You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-exclusions.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -70,7 +70,7 @@ The following table shows the exclusion types supported by Defender for Endpoint
70
70
|File extension|All files with the extension, anywhere on the device (not available for global exclusions) |`.test`|
71
71
|File|A specific file identified by the full path|`/var/log/test.log`<br/>`/var/log/*.log`<br/>`/var/log/install.?.log`|
72
72
|Folder|All files under the specified folder (recursively)|`/var/log/`<br/>`/var/*/`|
73
-
|Process|A specific process (specified either by the full path or file name) and all files opened by it.<br/>*We recommend using full and trusted process launch path.*|`/bin/cat`<br/>`cat`<br/>`c?t`|
73
+
|Process|A specific process (specified either by the full path or file name) and all files opened by it.<br/>Antivirus exclusions can be added using either a full path or file name, but for global exclusions, only use full and trusted process launch paths. In both the cases, it is recommended to use the full path.|`/bin/cat`<br/>`cat`<br/>`c?t`|
74
74
75
75
> [!IMPORTANT]
76
76
> The paths used must be hard links, not symbolic links, in order to be successfully excluded. You can check if a path is a symbolic link by running `file <path-name>`. When implementing global process exclusions, exclude only what is necessary to ensure system reliability and security. Verify that the process is known and trusted, specify the complete path to the process location, and confirm that the process will consistently launch from the same trusted full path.
0 commit comments