You can generate a temporary exception to bypass a process from prevention modules and injections.
You can generate a temporary exception to bypass a process from prevention modules and injections. You can specify paths, or command line, from both prevention and injection. This may be useful when you have processes that are essential to your organization and must not be terminated. Cortex XDR still generates alerts from data collections.
Important
Exceptions are limited up to 48 hours by default and configurable up to one week.
Consider the consequences of disabling a prevention rule before you add the exception and monitor it over time.
You can only apply a Disable Prevention Rule to agents version 7.9 and later.
Select
→ → .Click +Add Injection Rule.
Specify a rule name and an optional description.
Select the platform. To cover all your endpoints, you can prevent different exception rules per platform.
Add the Process Name , and specify the Path to bypass.
Select the time limit for the exception rule.
Select the Scope for the rule. If you want to apply the rule to only specific Exception Profiles, select them from the list.
Enable the rule.
Click Yes, to confirm that you acknowledge that the selected rules will be disabled.