Maintaining the exception policy excluded MD5 hash list

Using the Web UI or the CLI, you can add and remove MD5 hashes in the Exploit Guard exception policy exclusion list.

Note

Use of an Exploit Guard exception policy is not recommended.

Adding excluded MD5 hashes using the web UI

To add MD5 hashes to the exception policy exclusion list using the Web UI:

Important

The HX Server does not validate the correct entry of the MD5 hashes included in your exclusion list. Confirm that your MD5 hash exclusions are represented by 32 hexadecimal digits.

Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, verify that the Exclude MD5 hashes from Exploit Guard for the selected host sets option is selected.
In the field under the Exclude MD5 hashes from Exploit Guard for the selected host sets option, specify the MD5 hash of the file you want to exclude from Exploit Guard processing for the endpoints in the host sets selected for the exception policy.
Click Add to add the MD5 hash to the list.
Repeat Steps 5 and 6 until you have added all the MD5 hashes you want to the list.
Click Save.

Adding excluded MD5 hashes using the CLI

To add MD5 hashes to the exception policy exclusion list using the CLI:

On the HX Server, enable CLI configuration mode:
hostname > enable
hostname # configure terminal
Add an MD5 hash to the Exploit Guard exception policy:
hostname (config) # hx config agent exd exceptions whitelist md5 values <hash>
For <hash>, specify the MD5 hash of the file you want to exclude from Exploit Guard processing for the endpoints in the host sets selected for the exception policy.
Repeat Step 2 until you have added all the MD5 hashes you want to the list.
Save your changes:
```
hostname (config) # write memory
```

Removing excluded MD5 hashes using the web UI

To remove MD5 hashes from the exception policy exclusion list using the Web UI:

Log in to the Web UI as an administrator.
Access the Policies page by selecting Policies on the Admin menu.
Select the Exploit Guard tab.
In the Exceptions for Selected Host Sets section, locate the MD5 hash you want to remove from the list below the Exclude MD5 hashes from Exploit Guard for the selected host sets option.
Click the icon next to the MD5 hash to remove it from the list.
Repeat Step 5 until you have removed all the MD5 hashes you want from the list.
Click Save.

Removing excluded MD5 hashes using the CLI

To remove MD5 hashes from the exception policy exclusion list using the CLI:

On the HX Server, enable CLI configuration mode:
hostname > enable
hostname # configure terminal
List the MD5 hashes in the Exploit Guard exception policy:
show hx server exd
The MD5 hashes listed under Exclude MD5 hashes from Exploit Guard in the output of this command are the MD5 hashes included in the exception policy.
Remove an MD5 hash from the Exploit Guard exception policy:
hostname (config) # no hx config agent exd exceptions whitelist md5 values <index#>
For <index#>, specify the path number of the MD5 hash you want to remove.
Repeat Step 3 until you have removed all the MD5 hashes you want from the list.
Save your changes:
```
hostname (config) # write memory
```