exploitDetection Section Settings

The alertThreshold key sets an alert threshold used internally by Exploit Guard processing.

The appList key lists the applications that are monitored by Exploit Guard. The applications that are monitored are Adobe Reader, Adobe Flash, Internet Explorer, Firefox, Google Chrome, Java, Microsoft Outlook, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft Office 2010 files.

The enable_notification key indicates whether the exploit prevention option to notify users when exploits are blocked has been enabled or not. Valid values are true (enabled) or false (disabled). The default is false.

If the enable_notification key value is true, set the following key values to true:

Change this setting using one of the following methods:

Exploit Guard uses special detection heuristics to detect shellcode in its early stages.

The enable_pageguard key indicates whether these special detection heuristics should be enabled for use in Exploit Guard processing. Valid values are true (enabled) or false (disabled). The default is true.

Change this setting using one of the following methods:

The enable_prevent_known key indicates whether exploits should be blocked by exploit prevention. Valid values are true (block exploits) or false (do not block exploits). The default is false.

If the enable_prevent_known key value is true, set the following key values to true:

Change this setting using one of the following methods:

The enable_production key indicates whether exploit detection has been enabled or not. Valid values are true (enabled) or false (disabled). The default is true.

Change this setting using one of the following methods:

The enable_protection key indicates whether exploit prevention has been enabled or not. Valid values are true (enabled) or false (disabled). The default is false.

If the enable_protection key value is true, the enable_production Key key value must also be true.

Change this setting using one of the following methods:

Use the enable_server_os key to enable or disable Exploit Guard processing for Windows server operating systems. Valid values are true (enabled) or false (disabled). The default is false.

Change this setting using one of the following methods:

The enable_termination key indicates whether the exploit prevention option to terminate monitored applications when exploits are detected has been enabled or not. Valid values are true (enabled) or false (disabled). The default is false.

If the enable_termination key value is true, set the following key values to true:

Change this setting using one of the following methods:

The excludedFiles key lists the files and folders to be excluded from Exploit Guard processing. This list of files and folders is part of the Exploit Guard global policy.

There is no default. If no files or folders are listed, all files and folders are included in Exploit Guard processing.

Files and folders should be listed within quotation marks (") and separated by commas. The full list of files should be enclosed in brackets ([]). For example:

"excludedFiles": [
    "\\system32\\",
    "\\FireEye\\xagt\\events.*"
]

The excludedMD5s key lists the MD5 hashes to be excluded from Exploit Guard processing. This list of MD5 hashes is part of the Exploit Guard global policy.

There is no default. If no MD5 hashes are listed, all MD5 hashes are included in Exploit Guard processing.

MD5 hashes should be listed as a sequence of 32 hexadecimal digits, within quotation marks ("), and separated by commas. The full list of files should be enclosed in brackets ([]). For example:

"excludedMD5s": [
    "c8a9dab8f7cdec707eba6deca3448ba8",
    "c2f5bbc927532092da5bfbb5ef839308"
]

Change this setting using one of the following methods:

The excludedPaths key lists the executable files of applications that are monitored by Exploit Guard that should be excluded from Exploit Guard processing. This list of monitored applications is part of the Exploit Guard global policy configured in the Agent Default Policy.

Applications that are monitored by Exploit Guard are Adobe Reader, Adobe Flash, Internet Explorer, Firefox, Google Chrome, Java, Microsoft Outlook, Microsoft Word, Microsoft Excel, and Microsoft PowerPoint

There is no default. If no executable files are listed, all monitored applications are included in Exploit Guard processing.

Executable files should be listed within quotation marks (") and separated by commas. The full list of files should be enclosed in brackets ([]). For example:

"excludedPaths": [
    "chrome.exe",
    "iexplore.exe",
    "firefox.exe"
]

Change this setting using one of the following methods:

The rules_uri key identifies the location of the rules file used during Exploit Guard processing. The default is /content/v1/intel/exd/rules.

If you attempt to modify this setting using an API custom configuration channel, the API will automatically override it with the setting set up during Endpoint Security (HX) server and agent deployment.

The traceLevel key sets a trace level used internally by Exploit Guard processing. This setting is set the same way the log_level setting is set in the logging section.

Change this setting using one of the following methods:

The whitelist_uri key identifies the location of the whitelist file used during Exploit Guard processing. The default is /content/v1/intel/exd/whitelist.

If you attempt to modify this setting using an API custom configuration channel, the API will automatically override it with the setting set up during Endpoint Security (HX) server and agent deployment.