Operational Exception without Case

[M.Wempen]

We are currently facing an issue with a Windows service. This service only functions properly after we add a specific executable (.exe) to the Operational Agent Exceptions . We haven’t seen any corresponding case or alert in the console, meaning Cortex XDR is not actively blocking anything.

This raises the following questions:

1) Wildcards in Operational Agent Exceptions

Unfortunately, wildcards cannot be used in the Operational Agent Exceptions profile. Is there any plan to support wildcards for these exceptions in the future?

2) Module Identification & Support Files

A more granular Process Exception would be highly preferred over a blanket operational exception. To achieve this, we obviously need to identify which specific module needs to be disabled for this process.

• What is the best troubleshooting workflow to determine this?

• How can we extract this information from the Support Files?

3) Best Practice for Single-Endpoint Exceptions

This exception is intended for a single server only. To apply this single operational exception, we currently have to create a separate policy row containing a Malware, Restriction, and Agent Setting profile. Is creating a completely dedicated policy structure for a single endpoint really considered best practice? Over time, managing exceptions this way makes the policy overview difficult to maintain.

Thank you 🙂