Adding files and folder exclusions to real-time indicator detection

You can exclude file and folder paths from real-time event monitoring by creating a file and folder exclusion list. Use the Web UI or the API to add file and folder exclusions to a real-time indicator detection policy assigned to all of your host endpoints or selected host sets in your environment.

When you enable the exclusion policy, it excludes these files and folders from real-time detection scanning for all host sets or specific host sets in your enterprise.

This section covers the steps for adding file and folder exclusions to your real-time indicator detection policy for all host endpoints and selected host sets using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API exclude files and folders from real-time event monitoring.

Windows offloaded data transfer (ODX) support

The Trellix Endpoint Security (HX) xAgentnow supports ODX. Windows Offloaded Data Transfer (ODX) is a Windows feature that allows fast data transfer between storage media for local or remote systems. ODX support is enabled when the SupportedFeatures registry value equals 3, which enables the FeKern Minifilter driver.

To learn more about validating ODX support, visit https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/offloaded-data-transfers

To verify that the minifilter driver is registered to support ODX:

Use PowerShell to verify that the SupportedFeatures registry value equals 3 by entering the following script:

PS C:\Users\test> Get-ItemProperty hklm:\system\currentcontrolset\services\FeKern -Name "SupportedFeatures"

SupportedFeatures : 3 PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FeKern PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\system\currentcontrolset\services PSChildName : FeKern PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry

Trellix recommends that you create path exclusions configured for real-time event processing for the destination path of files copied via ODX. ODX transfer on excluded paths is much faster because it bypasses the FeKern Minifilter. You can also use non-excluded paths, but ODX transfer on them will be slower.

ODX typically transfers large files that can be used for:

If you dedicate the excluded path to ODX transfer only, you can still use non-excluded paths for file copying, software installation, archive extraction, etc.