Legacy agent exception and Disable prevention rule

[DannyMulheran]

What is the difference between Legacy agent exception and Disable prevention rules?

This was asked in another discussion but the answer does not resolve the question asked (https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/exception-and-exclusion-tips-amp-trick-b... )

Thanks

Danny

[jmazzeo]

Hi @DannyMulheran, thanks for reaching us using the Live Community.

The Disable Prevention Rules applies to agents only from version 7.9 and above.

The Legacy Agent Exceptions also applies to older agent versions.

If this post answers your question, please mark it as the solution.

[Fm12345 · Accepted solution]

Disable prevention rules are more granular compared to legacy agent exceptions. 

Legacy agent exceptions Target the hole module like pe dll examination where as disable prevention rules would Target specific protections within that..like we can do wildfire detection, wildfire post detection, local analysis etc..

Disable prevention rules generate an alert even after allowing the activities where as legacy agent exceptions mostly don't generate alerts and allow a process to run.(E.g global behavior protection based legacy exception or credential protection module related ones generate alerts and other PE dll examination module based legacy agent exceptions don't generate alerts.

That's all I can remember for now 😉 

[DannyMulheran]

Thanks, really appreciate the reply.

[DannyMulheran]

Thanks JM, your response is appreciated.