This section describes critical steps you must perform before installing or upgrading the Endpoint Security Agent (HX) software on your host endpoints.
If your third-party antivirus software does not allow you to whitelist or exclude agent files or processes until they are present on your host endpoint, perform these steps immediately after installing or upgrading the agent software on your host endpoint.
Excluding agent files in your antivirus software
Third-party antivirus software packages use advanced heuristics engines to evaluate and protect your host endpoints. To ensure that Endpoint Security (HX) processes are not subject to these heuristics, verify that the agent executable files (*.exe files) meet the following requirements for the following antivirus software vendors (if applicable in your environment):
List agent executable files as low-risk processes in McAfee.
Exclude agent executable files from behavior monitoring in Trend Micro Office Scan.
Apply application exclusion to agent executable files in Symantec Endpoint Protection.
For more information, refer to the documentation provided with your antivirus software.
Rarely, third-party security software identifies installed Endpoint Security (HX) files and activity as malicious. It is a good idea to whitelist or exclude agent files from real-time scanning and behavioral analysis (sometimes known as HIPS) in your third-party security software. Endpoint Security Agent (HX) software version 27 or later supports whitelisting by the original filename. This ensures that whitelisted files remain on the excluded list even if a user changes the filename.
Note
Be sure to exclude the xagt.exe file as a process in addition to excluding it as a file.
In addition, Trellix strongly recommends that you create malware protection process, file and folder exclusions for any third-party antivirus software. For example, if you are running McAfee antivirus software on your host endpoints, you should use the Malware Protection tab to create exclusions for McAfee processes, files, and folders.
Be sure to create malware protection process, file, and folder exclusions for the following third-party antivirus software running on your host endpoints:
McAfee
Symantec Endpoint Protection (SEP)
Trend Micro Office Scan
Windows Antivirus software
Important
See Microsoft Anti-Virus Exclusion List and Running Windows Antivirus Software on Exchange 2016 Servers for more information on the folders, processes, and file name extensions you should exclude from Endpoint Security (HX) Agent malware protection processing.
This will maximize performance, ensure compatibility with other antivirus software, and reduce the number of duplicate alerts you receive from the Endpoint Security (HX) malware protection feature and your third-party antivirus software. Use the malware protection global policy to define these exclusions. See Defining the Malware Protection Exclusion Policy in the Endpoint Security Agent (HX) Administration Guide for more information.
Excluding agent files for your Windows environment
In your Windows environment, whitelist the directories and file paths listed in this section to exclude specific Endpoint Security (HX) program files, plug-in files, driver files, and log files from real-time scanning and behavioral analysis by your third-party antivirus software. The default directory paths (wildcard) and file paths, including the supported Windows version, are shown for each directory and file.
Important
If the TARGETDIR option was used with the Windows MSI to change the installation location of the agent software, then the exclusion path must change. For example, if TARGETDIR = C:\MyInstallationDirectory then C:\MyInstallationDirectory\*.* should be excluded instead of %ProgramFiles(x86)%\FireEye\xagt\*.* or %ProgramFiles%\FireEye\xagt\*.*.
Note
If the Endpoint Security (HX) is installed in an environment where Sophos Antivirus and the Microsoft Enhanced Mitigation Experience Toolkit (EMET) are installed, you might experience Microsoft Internet Explorer crashes. To resolve this problem, start up the EMET GUI and turn off the ROP Caller Check setting for the iexplore.exe application. Refer to the EMET documentation for more information.
Program Files Excluded | Default File Path | Windows Version |
|---|---|---|
Everything in the | %ProgramFiles%\FireEye\xagt\*.* | 32-bit |
%ProgramFiles(x86)%\FireEye\xagt\*.* | 64-bit | |
32-bit = 32-bit versions of Windows 64-bit = 64-bit versions of Windows | ||
Driver Files | Default File Path | Windows Version |
|---|---|---|
FeKern.sys | %SystemRoot%\System32\drivers\FeKern.sys | All |
FeElam.sys | %SystemRoot%\System32\drivers\FeElam.sys | All |
fe_avk.sys | %ProgramData%\FireEye\xagt\exts\MalwareProtection\ sandbox\fe_avk.sys | 64-bit |
64-bit = 64-bit versions of Windows All = See "Operating System Requirements" for a list of all of the supported Windows operating system versions. | ||
All Data Files | Default File Path | Windows Version |
|---|---|---|
Everything in the | %ALLUSERSPROFILE%\Application Data \FireEye\xagt\*.* | NT 5.x |
%ProgramData%\FireEye\xagt\*.* | NT 6+ | |
NT 5.x = Windows XP SP3 and Windows Server 2003 SP2+R2 NT 6+ = All other supported Windows versions | ||
Plug-In File | Default File Path | Windows Version |
|---|---|---|
xagtnotif.exe | %SystemRoot%\FireEye\xagtnotif.exe | All |
Any extensions in %ALLUSERSPROFILE%\Application Data\FireEye\xagt\exts directories or subdirectories should be whitelisted in your antivirus software. | All | |
All = All supported versions of Windows | ||
Excluding agent files for your macOS environment
In your macOS environment, whitelist the program files, plug-in files, driver files, and log files listed in the tables below. The default file path and the supported macOS version are shown for each file.
