You may need to exclude specific files and folders, monitored applications (processes), and MD5 hashes from Exploit Guard processing on all of your host endpoints or selected host sets. You can use the Web UI or the API to define any of the following Exploit Guard policy exclusions:
Exclude all host sets or selected host sets from Exploit Guard processing, including both Exploit Guard detection and Exploit Guard prevention processing.
Exclude all host sets or selected host sets from Exploit Guard prevention processing only.
Exclude specific processes from Exploit Guard processing for all host endpoints or selected host sets.
Exclude specific file executables from Exploit Guard processing for all host endpoints or selected host sets.
Exclude specific MD5 hashes from Exploit Guard processing for all host endpoints or selected host sets.
Important
Exploit Guard process, file, folder, and MD5 hash exclusions are supported on Windows agents version 22 and later only.
Excluding host sets, processes, files and folders, or MD5 hashes from Exploit Guard processing is not recommended because it restricts the items that Exploit Guard protects.
Exploit Guard file, folder, or process exclusions defined in the xAgent default policy do not apply to host sets assigned to a custom policy, if the custom policy defines different Exploit Guard policy settings. To exclude files, folders, and processes for third-party antivirus software installed on your host endpoints, you must define these exclusions for all policies that include an Exploit Guard policy.
Admin access when using the Web UI
Endpoint Security (HX) xAgent version 22 or later installed on your Windows endpoint. If an xAgent for an earlier xAgent version is included in a host set that is managed by a policy, the policy is ignored for that xAgent .
This section covers the following topics:
Exploit Guard exclusion guidelines
Follow these guidelines when adding files and folders, applications (processes), and MD5 hashes to the Exploit Guard exclusion list:
Excluding monitored applications from Exploit Guard processing
You can add and remove a list of monitored applications (processes) that you want to exclude from Exploit Guard processing. Excluding an application for Exploit Guard processing prevents Exploit Guard from monitoring the application or performing other Exploit Guard activities, including application termination. If an exploit occurs on the excluded application, you will not receive an alert.
Applications that are monitored for exploits are Adobe Reader, Adobe Flash, Internet Explorer, Firefox, Google Chrome, Java, Microsoft Outlook, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft Office 2010 files.
Important
Exploit Guard monitored application exclusions are supported on Windows agents version 22 and later only.
Excluding monitored applications from Exploit Guard processing is not recommended because it restricts the monitored applications that Exploit Guard protects.
Exploit Guard process exclusions defined in the apply to all host endpoints in your enterprise except for host endpoints assigned to a custom policy that includes an Exploit Guard policy.
This section covers how to use the Web UI to manage an monitored applications list for Exploit Guard processing. See the Endpoint Security (HX) REST API Guide for more information about managing monitored application exclusions using the API.
Adding monitored application list exclusions
You can add a list of monitored applications you want to exclude from Exploit Guard processing (both exploit detection and exploit prevention) using the Web UI or the API.
Important
The excludedPaths is the only value that will completely exclude a specific process.
File paths should not be included in the excludedPaths list.
The Endpoint Security (HX) server does not validate monitored application entries included in your Exploit Guard exclusion list. You must confirm your application exclusions are correct.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the executable file name of a monitored application (process) you want to exclude from Exploit Guard processing in the field under the Exclude monitored applications from Exploit Guard. For example, adding
chrome.exeto the exclusion list will exclude Chrome from Exploit Guard processing.Click Add to add the monitored application to the list.
Repeat Steps 5 and 6 until you have added all the monitored applications you want to the list.
Click Save.
To add monitored application exclusions for selected host sets:
Note
NOTE: See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the name of a monitored application you want to exclude from Exploit Guard processing in the field under the Exclude monitored applications from Exploit Guard.
Click Add to add the monitored application to the list.
Repeat Steps 5 and 6 until you have added all the monitored applications you want to the list.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Removing monitored application list exclusions
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the executable file of the application (process) you want to remove from the list below the Exclude monitored applications from Exploit Guard option.
Click the
.png)
icon next to the process you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the monitored applications you want to delete from the list.
Click Save.
To remove an application (process) from the Exploit Guard exclusions list for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the process you want to remove from the list below the Exclude monitored applications from Exploit Guard option.
Click the
icon next to the process you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the monitored applications you want to delete from the list.
Click Save.
Excluding files and folders from Exploit Guard processing
You can exclude a list of executable files and folders from Exploit Guard processing for all your host endpoints or selected host sets in your environment. Exploit Guard still monitors your excluded files and folders but you will not receive an alert if an exploit occurs on an excluded file or folder. In addition, Exploit Guard activities, including application termination, do not occur on the excluded file or folder.
Important
Exploit Guard file and folder exclusions are supported on Windows agents version 22 and later only.
