Understanding scan profiles and how to exclude an executable from scanning
Last Modified: 2023-02-07 22:37:49 Etc/GMT
Affected Products
Languages:
This article is available in the following languages:
Trellix CEO, Bryan Palma, explains the critical need for security that’s always learning.
As per Gartner, "XDR is an emerging technology that can offer improved threat prevention, detection and response."
Trellix announced the establishment of the Trellix Advanced Research Center to advance global threat intelligence.
Trellix Advanced Research Center analyzes threat data on ransomware, nation-states, sectors, vectors, LotL, MITRE ATT&CK techniques, and emails.
As of May 14, 2024, Knowledge Base (KB) articles will only be published and updated in our new Trellix Thrive Knowledge space.
Log in to the Thrive Portal using your OKTA credentials and start searching the new space. Legacy KB IDs are indexed and you will be able to find them easily just by typing the legacy KB ID.
Understanding scan profiles and how to exclude an executable from scanning
Technical Articles ID:
KB88595
Last Modified: 2023-02-07 22:37:49 Etc/GMT Environment
Endpoint Security (ENS) Threat Prevention 10.x
SummaryWhen you configure ENS to exclude files from being scanned, it is important to understand how to use the available options to achieve your goal.
There are three scan profiles in the Endpoint Security Threat Prevention, On-Access Scan policy to achieve a balance between security and the performance impact of scanning. The three scan profiles are:
It is common and recommended to set the Low Risk process scan policy to not scan on a file read or file write. This setting means any file reads and file writes by Low Risk processes are not scanned. You do not need to specify any scan exclusions for files and folders. For information about improving performance when scanning files, see: KB88205 - How to improve performance with Endpoint Security. How to exclude an application executable from on-access scanning To exclude a known and trusted application executable from on-access scanning, put the application executable name in an exclusion. The exclusion prevents the executable from being scanned and potentially flagged, blocked, or deleted. For instructions, see the "Preventing Threat Prevention from blocking trusted programs, networks, and services" section of the Endpoint Security 10.7 Product Guide. How to exclude all file reads/writes by a known and trusted application from on-access scanning Suppose that you have an internally developed application executable named Affected ProductsLanguages:This article is available in the following languages: |
|