Unable to add multiple folders in exclusion list

[Lakshminarayan]

Hi Team,

Am unable to add multiple folders under Exception configuration page. I have 20+ folders which i need to exclude in Cortex XDR, i went to Exception Configuration-->Disable Prevention policy-->Add Rule. I have to do this each every time for every folder which is cumbersome process. Is there a way to exclude all folders in one go.

Regards,

Lakshminarayanan

[aspatil]

Hello @Lakshminarayan ,

You can use wild card if all Folders exists in same drive, for example /var/lib/docker/* 

Please refer below:
https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/adding-file-and-folder-exclusions/td-p/5...

If you feel this has answered your query, please let us know by clicking on "mark this as a Solution". Thank you.

[Lakshminarayan]

Hi Ashutosh,

I want to exclude different folders from same drive and different drive also.

[jmazzeo]

Hi @Lakshminarayan, if you use Legacy Exceptions you can configure multiple folders in the same rule.

As a Legacy exception it might be not as specific as the Disable Prevention rules.

If this post answers your question, please mark it as the solution.

[Lakshminarayan]

Hi,

I think both does the same job, because i dont see any major difference in the functionality.