Excluding files and folders from Exploit Guard processing is not recommended because it restricts the items that Exploit Guard protects.
Exploit Guard file and folder exclusions defined in the apply to all host endpoints in your enterprise except for host endpoints assigned to a custom policy that includes an Exploit Guard policy.
This section covers how to use the Web UI to manage a file and folder exclusion list for Exploit Guard processing. See the Endpoint Security (HX) REST API Guide for more information about managing Exploit Guard file and folder exclusions.
Adding file and folder exclusions
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the file or folder path you want to exclude from Exploit Guard processing in the field under the Exclude files and folders from Exploit Guard.
Click Add to add the file or folder path to the list.
Repeat Steps 5 and 6 until you have added all the files and folders you want to the list.
Click Save.
To add file and folder exclusions for selected host sets:
Note
NOTE: See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the file or folder path you want to exclude from Exploit Guard processing in the field under the Exclude files and folders from Exploit Guard.
Click Add to add the file or folder path to the list.
Repeat Steps 5 and 6 until you have added all the files and folders you want to the list.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Removing file and folder exclusions
To remove file and folder exclusions for all host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the file and folder you want to remove from the list below the Exclude files and folders from Exploit Guard option.
Click the
icon next to the file and folder you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the files and folders you want to delete from the list.
Click Save.
To remove file and folder exclusions for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the file and folder you want to remove from the list below the Exclude files and folders from Exploit Guard option.
Click the
icon next to the file and folder you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the files and folders you want to delete from the list.
Click Save.
Excluding MD5 hashes from Exploit Guard processing
You can add and remove a list of excluded MD5 hashes in the Exploit Guard global policy using the Web UI or the API.
Excluding an MD5 hash from Exploit Guard processing does not prevent Exploit Guard from monitoring the MD5 hash. Monitoring still occurs but you will not receive any alerts or other Exploit Guard activities, including application termination, if an exploit does occur for the excluded MD5 hash.
Important
Exploit Guard MD5 hash exclusions are supported on Windows agents version 22 or later only.
Excluding MD5 hashes from Exploit Guard processing is not recommended because it restricts the MD5 hashes that Exploit Guard protects.
Exploit Guard MD5 hash exclusions defined in the apply to all host endpoints in your enterprise except for host endpoints assigned to a custom policy that includes an Exploit Guard policy.
This section covers how to use the Web UI to manage an MD5 hash exclusion list for Exploit Guard processing. See the Endpoint Security (HX) REST API Guide for more information about managing MD5 hash exclusions.
Adding MD5 hash exclusions
You can add a list of MD5 hashes to exclude from Exploit Guard processing using the Web UI or the API.
Important
The Endpoint Security (HX) server does not validate the MD5 hash entries included in your Exploit Guard exclusion list. You must confirm your MD5 hash exclusions are represented by 32 hexadecimal digits.
To add MD5 hash exclusions for all host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the MD5 hash you want to exclude from Exploit Guard processing in the field under the Exclude MD5 hashes from Exploit Guard.
Click Add to add the MD5 hash to the list.
Important
The Endpoint Security (HX) server and the xAgent do not validate the correct entry of the MD5 hashes included in your exclusion list. Confirm that your MD5 hash exclusions are represented by 32 hexadecimal digits.
Repeat Steps 5 and 6 until you have added all of the MD5 hash exclusions you want to the list.
Click Save.
To add MD5 hash exclusions for selected host sets:
Note
See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, specify the MD5 hash you want to exclude from Exploit Guard processing in the field under the Exclude MD5 hashes from Exploit Guard.
Click Add to add the MD5 hash to the list.
Important
The Endpoint Security (HX) server and the xAgent do not validate the correct entry of the MD5 hashes included in your exclusion list. Confirm that your MD5 hash exclusions are represented by 32 hexadecimal digits.
Repeat Steps 5 and 6 until you have added all of the MD hash exclusions you want to the list.
Click Save.
Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.
Removing MD5 hash exclusions
To remove MD5 hash exclusions for all host endpoints:
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the Agent Default Policy link to access the Edit Policy page.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the MD5 hash you want to remove from the list below the Exclude MD5 hashes from Exploit Guard option.
Click the
icon next to the MD5 hash you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the MD5 hash exclusions you want from the list.
Click Save.
To remove MD5 hash exclusions for selected host sets:
Note
When you disable a setting in a custom policy, the setting is disabled for all host sets assigned to the policy. If you want select host sets to keep the original setting, you must create a new custom policy with the setting enabled and assign it to the selected host sets. See Creating a Custom Policy for more information about using the Web UI to create a custom policy.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
In the Policies table, click the link for the custom policy you want to modify.
Select the Exploit Guard Protection tab.
