Press CTRL+K to open search

File Hashing policy configuration

  • Published on Sep 3, 2026
  • 6 minute(s) read
Prev Next

You can use the File Hashing policy tab to configure the File Hashing plug-in on managed devices.

Note

Make sure Enable Plug-in is selected on the File hashing policy to gather file hash information using collectors on the Real-time Search dashboard.

File hashing option definitions

Option

Definition

Enable File Hashing on the device (enables the Files collector and trigger)

This option is disabled by default. When enabled, Enables the Files collector and trigger capabilities on the device.

Note

Click Show advanced to display other policy options.

Maximum size (MB) of the device storage that can be used by the File Hashing collector

The size limit for the Files collector database on devices. If the value exceeds the Max database size (MB), then Trellix EDR tries to get as close as possible to the maximum storage target by removing information about deleted files from the database.

The default value you can set is 60 MB. The minimum and maximum value you can set is between 0 MB and 8192 MB.

Maximum percentage of the device storage used by the File Hashing collector database

The maximum storage target size that the File Hashing plug-in database tries to keep. If the value exceeds the Max database size % value, then Trellix EDR tries to get as close as possible to the maximum storage target by removing information about deleted files from the database.

The default value you can set is 2 percentage. The minimum and maximum value you can set is between 0 and 100 percentage.

Maximum number of results returned by the File Hashing collector

Maximum number of rows returned by the Files collector.

The default value set is 512. The minimum and maximum value you can set is between 64 and 8192.

Hash strategy

Selects the priority of the file hashing process. A lower priority uses less device resources.

  • Low — This is the recommended setting. Uses the least device resources.

  • Normal — The operating system alone decides priority.

  • Medium — Incremented priority.

  • High — Top priority.

  • Auto — Switches between Low and Normal strategies depending on device usage.

Pause File Hashing when the device is running out of battery life

This option is enabled by default. Pause file hashing when the device is running on battery to preserve battery life.

Time (in seconds) to delay the File Hashing process after booting the device

The time in seconds to delay the file hashing process in the Trellix EDR clients after booting the system. The devices will start the warm-up procedure for the file hashing component only after the specified delay time is over.

The default value set is 120 seconds. The minimum and maximum value you can set is between 0 and 8192 seconds.

Max file size for hashing (MB)

The maximum file size that Trellix EDR hashes. Files above this limit are excluded from file hashing.

The default value set is 100 MB. The minimum and maximum value you can set is between 0 MB and 8192 MB.



Exclusions option definitions

Option

Definition

Exclude file(s) on Windows (use ';' as separator) (max: 3072 characters)

Excludes a list of file paths. You can include complete file paths or use wildcards.

Note

All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity.

For example:

Full path

  • C:\PAGEFILE.SYS

Wildcards (*)

  • C:\Windows\Temp\etilqs*

  • C:\Windows\Temp\etilqs**

Note

The asterisk (*) and double asterisk (**) wildcards are used to represent one or more characters, and do not cross folder boundaries.

You can use these system variables to specify ignored files and paths:

  • %systemdrive%

  • %profilesdirectory%

  • %windir%

  • %commonprogramfiles%

  • %commonprogramfiles(x86)%

  • %comspec%

  • %homedrive%

  • %programdata%

  • %programfiles%

  • %programfiles(x86)%

  • %public%

  • %systemroot%

  • %temp%

  • %tmp%

Trellix EDR only expands system user variables. Use of variables that point to user paths is not recommended. Avoid using the following variables:

  • %allusersprofile%

  • %appdata%

  • %homepath%

  • %localappdata%

  • %userprofile%

Under certain circumstances, endpoint users with administrator level access can change the destination folders of system variables.

Note

If you must use system variables, you can create an Trellix EDR trigger that catches changes to system variables in the Windows Registry. The trigger must be of WinRegistry type and watch for changes on this registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment.

Exclude file extension(s) on Windows (Use ';' as separator) (max: 3072 characters)

Excludes a list of file extensions. Place a '.' before each extension, separated by semicolons.

Note

All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity.

For example, .swap;.o;.temp;

Note

Unless there is a reason to ignore a specific extension, only ignore those extensions that are repeatedly opened and modified.

Exclude path(s) on Windows (Use ';' as separator) (max: 3072 characters)

Excludes paths and folder names. You can specify folder paths in full or partially, using '*' to replace the beginning of a path, or entering '**' to ignore a folder regardless the location.

Note

All extension path exclusions are case insensitive and Trellix EDR now supports per-directory case sensitivity.

