The excludedProcessNames key specifies the processes to be excluded from Windows real-time event monitoring, including registry, url, file, and image load events.
Note
The excludedProcessNames key is not available on macOS endpoints.
You must use the Web UI or the API to enable Real-Time Indicator Detection. The excludedProcessNames key is ignored if Real-Time Indicator Detection is not turned on.
Please note that certain classes of events (for example, DNS lookup events) are not included in excluded processes.
Specify the full path to the processes you want excluded from real-time monitoring in quotation marks ("), using commas to separate entries. Enclose the full list of files and folders in brackets ([]). For example:
"excludedProcessNames": [ "%VS120COMNTOOLS%..\\..VC\\bin\\cl.exe", "%VS120COMNTOOLS%..\\..\\VC\\bin\\x86_amd64\\cl.exe", "%VS120COMNTOOLS%..\\..\\VC\\bin\\link.exe" ]
Change this setting using one of the following methods:
API custom configuration channels (see Using API Custom Configuration Channels ).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).