You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
3.[How to configure the list of exclusions](#how-to-configure-the-list-of-exclusions)
30
+
4.[Validate exclusions lists with the EICAR test file](#validate-exclusions-lists-with-the-eicar-test-file)
31
+
5.[Allow threats](#allow-threats)
32
+
25
33
**Applies to:**
26
34
27
35
-[Microsoft Defender for Endpoint Plan 1](microsoft-defender-endpoint.md)
@@ -30,51 +38,73 @@ ms.date: 06/24/2024
30
38
31
39
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://signup.microsoft.com/create-account/signup?products=7f379fee-c4f9-4278-b0a1-e4c8c2fcdf7e&ru=https://aka.ms/MDEp2OpenTrial?ocid=docs-wdatp-investigateip-abovefoldlink)
32
40
33
-
This article provides information on how to define exclusions that apply to on-demand scans, and real-time protection and monitoring.
41
+
This article provides information on how to define antivirus and global exclusions for Microsoft Defender for Endpoint. Antivirus exclusions apply to on-demand scans, real-time protection (RTP), and behavior monitoring (BM). Global exclusions apply to real-time protection (RTP), behavior monitoring (BM), and endpoint detection and response (EDR), thus stopping all the associated antivirus detections, EDR alerts, and visibility for the excluded item.
34
42
35
43
> [!IMPORTANT]
36
-
> The exclusions described in this article don't apply to other Defender for Endpoint on Linux capabilities, including endpoint detection and response (EDR). Files that you exclude using the methods described in this article can still trigger EDR alerts and other detections. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
44
+
> The antivirus exclusions described in this article apply to only antivirus capabilities and not endpoint detection and response (EDR). Files that you exclude using the antivirus exclusions described in this article can still trigger EDR alerts and other detections. Whereas the global exclusions described in this section apply to antivirus as well as endpoint detection and response capabilities thus stopping all associated AV protection, EDR alerts and detection. Global exclusions are available from Defender for Endpoint version `101.23092.0012` or later. For EDR exclusions, [contact support](/microsoft-365/admin/get-help-support).
37
45
38
-
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux scans.
46
+
You can exclude certain files, folders, processes, and process-opened files from Defender for Endpoint on Linux.
39
47
40
-
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. They can also be useful for mitigating performance issues caused by Defender for Endpoint on Linux.
48
+
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. Global exclusions are useful for mitigating performance issues caused by Defender for Endpoint on Linux.
41
49
42
50
> [!WARNING]
43
51
> Defining exclusions lowers the protection offered by Defender for Endpoint on Linux. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
44
52
53
+
## Supported exclusion scopes
54
+
55
+
As described in an earlier section, we support two exclusion scopes: antivirus (`epp`) and global (`global`) exclusions.
56
+
57
+
Antivirus exclusions can be used to exclude trusted files and processes from real-time protection while still having EDR visibility. Global exclusions are applied at sensor level and to mute the events that match exclusion conditions very early in the flow, before any processing is done, thus stopping all EDR alerts and antivirus detections.
58
+
59
+
> [!NOTE]
60
+
> Global (`global`) is a new exclusion scope that we are introducing in addition to antivirus (`epp`) exclusion scopes that are already supported by Microsoft.
| Antivirus Exclusion | Antivirus engine <br/>*(scope: epp)*| Excludes content from antivirus (AV) scans and on-demand scans.|
65
+
| Global Exclusion | Antivirus and endpoint detections and response engine <br/>*(scope: global)*| Excludes events from real time protection and EDR visibility. Doesn't apply to on-demand scans by default. |
66
+
45
67
## Supported exclusion types
46
68
47
69
The following table shows the exclusion types supported by Defender for Endpoint on Linux.
48
70
49
71
Exclusion|Definition|Examples
50
72
---|---|---
51
-
File extension|All files with the extension, anywhere on the device|`.test`
73
+
File extension|All files with the extension, anywhere on the device (not available for global exclusions) |`.test`
52
74
File|A specific file identified by the full path|`/var/log/test.log`<br/>`/var/log/*.log`<br/>`/var/log/install.?.log`
53
75
Folder|All files under the specified folder (recursively)|`/var/log/`<br/>`/var/*/`
54
76
Process|A specific process (specified either by the full path or file name) and all files opened by it|`/bin/cat`<br/>`cat`<br/>`c?t`
55
77
56
78
> [!IMPORTANT]
57
-
> The paths above must be hard links, not symbolic links, in order to be successfully excluded. You can check if a path is a symbolic link by running `file <path-name>`.
79
+
> The paths used must be hard links, not symbolic links, in order to be successfully excluded. You can check if a path is a symbolic link by running `file <path-name>`.
58
80
59
81
File, folder, and process exclusions support the following wildcards:
60
82
83
+
> [!NOTE]
84
+
> Wildcards are not supported while configuring global exclusions.
85
+
61
86
Wildcard|Description|Examples|
62
87
---|---|---
63
-
\*|Matches any number of any characters including none (note if this wildcard is not used at the end of the path then it will substitute only one folder)| `/var/*/tmp` includes any file in `/var/abc/tmp` and its subdirectories, and `/var/def/tmp` and its subdirectories. It does not include `/var/abc/log` or `/var/def/log` <p> <p> `/var/*/` only includes any files in its subdirectories such as `/var/abc/`, but not files directly inside `/var`.
