You can generate granular exceptions to prevention actions defined for your endpoints.
You can generate granular exceptions to prevention actions defined for your endpoints. You can specify signers, command line, or processes to exclude from the prevention actions triggered by specific security modules. This may be useful when you have processes that are essential to your organization and must not be terminated. Cortex XDR still generates alerts from the disabled rules.
Important
All applicable prevention actions are skipped for the files and process that match the properties defined in the rule.
Consider the consequences of disabling a prevention rule before you add the exception and monitor it over time.
You can only apply a Disable Prevention Rule to agents version 7.9 and later.
From → → , select +Add Rule.
Specify an optional description for the reason or intent for the rule.
Select the platform. To cover all your endpoints, you can prevent different exception rules per platform.
Under Target Properties, specify the Hash, Path, Command Line argument, or trusted Signer Name, or any combination of these.
When you specify two or more values, the exception is applied only if the file satisfies all the specified target properties.
You can use wildcards for matching the command line.
Select one or more security Modules that won't trigger prevention actions.
The actions triggered by the other modules are not affected.
Select the Scope for the rule. If you want to apply the rule to only specific Exception Profiles, select them from the list.
Enable the rule.
Review the configurations for the exception, and if the risks are acceptable to you, select I understand the risk.