excludedPaths Key

The excludedPaths key specifies the files and folders to be excluded from monitoring of file write events for real-time indicator detection global exclusion policy. This policy must be enabled using the Web UI. If the policy is not enabled, this setting is ignored.

Use quotation marks (") to specify the file or folders you want excluded from real-time indicator detection and commas to separate each entry. Enclose the full list of files and folders in brackets ([]). For example:

"excludedPaths": [
    "%WINDIR%\\system32\\",
    "%ProgramData%\\FireEye\\xagt\\events.*"
]

File and folder exclusions apply to file write events only.
UNC names are supported in excludedPaths.
On Windows endpoints, file and folder paths must start with a drive letter followed by a colon (C:) or UNC name (\\Server\Share).
System environment variables are supported in excludedPaths:
- %ProgramFiles%, %ProgramFiles(x86)%, %ProgramW6432%, %CommonProgramFiles%, %ProgramData%
- %SystemDrive%, %SystemRoot%, %windir%
- %ALLUSERSPROFILE%, %PUBLIC%
  Important
  Use care when specifying system environment variables in folder paths. Their expanded paths may vary based on the installed version of Windows. For complete information about Windows environment variables, refer to your Windows documentation (Microsoft TechNet).
  User-specific environment variables are not supported because the Endpoint Security (HX) Agent runs on the endpoint as SYSTEM. For example, %HOMEDRIVE%\Users\*\Documents\*.* is an invalid path because it includes a user-specific environment variable.
  Wildcard characters (*) and (?) are not supported in file and folder paths.

The following table lists examples for excluding files and folders from real-time detection processing. Reference these examples when adding file and folder excludedPaths to your real-time indicator detection exclusion list.

Exclusion Method	Exclusion Example
Exclude a specific file name.	`myfile`
Exclude a specific file name located in a specific directory.	`C:\Users\Admin\Documents\myfile.txt`
Exclude all files in a specific directory.	`C:\Users\Admin\Documents*.TXT`
Exclude all files and sub directories in a specific directory.	`C:\Users\Admin\Documents\C:\Users\Admin\Documents`

Change this setting using one of the following methods:

Web UI (see Excluding Files, Folders, and Processes from RTID).
API custom configuration channels (see Using API Custom Configuration Channels).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).

excludedPaths Key

Important