88
+
\*|Matches any number of any characters including none <br/> *(note if this wildcard isn't used at the end of the path then it substitutes only one folder)*| `/var/*/tmp` includes any file in `/var/abc/tmp` and its subdirectories, and `/var/def/tmp` and its subdirectories. It doesn't include `/var/abc/log` or `/var/def/log` <p> <p> `/var/*/` only includes any files in its subdirectories such as `/var/abc/`, but not files directly inside `/var`.
64
89
?|Matches any single character|`file?.log` includes `file1.log` and `file2.log`, but not`file123.log`
90
+
65
91
> [!NOTE]
66
-
> When using the * wildcard at the end of the path, it will match all files and subdirectories under the parent of the wildcard.
92
+
For antivirus exclusions, when using the * wildcard at the end of the path, it will match all files and subdirectories under the parent of the wildcard.
67
93
68
94
## How to configure the list of exclusions
69
95
70
-
### From the management console
96
+
### Using the management console
71
97
72
98
For more information on how to configure exclusions from Puppet, Ansible, or another management console, see [Set preferences for Defender for Endpoint on Linux](linux-preferences.md).
73
99
74
-
### From the command line
100
+
### Using the command line
75
101
76
102
Run the following command to see the available switches for managing exclusions:
77
103
104
+
> [!NOTE]
105
+
> `--scope` is an optional flag with accepted value as `epp` or `global`. It provides the same scope used while adding the exclusion to remove the same exclusion. In the command line approach, if the scope isn’t mentioned, the scope value is set as `epp`.
106
+
> Exclusions added through CLI before the introduction of `--scope` flag remain unaffected and their scope is considered `epp`.
107
+
78
108
```bash
79
109
mdatp exclusion
80
110
```
@@ -84,7 +114,7 @@ mdatp exclusion
84
114
85
115
Examples:
86
116
87
-
- Add an exclusion for a file extension:
117
+
- Add an exclusion for a file extension*(Extension exclusion isn't supported for global exclusion scope)* :
mdatp exclusion folder add --path /other/folder --scope global
122
207
```
123
208
124
209
```console
125
210
Folder exclusion configured successfully
126
211
```
127
212
128
213
- Add an exclusion fora folder with a wildcardin it:
214
+
215
+
> [!NOTE]
216
+
> Wildcards are not supported while configuring global exclusions.
129
217
130
218
```bash
131
219
mdatp exclusion folder add --path "/var/*/tmp"
132
220
```
133
221
134
222
> [!NOTE]
135
-
> This will only exclude paths below*/var/\*/tmp/*, but not folders which are siblings of *tmp*;for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
223
+
> This will only exclude paths under*/var/\*/tmp/*, but not folders which are siblings of *tmp*;for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
> This will exclude all paths whose parent is */var/*;for example, */var/this-subfolder/and-this-subfolder-as-well*.
@@ -153,18 +240,43 @@ Examples:
153
240
- Add an exclusion for a process:
154
241
155
242
```bash
156
-
mdatp exclusion process add --name cat
243
+
mdatp exclusion process add --name /usr/bin/cat --scope global
244
+
```
245
+
246
+
```console
247
+
Process exclusion configured successfully
248
+
```
249
+
250
+
```bash
251
+
mdatp exclusion process remove --name /usr/bin/cat --scope global
252
+
```
253
+
254
+
```Output
255
+
Process exclusion removed successfully
256
+
```
257
+
258
+
```bash
259
+
mdatp exclusion process add --name /usr/bin/cat --scope epp
157
260
```
158
261
159
262
```console
160
263
Process exclusion configured successfully
161
264
```
162
265
266
+
267
+
```bash
268
+
mdatp exclusion process remove --name /usr/bin/cat --scope epp
269
+
```
270
+
271
+
```Output
272
+
Process exclusion removed successfully
273
+
```
274
+
163
275
- Add an exclusion for a second process:
164
276
165
277
```bash
166
-
mdatp exclusion process add --name cat
167
-
mdatp exclusion process add --name dog
278
+
mdatp exclusion process add --name cat --scope epp
279
+
mdatp exclusion process add --name dog --scope global
168
280
```
169
281
170
282
```console
@@ -175,21 +287,21 @@ Examples:
175
287
176
288
You can validate that your exclusion lists are working by using `curl` to download a test file.
177
289
178
-
In the following Bash snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you are testing a path, ensure that you run the command within that path.
290
+
In the following Bash snippet, replace `test.txt` with a file that conforms to your exclusion rules. For example, if you have excluded the `.testing` extension, replace `test.txt` with `test.testing`. If you're testing a path, ensure that you run the command within that path.
If Defender for Endpoint on Linux reports malware, then the rule is not working. If there is no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/).
296
+
If Defender for Endpoint on Linux reports malware, then the rule isn't working. If there's no report of malware, and the downloaded file exists, then the exclusion is working. You can open the file to confirm that the contents are the same as what is described on the [EICAR test file website](https://www.eicar.org/download-anti-malware-testfile/).
185
297
186
-
If you do not have Internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
298
+
If you don't have Internet access, you can create your own EICAR test file. Write the EICAR string to a new text file with the following Bash command:
0 commit comments