For example:

  • *bar excludes folders bar and foobar anywhere in the file system.

  • *foo\bar excludes the bar folder inside the foo and snafoo directories, anywhere in the file system.

  • C:\foo\bar\ excludes only the folder bar inside C:\foo directory.

  • C:\**\bar\ excludes one or more subdirectories where bar is found. For example, ignores c:\foo\bar, c:\snafoo\bar, and c:\snafoo\foo\bar.

    Warning

    When entering absolute paths, the trailing '\' is mandatory.

Removing a path from the ignored list makes the path available for file hashing only after the device system is restarted. Until then, only newly created files are hashed at previously ignored paths.

Windows operating system exclusions must start with a Microsoft "FOLDERID_" prefix. For details, see Microsoft documentation "knownfolderid" for complete supported list.

Directory paths are case-sensitive in ignore paths on Windows.

System environment variables and FOLDERID_* style paths are supported.

Important

When entering full paths, trailing slash is not mandatory. When a full path is provided, all files within the directory and all its directories are excluded.

Exclude file(s) on Linux (Use ';' as separator) (max: 3072 characters)

Excludes a list of file paths. File paths must be complete, indicating full path, file name, and extension. For example, /etc/cma.d/lpc.conf;

You can use the following system variables to specify ignored files and paths:

  • $BASH_VERSION

  • $HOSTNAME

  • $CDPATH

  • $HISTFILE

  • $HISTFILESIZE

  • $HISTSIZE

  • $HOME

  • $IFS

  • $LANG

  • $PATH

  • $PS1

  • $TMOUT

  • $TERM

  • $SHELL

  • $DISPLAY

  • $EDITOR

Exclude file extension(s) on Linux (Use ';' as separator) (max: 3072 characters)

Excludes a list of file extensions. Place a '.' before each extension, separated by semicolons. For example, .swp;.o;.temp;

Ignore path(s) on Linux (Use ';' as separator) (max: 3072 characters)

Paths and folder names to be ignored. You can specify folder paths in full or partially, using '*' to replace the beginning of a path.

For example:

  • *bar excludes folders bar and foobar anywhere in the file system.

  • */bar excludes the bar folder anywhere in the file system.

  • /foo/bar excludes only the folder bar inside the /foo directory.

Removing a path from the ignored list makes the path available for file hashing only after the device system is restarted. Until then, only newly created files are hashed at previously ignored paths.

Exclude file(s) on macOS (Use ';' as separator) (max: 3072 characters)

Excludes a list of file paths. You can use ';' as separator.

Exclude files extension(s) on macOS (Use ';' as separator )(max: 3072 characters)

Excludes a list of file extensions. You can use ';' as separator.

Exclude path(s) on macOS (Use ';' as separator) (max: 3072 characters)

Excludes paths and folder names. You can use ';' as separator.



Note

Mounted folders and removable drives are not included in file hashing.

Find file extensions and folders to exclude in File Hashing

These steps improve the performance of Trellix EDR by searching and removing file extensions and folders that consume too much data storage and are not relevant from a software security perspective.

  1. Download and install any SQLite tool.

  2. Copy the File Hashing Database to another folder.

    • macOS and Linux — sudo cp /var/McAfee/mvedr/data/file_hash.db /tmp/

    • Windows — to copy the database on Windows, you must disable data folder protection on ePO - On-prem or ePO - SaaS: Trellix EDR Policy → General → Enable data folder protection.

  3. Open the copy of file_hash.db option in the SQLite tool.

  4. Run this query to get the 20 most commonly used file extensions:

    SELECT replace(name, rtrim(name, replace(name, '.', '')), '') as extension, count(*) as amount
FROM files
GROUP BY extension
ORDER BY amount DESC
LIMIT 20;

  5. Run this query to get the 20 most commonly used folders:

    SELECT dir, count(*) as amount
FROM files
GROUP BY dir
ORDER BY amount DESC
LIMIT 20;
Related articles
  • Investigation policy
    Endpoint Detection and Response with Forensics (EDRF) > Configure EDRF policies
  • Malware Protection Exclusion Guidelines
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > xAgent Configuration > Configuring Malware Protection > Defining the Malware Protection exclusion policy
  • Exploit Guard exclusion guidelines
    Endpoint Security Agent (HX) > Endpoint Security Agent (HX) 36 Administrator Guide > xAgent Configuration > Configuring Exploit Guard protection > Defining exploit guard protection exclusion policies