The fileExtInclusions key lists the extensions of files types included in malware protection processing.
By default, all files with extensions of *.com, *.exe, *.dll, *.ocx, and *.sys are included in malware protection processing when it is turned on. These extensions are not shown in the fileExtInclusions list, but are always included in malware protection processing.
Use the fileExtInclusions list to add other file extensions to malware protection processing. There is no default. If no extensions are listed, only files with extensions of *.com, *.exe, *.dll, *.ocx, and *.sys are included in malware protection processing.
File extensions should be listed within quotation marks (") and separated by commas. The full list of file extensions should be enclosed in brackets ([]). For example:
"fileExtInclusions": [ ".log", ".py*" ]
Change this setting using one of the following methods:
API custom configuration channels (see Using API Custom Configuration Channels ).
Manually on individual endpoints using a text editor (see Modifying the Configuration File for a Single Endpoint).