Detection policy

The Detection policy customizes real-time monitoring to identify threats and indicators of compromise (IOCs). It continuously monitors endpoint activity, such as network connections and DNS traffic, against a database of known malicious indicators.

Real-Time Indicator Detection

Option	Definition
Enable Real-Time Indicator Detection	Continuously monitor host endpoints for suspicious activities based on a set of defined indicators of compromise (IOCs).

Events

Option	Definition
Capture UDP Events	Monitors and records network traffic that uses the User Datagram Protocol (UDP).
Capture Network Connection Events	Monitors and records endpoint network traffic, including IP addresses, ports, protocols, and timestamps.
Capture DNS Events	Monitors and records Domain Name System (DNS) traffic, including domain names, IP addresses, and timestamps.
Capture URL Events	Monitors and records all network traffic related to URLs.

Exclusions

Configure exclusions to prevent the monitoring of trusted files, processes, or registry keys. Use a semicolon (;) to separate multiple items in the exclusion fields.

For required exclusions when integrating EDRF with Splunk, see the Trellix Knowledge Base (KB) article, Required EDRF Exclusions for Splunk (Windows and Linux) - KB000015182.

For information about troubleshooting EDRF performance issues using Exclusion Advisor Audit, see the Trellix Knowledge Base (KB) article, How to use Exclusion Advisor Audit to troubleshoot EDRF performance issues - KB000015181.

Option	Definition
Exclude file(s) or folder(s) from Real-Time indicator Detection	Excludes specified file and folder paths from real-time event monitoring. To create an exclusion, add a full file path (for example, `C:\Temp\temp_file.txt`) or a directory (for example, `C:\Program Files\MyApp\Logs`) in the Exclude files or folders from Real-Time Indicator Detection field. On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (`C:`) or UNC name (`\\Server\Share`). UNC names are supported in excludedPaths. Examples of supported UNC include: `\\Server\Share` `\\Server\Share\Folder\Path` `\\192.168.1.10\Finance` `\\corp-fileserver\Engineering\Builds` This prevents the detection of events, such as file writes, within those locations. Important Wildcard searches are supported only for file(s) or folder(s) exclusions. For details, see Examples for file and folder exclusions.
Exclude process(es) by full path from Real-Time indicator Detection	Adds process exclusions to the real-time indicator detection policy for all host endpoints or selected host sets. To exclude a process, specify its full executable path in the Exclude Processes from Real-Time Indicator Detection field, using either an absolute path or a Windows System variable. For example, adding `C:\windows\system32\notepad.exe` or `%windir%\system32\notepad.exe` to the process exclusion list will exclude `notepad.exe` from real-time event monitoring.
Exclude Registry Keys from Real-Time Indicator Detection	Excludes specified registry keys or entire paths from Real-Time Indicator Detection. Adding a key to this list instructs the system to ignore modifications (creations, deletions, or value changes) to that key and its subkeys, which helps reduce alert fatigue. For example, excluding `HKEY_CURRENT_USER\Software\MyDiagnosticTool\Settings` prevents alerts from a tool that constantly and safely modifies its settings.

Option

Definition

Exclude file(s) or folder(s) from Real-Time indicator Detection

Excludes specified file and folder paths from real-time event monitoring.

To create an exclusion, add a full file path (for example, C:\Temp\temp_file.txt) or a directory (for example, C:\Program Files\MyApp\Logs) in the Exclude files or folders from Real-Time Indicator Detection field.

On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (C:) or UNC name (\\Server\Share). UNC names are supported in excludedPaths.

Examples of supported UNC include:

\\Server\Share
\\Server\Share\Folder\Path
\\192.168.1.10\Finance
\\corp-fileserver\Engineering\Builds

This prevents the detection of events, such as file writes, within those locations.

Important
Wildcard searches are supported only for file(s) or folder(s) exclusions. For details, see Examples for file and folder exclusions.

Exclude process(es) by full path from Real-Time indicator Detection

Adds process exclusions to the real-time indicator detection policy for all host endpoints or selected host sets.

To exclude a process, specify its full executable path in the Exclude Processes from Real-Time Indicator Detection field, using either an absolute path or a Windows System variable.

For example, adding C:\windows\system32\notepad.exe or %windir%\system32\notepad.exe to the process exclusion list will exclude notepad.exe from real-time event monitoring.

Exclude Registry Keys from Real-Time Indicator Detection

Excludes specified registry keys or entire paths from Real-Time Indicator Detection.

Adding a key to this list instructs the system to ignore modifications (creations, deletions, or value changes) to that key and its subkeys, which helps reduce alert fatigue.

For example, excluding HKEY_CURRENT_USER\Software\MyDiagnosticTool\Settings prevents alerts from a tool that constantly and safely modifies its settings.

Examples for file or folder exclusions

Use these examples to exclude files or folders from Real-Time indicator Detection using wildcard search.

Exclusion Method	Exclusion Example
Exclude a specific file name, regardless of location.	`myfile`
Exclude a specific file located in a defined directory.	`C:\Users\Admin\Documents\myfile.txt`
Exclude all files with a specific extension at a defined path level.	`C:\*.TXT`
Exclude an entire directory, including all files and subdirectories.	`C:\Users\Admin\Documents\`
Exclude a directory and all contents for all user profiles.	`C:\Users\*\Documents\`
Exclude all files of a specific extension across all user profile directories.	`C:\Users\\Documents\.doc`
Exclude all files in a specific directory across all user profile directories.	`C:\Users\\Documents\.*`
Exclude files in a directory using an environment variable to resolve the system drive.	`%SystemDrive%\Users\\Documents\.*`
Exclude a specific file in user profile directories that match a name prefix.	`C:\Users\Name*\Documents\file.txt`
Exclude a specific file in user profile directories whose name matches a single additional character.	`C:\Users\Name?\Documents\file.txt`

Using wildcards in file or folder exclusions

The wildcard (*) matches text within a single directory name and not across multiple directory levels.
For example, the asterisk (*) can match a single directory level, such as Admin in C:\Users\Admin\Documents\, but it does not match multiple nested levels like Group\User1 in C:\Users\Group\User1\Documents\.
A trailing backslash (\) identifies a directory path and applies the exclusion to that directory and all subdirectories and files.
A pattern that ends with *.* applies only to files and not directories.
A wildcard that follows a directory name (for example, Documents*) performs a name match on a single directory level and not across multiple directory levels.
The following patterns are not equivalent since they target different scopes:
- C:\Users*\Documents\ — Applies only to directory exclusions. When configured under Exclude file(s) or folder(s) from Real-Time Indicator Detection, this pattern excludes all files within directories that match the path. For example, it excludes all files under C:\Users23\Documents\.
- C:\Users*\Documents*\ — Applies to directory name matching using a wildcard. When configured under Exclude file(s) or folder(s) from Real-Time Indicator Detection, this pattern excludes all files in directories whose names start with Documents within paths that match C:\Users*. For example, it excludes files under C:\Users23\Documents\, C:\Users23\Documents1\, C:\Users23\Documents_backup\.
- C:\Users*\Documents*\*.* — Applies only to file exclusions, not folders. When configured under Exclude file(s) or folder(s) from Real-Time Indicator Detection, this pattern excludes files with an extension in directories whose names start with Documents within paths that match C:\Users*. For example, it excludes files such as C:\Users23\Documents\test.exe and C:\UsersABC\Documents_backup\file.dll. The directory itself (for example, C:\Users23\Documents_backup\) is not excluded.
Environment variables, such as %SystemDrive%, are supported for path-based exclusions.