Whitelisting of files under legacy agent exception

[RamyashreeMada]

Hello Team,

- For exceptions, whether we have to create rule for each of the module profiles to whiltelist the file path?

- Is there any way that we can create only one and it applies to all other pofiles.

[nsinghvirk]

Hello @RamyashreeMada 

Thanks for reaching out on LiveCommunity.

Creating an exception with broad scope is not a good security practise. Cortex XDR enable you to create granular exceptions by allowing you to choose particular module/profile. Hence we advise you to please investigate the alerts for the file for which you want to create exception. In alerts table, there is a column named "Module". Module column let you know which particular module has triggered the alert. Once you know the module, please create exception for that one only.

Same goes for the profiles, please try to minimise the scope. For example, it may be possible that only endpoints which belong to IT team need exception. Hence we should only create exception for profile which belong to IT endpoints. 

However, XDR allows you to select multiple profiles also.

Please let me know if you have more questions.