Exclusion

An exclusion prevents the agent from detecting or acting on specified files. You can define an exclusion by file mask, hash, or certificate. Excluded files are not scanned and generate no alert. An exclusion applies only to the specified file; it does not extend to child or parent processes.

Every exclusion lowers protection. Use the narrowest exclusion type that meets your needs: a hash, then a leaf certificate, then a file mask.

To view exclusions, navigate to Policy > Exclusion.

Exclusion List

The list displays the following columns:

• Tenant
• Type: FILE (a file mask exclusion), HASH, or CERTIFICATE.
• Name and Description
• Value: The file mask, hash, thumbprint, subject, or issuer.
• Cmdline Params: N/A displays if none are defined.
• Status: Enabled or Disabled.
• Updated At and Created At

Viewing Exclusion by Scope

Use the All related Scopes drop-down list to select one of the following:

• This scope and its ancestors: Shows the exclusions at the selected scope and at the scopes above it (its parent scopes).
• This scope and its descendants: Shows the exclusions at the selected scope and at the scopes below it (its child scopes).

Filtering the List

1. Click Filter.

2. Use one or more of the following fields: Type, Name, Description, and Status.

   

3. Click Clear to remove all filters.

Downloading the List

Click Download to save the list as a CSV file named Exclusion-YYYY-MM-DD HH_MM_SS.csv. The file contains the following columns, which correspond to the columns in the list:

• scope: The scope of the exclusion. This column appears only in the downloaded file.
• type: Type
• title: Name
• description: Description
• value: Value
• cmdLineParams: Cmdline Params
• is_enabled: Status
• updated_at: Updated At (UTC)
• created_at: Created At (UTC)

Adding Exclusion

You can add an exclusion by file mask, hash, or certificate. Each exclusion type has its own procedure.

File Mask Exclusion

File mask exclusions allow you to exclude files or folders from detection and prevention based on a folder path or file name mask. Use this type to trust an application folder or a specific file without needing its hash. You can optionally specify command-line parameters.

A folder mask is the broadest exclusion type. Any file placed in an excluded folder is also excluded.

Adding a File Mask Exclusion

1. Navigate to Policy > Exclusion, and then click + Create.
2. Under Base Info, enter a Name and, optionally, a Description.

3. Keep Enable Rule turned on to make the exclusion active. If you turn it off, the exclusion is saved but not enforced.

   

4. Under Locations, select File Mask from the drop-down list.

5. In the Folder & File Name Mask field, enter the folder path or file mask, for example, C:\Program Files\<vendor>\<product>\.

   Use the wildcard asterisk (*) as required. For example:

   • C:\test\*: Excludes files that match the specified file name pattern within the path.
   • C:\test\**: Excludes files regardless of file name and extension within the path and its subfolders.
   • *.<extension>: Excludes all files with the specified extension, for example, *.txt, *.apl, or *.xls.

6. In the CMD Line Params field, enter the command-line parameters, if applicable.

   

7. Click Save.

Hash Exclusion

Hash exclusions allow you to exclude a specific file from detection and prevention based on its hash value. Because the hash identifies the exact file, the exclusion does not apply to other files.

Adding a Hash Exclusion

1. Navigate to Policy > Exclusion, and then click + Create.
2. Under Base Info, enter a Name and, optionally, a Description.
3. Keep Enable Rule turned on to make the exclusion active.
4. Under Locations, select Hash from the drop-down list.

5. In the Hash field, enter the hash value of the file.

   

6. Click Save.

Certificate Exclusion

Certificate exclusions allow you to exclude applications from detection and prevention based on the digital signature embedded in the file. Use this feature to trust software from a known publisher without creating exclusions for each file.

Obtaining Certificate Details

Use the PrintCerts tool to display the certificates embedded in a file.

1. Click https://therondownloadtools.s3.us-east-1.amazonaws.com/PrintCerts.exe to download the PrintCerts.exe file.
2. Open a command prompt.

3. Run the following command:

   PrintCerts.exe "C:\path\to\file.exe"

   The command creates a certinfo.txt file in the current folder.

   

4. Open the certinfo.txt file and copy the Hash Thumbprint, Subject, or Issuer value exactly as the file displays it.

   

   The Hash Thumbprint is the thumbprint of the certificate. It is not the file hash that you enter for a hash exclusion.

Adding a Certificate Exclusion

1. Navigate to Policy > Exclusion, and then click + Create.
2. Under Base Info, enter a Name and, optionally, a Description.
3. Keep Enable Rule turned on to make the exclusion active.

4. Under Locations, select Certificate from the drop-down list.

   An Intermediate CA or Root CA exclusion trusts every file signed under that certificate. Use Leaf whenever possible.

5. From the Certificate Type drop-down list, select one of the following. Use Leaf whenever possible.

   • Any (default): Matches the certificate at any level of the signing chain. This is the broadest option.
   • Leaf: The certificate issued to the signer of the file.
   • Intermediate CA: A certificate authority certificate that issued the leaf certificate.
   • Root CA: The top-level certificate authority certificate at the start of the signing chain.

   

6. Select one matching method, and then enter the value:

   • Hash Thumbprint: Enter the SHA-1 or SHA-256 thumbprint.
   • Subject: Enter the subject exactly as displayed by PrintCerts.
   • Issuer: Enter the issuer exactly as displayed by PrintCerts.

   

7. Click Save.

Considerations for certificate exclusions:

• The certificate must be embedded in the file. Unsigned files cannot be excluded.
• The subject or issuer value must match the certificate text, including spaces and special characters. The comparison ignores letter case.
• Choose one matching method. You cannot require the subject and the issuer to match together.
• Most files do not embed the root CA certificate, so a Root CA exclusion rarely matches.

Managing Exclusion

1. Select one or more exclusions. The Table Action button displays the number selected.
2. Click Table Action, and then select one of the following:
   • Enable Rule: Activates the selected exclusions.
   • Disable Rule: Deactivates the selected exclusions without deleting them.
   • Delete Rule: Displays a confirmation prompt to delete the selected exclusions.
3. For Delete Rule, click Confirm to delete the selected exclusions, or click Cancel to make no changes.

In the Table Action menu, each exclusion is called a rule.

Deleting an exclusion is permanent and cannot be undone. Use Disable Rule to stop excluding the files temporarily.