Defining the real-time indicator detection exclusion policy

You may need to exclude specific files, folders, and processes from real-time event monitoring for all of your host endpoints or selected host sets in your environment. You can use the Web UI or the API to define any of the following Exploit Guard policy exclusions:

Exclude all host sets or selected host sets from real-time event monitoring.
Exclude specific files and folders from real-time event monitoring for all host sets or selected host sets. See Adding Files and Folder Exclusions to Real-Time Indicator Detection.
Exclude specific processes from real-time event monitoring for all host sets or selected host sets. See Adding Process Exclusions to Real-Time Indicator Detection.

Important

Excluding host sets, files and folders, or processes from real-time event monitoring is not recommended because it restricts the items real-time monitoring detects.

Real-time event monitoring file, folder, or process exclusions defined in the agent default policy do not apply to host sets assigned to a custom policy, if the custom policy defines different real-time indicator detection policy settings. To exclude files, folders, and processes for third-party antivirus software installed on your host endpoints, you must define these exclusions for all policies that include a real-time indicator detection policy.

Prerequisites

Admin access when using the Web UI
Endpoint Security (HX) xAgent version 20 or later installed on your Windows or macOS endpoints, or xAgent version 30.19 on your Linux endpoints. If an xAgent for an earlier release is included in a host set that is managed by a policy, the policy is ignored for that xAgent .

This section covers how to use the Web UI to review, add, and remove file, folder, and process exclusions from real-time event monitoring. For more details, see the Endpoint Security APIs page on the Trellix Developer Hub.

Real-time detection exclusion guidelines

Follow these guidelines when adding file or folder path exclusions to the real-time indicator detection file and folder exclusion list:

Tip

Trellix recommends that you minimize the number of exclusions. You can reduce exclusions by using custom policies targeted at specific OS versions and configurations.

Caution

On macOS, the total number of all file and folder exclusions must not exceed 100. The xAgent will ignore additional entries.

Important

Wildcard characters (*) and (?) are supported only in file and folder paths.

There are two possible values that you can exclude from real-time event monitoring: excludedPath and excludedProcessName. See events Section Settings for more information.

Exclusion Value	Description
excludedPaths	This value excludes specific files or folders from real-time event monitoring. File and folder exclusions apply to file write events only.
excludedProcessNames	This value excludes specific processes from Windows real-time event monitoring, including registry, url, file, and image load events. You can specify the full path of the executable file you want to exclude from real-time event monitoring by entering the absolute file path, which may contain Windows System variables. Important The `excludedProcessNames` key does not support wildcard characters. Important Certain classes of events (for example, DNS lookup events) are not included in excluded processes. The `excludedProcessNames` key is available on macOS endpoints.

Exclusion Value

Description

excludedPaths

This value excludes specific files or folders from real-time event monitoring. File and folder exclusions apply to file write events only.

excludedProcessNames

This value excludes specific processes from Windows real-time event monitoring, including registry, url, file, and image load events. You can specify the full path of the executable file you want to exclude from real-time event monitoring by entering the absolute file path, which may contain Windows System variables.

Important

The excludedProcessNames key does not support wildcard characters.

Important

Certain classes of events (for example, DNS lookup events) are not included in excluded processes.

The excludedProcessNames key is available on macOS endpoints.

UNC names are supported in excludedPaths.
On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (C:) or UNC name (\\Server\Share).
System environment variables are supported in excludedPaths:
- %ProgramFiles%, %ProgramFiles(x86)%, %ProgramW6432%, %CommonProgramFiles%, %ProgramData%
- %SystemDrive%, %SystemRoot%, %windir%
- %ALLUSERSPROFILE%, %PUBLIC%
  Important
  Use care when specifying system environment variables in folder paths. Their expanded paths may vary based on the installed version of Windows. For complete information about Windows environment variables, refer to your Windows documentation (Microsoft TechNet).
  User-specific environment variables are not supported because the Endpoint Security (HX) xAgent runs on the endpoint as SYSTEM. For example, %HOMEDRIVE%\Users\*\Documents\*.* is an invalid path because it includes a user-specific environment variable.
Wildcard characters (*) and (?) are supported in file and folder paths:
- Asterisk (*)—An asterisk will match one or more characters. If the asterisk is at the end of a path, the excluded path will include all sub-directories.
- Question mark (?)—A question mark will match a single character.

Exclusions are case sensitive for MacOS endpoints.

The following table lists exclusion examples for excluding files and folders from real-time detection processing. Reference these rules when adding file and folder paths to your real-time detection exclusion list.

