Exclusion Manager

The Exclusion Manager enables you to define which processes, files, or domains are excluded from Security Policies monitoring. Three types of exclusions can be defined in the Exclusion Manager:

• (PC only) Process Exclusions: This type of exclusion specifies that EDR does not inspect the actions that are performed by specific processes, so that these processes do not trigger security events. The processes that are excluded are identified by the attributes of the processes, according to your definitions.

  There may be various reasons for excluding a process in this manner. For example, when a process’s performance/functionality is affected by EDR’s inspection, but the customer knows that this process is good/safe (this example is relevant, even when the process does not trigger security events). Therefore, in this case, the exclusion will specify that EDR no longer inspects the specified processes.

  Please note that adding this type of exclusion excludes this process from being monitored by all EDR features and all activities of this process are ignored.

• Execution Prevention Exclusions: The Execution Prevention policy inspects/scans files and then blocks their execution if they are identified as malicious or suspected to be malicious. Execution Prevention Exclusions specify that EDR does not apply the Execution Prevention policy inspection, which analyzes files in order to find evidence of malicious activity, as described in Profiles. The files that are excluded are identified by the attributes of the files that are the target of the Execution Prevention actions, according to your definitions.
• (Mobile only) Domain Exclusions: The Malicious URL/IP Detected policy inspects/scans URLs/domains and blocks connections to them if they are identified as malicious or suspected to be malicious. Domain Exclusions specify that EDR does not apply the Malicious URL/IP Detected policy inspection. The domains that are excluded are identified according to your definitions.

To manage exclusions:

Select Profiles > Security > Exclusion Manager. The following window displays, showing the list of previously created exclusions:

The list of exclusions in the Exclusion Manager page contains the following columns:

Column	Description
Checkbox	Enables you to select multiple rows.
Icon	Represents the type of exclusion - Process - Execution Prevention - Domain
SOURCE ATTRIBUTES	Specifies the attributes that were defined in order to identify the Process/File/Domain, as described in Defining exclusions
OS	Specifies the operating system to which the exclusion applies.
LAST UPDATED	Specifies when this exclusion was last updated and by whom.
STATE	Specifies whether this exclusion is enabled or disabled.
	Edit and delete excursion tools.

The following actions can be performed in the Exclusion Manager page:

• Filtering
• Defining Exclusion Lists
• Defining exclusions
• Exporting and importing exclusion lists