Systems that are used by developers to compile programs can experience significant performance impact during compilation when Adaptive Threat Protection is running. You can mitigate this impact using exclusions and signed certificates.
Reasons for the impact on performance include:
Compilers, such as Cygwin, git, and CMake, create many short-lived processes and execute them multiple times. Adaptive Threat Protection requests reputation data for the processes from the TIE server or Trellix GTI (depending on your configured reputation source), resulting in time spent waiting for the response to come back.
Compilers might also create unsigned image files. The unsigned files trigger Adaptive Threat Protection scanning, which slows down the compilation.
We recommend using one of the following workarounds to improve performance during compilation.
Note
We don't recommend disabling Adaptive Threat Protection to improve performance.
Add exclusions for compilers
Exclusions are the most common solution used by organizations. Depending on the compiler being used, we recommend adding the following exclusions.
Note
The exclusion paths show compilers installed in the default location. Verify the actual compiler locations with the developers.
Exclusions for Cygwin
C:\cygwin\bin\as.exe C:\cygwin\bin\make.exe C:\cygwin\bin\sh.exe C:\cygwin\bin\gcc.exe C:\cygwin\bin\gcc-4.exe C:\cygwin\lib\gcc\i686-pc-cygwin\5.4.0\CC1.exe
Exclusions for git
C:\PROGRAM FILES\GIT\USR\BIN\BASH.EXE C:\PROGRAM FILES\GIT\USR\BIN\UNAME.EXE C:\PROGRAM FILES\GIT\USR\BIN\SH.EXEC C:\PROGRAM FILES\GIT\MINGW64\LIBEXEC\GIT-CORE\GIT.EXEC C:\PROGRAM FILES\GIT\USR\BIN\SED.EXEC C:\PROGRAM FILES\GIT\USR\BIN\BASENAME.EXE
Exclusion for CMake
C:\PROGRAM FILES\CMAKE\BIN\CMAKE.EXE
Sign executables with a code-signing certificate
When an executable is ready to be released, you can sign it with a trusted code-signing certificate that is configured to be trusted throughout your organization. The code-signing certificate must be marked as trusted by the TIE server; all executables signed by this certificate are fully trusted.
Submit executables to Trellix GTI
When application is ready to be released, you can submit the unknown files to Trellix using GetClean. Once confirmed, Trellix GTI trusts the files.
Trellix sends an email to confirm the files were received and notifies when the executables are added to Trellix GTI. The normal turnaround time is between 2 and 48 hours.
For information on GetClean, see KB73044.