In the Policy Exclusions section, select the MD5 hash you want to remove from the list below the Exclude MD5 hashes from Exploit Guard option.
Click the
icon next to the MD5 hash you want to remove from the list.Repeat Steps 5 and 6 until you have removed all of the MD5 hash exclusions you want from the list.
Click Save.
Managing Exception Policy MD5 hash exclusions
You can enable and maintain the list of excluded MD5 hashes in the Exploit Guard exception policy using the Web UI or the CLI.
Note
Excluding MD5 hashes from Exploit Guard processing is not recommended because it restricts the MD5 hashes that Exploit Guard protects.
The MD5 hash exclusion is only supported on hosts using Trellix Endpoint Security (HX) xAgent version 22 or later.
Enabling and disabling the Exception Policy excluded MD5 hash list
The list of excluded MD5 hashes in the Exploit Guard exception policy can be enabled and disabled using the Web UI or the CLI. When it is enabled, the MD5 hashes in the list are excluded from Exploit Guard processing (both exploit detection and exploit prevention) for the host sets selected in the exception policy.
Enabling the list using the web UI
To enable the exception policy excluded MD5 hash list using the Web UI:
Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, select the Exclude MD5 hashes from Exploit Guard for the selected host sets option.
In the field below this option, specify MD5 hashes that should be excluded from Exploit Guard processing for the exception policy. See Maintaining the MD5 Hash List for the Exploit Guard Exception Policy .
Click Save.
Enabling the list using the CLI
To enable the exception policy excluded MD5 hash list using the CLI:
On the HX Server, enable CLI configuration mode:
hostname > enablehostname # configure terminalEnable the excluded MD5 hash list in the Exploit Guard exception policy:
hostname (config) # hx config agent exd exceptions whitelist MD5 enableSave your changes:
hostname (config) # write memory
Disabling the list Using the web UI
To disable the exception policy excluded MD5 hash list using the Web UI:
Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, clear the Exclude MD5 hashes from Exploit Guard for the selected host sets option.
Click Save.
Disabling the list using the CLI
To disable the exception policy excluded MD5 hash list using the CLI:
On the HX Server, enable CLI configuration mode:
hostname > enablehostname # configure terminalDisable the excluded MD5 hash list in the Exploit Guard exception policy:
hostname (config) # no hx config agent exd exceptions whitelist MD5 enableSave your changes:
hostname (config) # write memory
Maintaining the exception policy excluded MD5 hash list
Using the Web UI or the CLI, you can add and remove MD5 hashes in the Exploit Guard exception policy exclusion list.
Note
Use of an Exploit Guard exception policy is not recommended.
Adding excluded MD5 hashes using the web UI
Important
The HX Server does not validate the correct entry of the MD5 hashes included in your exclusion list. Confirm that your MD5 hash exclusions are represented by 32 hexadecimal digits.
Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, verify that the Exclude MD5 hashes from Exploit Guard for the selected host sets option is selected.
In the field under the Exclude MD5 hashes from Exploit Guard for the selected host sets option, specify the MD5 hash of the file you want to exclude from Exploit Guard processing for the endpoints in the host sets selected for the exception policy.
Click Add to add the MD5 hash to the list.
Repeat Steps 5 and 6 until you have added all the MD5 hashes you want to the list.
Click Save.
Adding excluded MD5 hashes using the CLI
On the HX Server, enable CLI configuration mode:
hostname > enablehostname # configure terminalAdd an MD5 hash to the Exploit Guard exception policy:
hostname (config) # hx config agent exd exceptions whitelist md5 values <hash>For
<hash>, specify the MD5 hash of the file you want to exclude from Exploit Guard processing for the endpoints in the host sets selected for the exception policy.Repeat Step 2 until you have added all the MD5 hashes you want to the list.
Save your changes:
hostname (config) # write memory
Removing excluded MD5 hashes using the web UI
Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, locate the MD5 hash you want to remove from the list below the Exclude MD5 hashes from Exploit Guard for the selected host sets option.
Click the
.png)
icon next to the MD5 hash to remove it from the list.Repeat Step 5 until you have removed all the MD5 hashes you want from the list.
Click Save.
Removing excluded MD5 hashes using the CLI
On the HX Server, enable CLI configuration mode:
hostname > enablehostname # configure terminalList the MD5 hashes in the Exploit Guard exception policy:
show hx server exdThe MD5 hashes listed under Exclude MD5 hashes from Exploit Guard in the output of this command are the MD5 hashes included in the exception policy.
Remove an MD5 hash from the Exploit Guard exception policy:
hostname (config) # no hx config agent exd exceptions whitelist md5 values <index#>For
<index#>, specify the path number of the MD5 hash you want to remove.Repeat Step 3 until you have removed all the MD5 hashes you want from the list.
Save your changes:
hostname (config) # write memory