Exclusion Method	Exclusion Example
Exclude a specific file name.	`myfile`
Exclude a specific file name located in a specific directory.	`C:\Users\Admin\Documents\myfile.txt`
Exclude all files with a specific extension in all directories.	`C:\*.TXT`
Exclude all files and sub directories in a specific directory.	`C:\Users\Admin\Documents\`
Exclude all files and sub-directories in a specific directory for all users directories.	`C:\Users\\Documents\` or `C:\Users\\Documents\*` . Both examples are equivalent
Exclude all files with a specific extension located in a specific directory for all users directories.	`C:\Users\\Documents\.doc`
Exclude all files in a specific directory for all users directories.	`C:\Users\\Documents\.*`
Exclude all files in a specific directory for all users directories.	`%SystemDrive%\Users\\Documents\.*`
Exclude a specific file in all users directories that start with a name.	`C:\Users\Name*\Documents\file.txt`
Exclude a specific file in all users directories that start with a name followed by a single character.	`C:\Users\Name?\Documents\file.txt`

Reviewing a Real-Time Indicator Detection Exclusion Policy

You can use the Web UI to review the file, folder, and process exclusions for real-time indicator detection that are defined for all of your host endpoints or for select host endpoints.

This section covers how to review your real-time indicator detection exclusion policy settings using the Web UI. See the Endpoint Security (HX) xAgent API Guide for more information on reviewing real-time indicator detection exclusion policies using the API.

To review the file, folder, and process exclusions for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Files and Folders section, review the file and folder exclusions.
From the Exclude Processes from Real-Time Indicator Detection section, review the process exclusions.

To review the file, folder, and process exclusions for selected host sets:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the custom policy you want to review and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Files and Folders section, review the file and folder exclusions.
From the Exclude Processes from Real-Time Indicator Detection section, review the process exclusions.

Adding files and folder exclusions to real-time indicator detection

You can exclude file and folder paths from real-time event monitoring by creating a file and folder exclusion list. Use the Web UI or the API to add file and folder exclusions to a real-time indicator detection policy assigned to all of your host endpoints or selected host sets in your environment.

When you enable the exclusion policy, it excludes these files and folders from real-time detection scanning for all host sets or specific host sets in your enterprise.

This section covers the steps for adding file and folder exclusions to your real-time indicator detection policy for all host endpoints and selected host sets using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API exclude files and folders from real-time event monitoring.

Adding Files and Folder Exclusions to Real-Time Indicator Detection
Removing File and Folder Exclusions from Real-Time Indicator Detection

Windows offloaded data transfer (ODX) support

The Trellix Endpoint Security (HX) xAgentnow supports ODX. Windows Offloaded Data Transfer (ODX) is a Windows feature that allows fast data transfer between storage media for local or remote systems. ODX support is enabled when the SupportedFeatures registry value equals 3, which enables the FeKern Minifilter driver.

To learn more about validating ODX support, visit https://docs.microsoft.com/en-us/windows-hardware/drivers/ifs/offloaded-data-transfers

To verify that the minifilter driver is registered to support ODX:

Use PowerShell to verify that the SupportedFeatures registry value equals 3 by entering the following script:

PS C:\Users\test> Get-ItemProperty hklm:\system\currentcontrolset\services\FeKern -Name "SupportedFeatures"

SupportedFeatures : 3 PSPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\system\currentcontrolset\services\FeKern PSParentPath : Microsoft.PowerShell.Core\Registry::HKEY_LOCAL_MACHINE\system\currentcontrolset\services PSChildName : FeKern PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry PSDrive : HKLM PSProvider : Microsoft.PowerShell.Core\Registry

Trellix recommends that you create path exclusions configured for real-time event processing for the destination path of files copied via ODX. ODX transfer on excluded paths is much faster because it bypasses the FeKern Minifilter. You can also use non-excluded paths, but ODX transfer on them will be slower.

Note

You can create exclusions for a common destination path across systems where ODX files are copied, for example: c:\odx_transfer* or the entire destination volume if the volume is used explicitly as a destination source, for example: f:*.

ODX typically transfers large files that can be used for:

Installing a software package
Installing a decompressed archive

If you dedicate the excluded path to ODX transfer only, you can still use non-excluded paths for file copying, software installation, archive extraction, etc.

Adding File and Folder Exclusions to All Hosts

To add file and folder exclusions to real-time event monitoring for all of your host endpoints:

Caution

On macOS, the total number of all file and folder exclusions must not exceed 100. The agent will ignore additional entries.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
Verify that the Real-Time Indicator Detection ON/OFF switch is set to ON.
From the Exclude Files and Folders section, enter the name of a file or folder you want to exclude from real-time event monitoring in the Exclude files or folders from Real-Time Indicator Detection field. File and folder exclusions apply to file write events only. See Real-Time Detection Exclusion Guidelines for additional guidelines.
Click Add.
Click Save.

