp\*).

A ) What if i want to match all folders under a certain path?

Does (c:\temp\*) match c:\temp\folder1\file.xml ? (i don't think so)

I don't necessarily know how many folders there are, I need to be able to match any number of subfolders

B ) Or what if I want to match any file having a certain extension anywhere in the file system?

(all file ending with .xml as an example)

[anlynch]

Hi @MatteoNatalicchio,

Thanks for reaching out through LIVEcommunity!

I'm going to break your questions apart and answer them for clarity.

A ) What if i want to match all folders under a certain path?

Does (c:\temp\*) match c:\temp\folder1\file.xml ? (i don't think so)

I don't necessarily know how many folders there are, I need to be able to match any number of subfolders

Simply put, yes.  C:\temp\* covers all files and folder in the directory. Doesn't matter how many other folders are contained within, this encompasses them all.

B ) Or what if I want to match any file having a certain extension anywhere in the file system?

(all file ending with .xml as an example)

In this example you could do something like C:\Temp\*.xml.  The addition of the '.xml' means it will only search for .xml files in the Temp directory.  You could something like C:\*\*.xml.  Where the first '*' could represent any number of nested folders and target files in those folders ending with the ".xml" extension.  I strongly recommended testing in your own environment to confirm this works for your usecase.

I hope you find this information helpful.

[MatteoNatalicchio]

Hi Anlynch,

With question A, i mean that i need to exclude all the possibly existing level of nested subfolders, without having to indicate them explicitly

C:\temp\file.pdf

C:\temp\folder1\folder1a\file.xml

C:\temp\folder2\folder2a\folder2a1\file.txt

Are you sure that C:\temp\* will works even for the files on the nested folders ?

For question B: if i need to exclude all XML on any existing file systems, could i write: *\*.xml ?

Cheers

[anlynch]

Hi, @MatteoNatalicchio,

For question A: 

Yes, what I provided earlier will work for any file or folder nested in the C:\Temp\ Directory.  

For questions B)

I think that would work.  To be sure though, it's best to test it in your own environment and observer for any potentially unwanted behaviors.  Wildcards are powerful tools.