You can edit the list of existing threats criteria that are excluded from the potential threat list.
Log on to Trellix EDR.
Click the configuration icon on the top-right corner to access the Configuration page.
Select Manage threat exclusions under Finetune configuration to see the list of excluded threats.
Select a threat from the excluded threat list and edit as needed:
Enable or disable criteria such as SHA-256, File Path (includes shared network path), and Command Line
Note
Make sure at least one criteria checkbox is selected and added valid details, and Threat Exclusions name is present. Multiple criteria are combined using the AND logical operator.
Edit any of the existing criteria, Threat Exclusions name, or Note details. Click Save.
Note
For details about using wildcards in threat exclusion criteria File Path and Command Line, see the Trellix Knowledge Base article, Supported use of wildcards in Granular Exclusion for Trellix EDR - KB94998.
A new threat exclusion row is created with edited details.
Based on the edit criteria, threats excluded from the Monitoring dashboard are added to Manage threat exclusions on the Configuration page.