Adding File and Folder Exclusions to Selected Host Sets

To add file and folder exclusions to real-time event monitoring for selected host sets:

Note

NOTE: See Creating a Custom Policy for more information about using the Web UI to create a custom policy.

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the link for the custom policy you want to modify.
Select the Real-Time Indicator Detection tab.
Verify that the Real-Time Indicator Detection ON/OFF switch is set to ON.
From the Exclude Files and Folders section, enter the name of a file or folder you want to exclude from real-time event monitoring in the Exclude files or folders from Real-Time Indicator Detection field. File and folder exclusions apply to file write events only. See Real-Time Detection Exclusion Guidelines for additional guidelines.
Click Add.
Click Save.

Now you can assign host sets to the custom policy and set the policy priority level. See Assigning Host Sets to Agent Policies and Configuring Policy Priority Using the Web UI for more information.

Removing File and Folder Exclusions from Real-Time Indicator Detection

You can remove file and folder exclusions from a real-time indicator detection policy for all of your host endpoints or selected host sets using the Web UI or the API.

This section covers the steps for removing file or folder exclusions using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API to manage your real-time event monitoring files and folder exclusions.

Removing File and Folder Exclusions from All Hosts

To remove file and folder exclusions from your real-time indicator detection exclusion policy for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policiesto access the Policies page.
From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Files and Folders section, click the icon next to the file or folder you want to remove.
Click Save.

Removing File and Folder Exclusions from Selected Host Sets

To remove file and folders exclusions from your real-time indicator detection policy for selected host sets:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the custom policy you want to modify and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Files and Folders section, click the icon next to the file or folder you want to remove.
Click Save.

Adding Process Exclusions to Real-Time Indicator Detection

You can add process exclusions to a real-time indicator detection policy assigned to all of your host endpoints or selected host sets using the Web UI or the API.

Note

Real-time monitoring process exclusions do not apply to processEvent and dnsLookupEvent for processes running on Windows endpoints. Real-time monitoring still records these events for processes running on Windows endpoints. NetworkEvent and processEvent are recorded on endpoints using Linux and process exclusions will exclude both of these event types.

Process exclusions are not supported on endpoints using the macOS.

This section covers the steps for adding process exclusions to your real-time indicator detection policy using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API to manage your real-time event monitoring process exclusions.

Adding Process Exclusions to All Host Endpoints

To add process exclusions for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policiesto access the Policies page.
From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
Verify that the Real-Time Indicator Detection ON/OFF switch is set to ON.
From the Exclude Processes from Real-Time Indicator Detection section, specify the full path of the executable file you want to exclude from real-time event monitoring in the Exclude Processes from Real-Time Indicator Detection field. You can specify the absolute file path or use Windows System variables to define the executable file path.
For example, adding C:\windows\system32\notepad.exe or %windir%\system32\notepad.exe to the process exclusion list will exclude notepad.exe from real-time event monitoring. The executable file path is not case sensitive.
Click Add.
Click Save.

Adding Process Exclusions to Selected Host Sets

To add process exclusions for selected host sets:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the link for the custom policy you want to modify.
Select the Real-Time Indicator Detection tab.
Verify that the Real-Time Indicator Detection ON/OFF switch is set to ON.
From the Exclude Processes from Real-Time Indicator Detection section, specify the full path of the executable file you want to exclude from real-time indicator detection in the Exclude Processes from Real-Time Indicator Detection field. You can specify the absolute file path or use Windows System variables to define the executable file path.
For example, adding C:\windows\system32\notepad.exe or %windir%\system32\notepad.exe to the process exclusion list will exclude notepad.exe from real-time event monitoring. The executable file path is not case sensitive.
Click Add.
Click Save.

Removing Process Exclusions from Real-Time Indicator Detection

You can remove process exclusions from a real-time indicator detection policy assigned to all of your host endpoints or selected host sets using the Web UI or the API.

This section covers the steps for removing process exclusions using the Web UI. See the Endpoint Security (HX) REST API Guide for information on using the API to manage your real-time event monitoring process exclusions.

Removing Process Exclusions from All Hosts

To remove process exclusions from a real-time indicator detection for all host endpoints:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the Agent Default Policy and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Processes from Real-time Indicator Detection, click the icon next to the process you want to remove.
Click Save.

Removing Process Exclusions from Selected Host Sets

To remove process exclusions from a real-time indicator detection for selected host sets:

Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
From the Policies table, select the custom policy you want to modify and click the policy link to access the Edit Policy page.
Select the Real-Time Indicator Detection tab.
From the Exclude Processes from Real-time Indicator Detection, click the icon next to the process you want to remove.
Click Save.