By default, when you enable malware protection processing for all of your host endpoints using the xAgent default policy, including malware detection, quarantine, and remediation, it is enabled for all host sets that are running version 26 or later of the xAgent software. You can create a custom policy using the Web UI or the API that excludes selected host sets from malware protection processing. Host sets that are excluded malware detection (Signature and Heuristic Detection) are also excluded from quarantine, and remediation.
Important
Malware protection settings in the xAgent default policy apply to all host endpoints in your enterprise except for host sets assigned to a custom policy that defines different settings for malware protection or defines different malware protection exclusions.
Trellix does not recommend excluding host sets from malware protection processing because it restricts the hosts that malware protection protects.
This section covers how to use the Web UI to create a custom policy that excludes host sets from malware protection processing. See the Endpoint Security (HX) REST API Guide for information on using the API to manage your malware protection policies.
Log in to the Web UI as an administrator.
From the Admin menu, select Policies to access the Policies page.
Click Create Custom Policy to go to the Create Policy page.
Enter a policy name in the Name field and a policy description in the Description field.
Click Categories to access a list of the policy categories.
Select the Malware Protection checkbox and click Apply.
Toggle the Signature and Heuristic Detection switch OFF to completely disable malware protection processing.
.png "Policy_MalProtect_Disable.png")
You can also disable components of malware protection for select host sets while enabling malware detection (Signature and Heuristic Detection). Replace step 7 with one or more of the alternate steps listed below to disable MalwareGuard or quarantine and remediation.
Toggle the MalwareGuard Detection switch OFF to disable MalwareGuard.
.png "Policy_MalProtect_MalGuard_Disable.png")
Toggle the Quarantine switch OFF to disable quarantine and remediation.
.png "Policy_MalProtect_Quarantine_Disable.png")
Click Save.
After you create a custom policy that disables malware protection processing, you can use the steps outlined in Assigning Host Sets to Agent Policies to assign specific host sets to your custom policy. This will disable malware protection processing for all of the selected host sets.