Program Files | Default File Path | macOS Version |
|---|---|---|
xagt/* | /Library/FireEye/xagt/* | All |
Support/FireEye/* | /Library/Application Support/FireEye/* | All |
FireEye.kext/* | /Library/Extensions/FireEye.kext/* | All |
com.fireeye.xagt.plist | /Library/LaunchDaemons/com.fireeye.xagt.plist | All |
com.fireeye.xagtnotif.plist | /Library/LaunchAgents/com.fireeye.xagtnotif.plist | All |
IOKitBDAv.kext | /Library/Extensions/IOKitBDAv.kext | All |
All = Supported macOS versions: 10.9 ( Mavericks), 10.10 (Yosemite), 10.12 (Sierra), and 10.15 (Catalina), and 11 (Big Sur). | ||
Enabling Full Disk Access on macOS
To add the xagt app to the "Full Disk Access" list:
Note
After you enable Full Disk Access on macOS hosts, you must restart the host before you install the agent.
Open System Preferences.
Select the Security & Privacy tab.
In the list of services on the left, choose Full Disk Access.
Click the Lock icon in the bottom left corner to unlock the setting.
Enter Administrator credentials.
Click the + icon.
Navigate to the
/Library/FireEye/xagt/folder.Select
xagt.app.Click the Open button.
Ensure that the
xagtapp checkbox is selected..png "full-disk-access.png")
Quit Security & Privacy.
Excluding agent files for your Linux environment
In your Linux environment, whitelist the program files and directories listed in the table below. The default file path and the supported Linux version are shown for each file.
Program Files | Default File Path | Linux Version |
|---|---|---|
xagt | /etc/rc.d/init.d/xagt | RHEL 6.x |
Everything in the | /var/lib/fireeye/* | All |
Everything in the | /opt/fireeye/* | All |
xagt.service | /usr/lib/systemd/system/xagt.service | RHEL 7.x |
All = Supported Linux versions: RHEL 6.8 and RHEL 7.x) | ||
Note
When GPG signing is enabled on Linux distributions that support package signing checks, the Trellix GPG signature must be imported before upgrading or installing the v36 MR2 and later packages of xAgent. For more information about the GPG signature, see this Community Article.
Excluding Exploit Guard files in your Windows environment
In addition, if you intend to enable Exploit Guard in your Windows environment, whitelist the driver files and log files in the tables below. The default file path and the supported Windows version are shown for each file.
Note
The Exploit Guard plug-in files you need to whitelist are included in the %ALLUSERSPROFILE%\Application Data\FireEye\xagt\*.* and %ProgramData%\FireEye\xagt\*.* directory exclusions you whitelisted in Excluding agent files for your Windows environment.
Note
At first installation, the following files will not have the underscore (_) and xx number appended to them. Files without the underscore (_) should also be excluded.
Driver Files | Default File Path | Windows Version |
|---|---|---|
AppMonitorDll32_xx.dll | %SystemRoot%\FireEye\AppMonitorDll32_xx.dll (where xx is a series of incrementing numbers, for example: %SystemRoot%\FireEye\AppMonitorDll32_00.dll %SystemRoot%\FireEye\AppMonitorDll32_01.dll %SystemRoot%\FireEye\AppMonitorDll32_02.dll %SystemRoot%\FireEye\AppMonitorDll32_03.dll) | 64-bit |
JavaAgentDll32_xx.dll | %SystemRoot%\FireEye\JavaAgentDll32_xx.dll (where xx is a series of incrementing numbers, for example: %SystemRoot%\FireEye\JavaAgentDll32_00.dll %SystemRoot%\FireEye\JavaAgentDll32_01.dll %SystemRoot%\FireEye\JavaAgentDll32_02.dll %SystemRoot%\FireEye\JavaAgentDll32_03.dll) | 64-bit |
AppUIMonitor_xx.exe | %SystemRoot%\FireEye\AppUIMonitor_xx.exe (where xx is a series of incrementing numbers, for example: %SystemRoot%\FireEye\AppUIMonitor_00.exe %SystemRoot%\FireEye\AppUIMonitor_01.exe %SystemRoot%\FireEye\AppUIMonitor_02.exe %SystemRoot%\FireEye\AppUIMonitor_03.exe) | All |
AppMonitorDll_xx.dll | %SystemRoot%\FireEye\AppMonitorDll_xx.dll (where xx is a series of incrementing numbers, for example: %SystemRoot%\FireEye\AppMonitorDll_00.dll %SystemRoot%\FireEye\AppMonitorDll_01.dll %SystemRoot%\FireEye\AppMonitorDll_02.dll %SystemRoot%\FireEye\AppMonitorDll_03.dll) | All |
JavaAgentDll_xx.dll | %SystemRoot%\FireEye\JavaAgentDll_xx.dll (where xx is a series of incrementing numbers, for example: %SystemRoot%\FireEye\JavaAgentDll_00.dll %SystemRoot%\FireEye\JavaAgentDll_01.dll %SystemRoot%\FireEye\JavaAgentDll_02.dll %SystemRoot%\FireEye\JavaAgentDll_03.dll) | All |
64-bit = 64-bit versions of Windows All = All supported versions of Windows | ||
Note
Host containment over proxy support is provided for Windows and macOS endpoints only.
Certificate-based whitelisting
Endpoint Security supports certificate-based whitelisting for malware alerts only. This means that you can specify a family of binaries with a single rule. Certificate-based whitelisting can be provided through the Dynamic Threat Intelligence (DTI) Portal, or you can mark an alert as false positive, selecting the Digital Signature condition. This will identify all alerts with this certificate as false positive.
Note
TrellixEndpoint Security Agent (HX) version 27 or later supports certificate-based whitelisting for malware alerts only.