You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/linux-exclusions.md
+12-12Lines changed: 12 additions & 12 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,8 +2,8 @@
2
2
title: Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
3
3
description: Provide and validate exclusions for Microsoft Defender for Endpoint on Linux. Exclusions can be set for files, folders, and processes.
4
4
ms.service: defender-endpoint
5
-
ms.author: deniseb
6
-
author: denisebmsft
5
+
ms.author: ewalsh
6
+
author: emmwalshh
7
7
ms.reviewer: gopkr, ardeshmukh
8
8
ms.localizationpriority: medium
9
9
manager: deniseb
@@ -39,24 +39,24 @@ You can exclude certain files, folders, processes, and process-opened files from
39
39
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. Global exclusions are useful for mitigating performance issues caused by Defender for Endpoint on Linux.
40
40
41
41
> [!WARNING]
42
-
> Defining exclusions lowers the protection offered by Defender for Endpoint on Linux. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
42
+
> Defining exclusions lowers the protection offered by Defender for Endpoint on Linux. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you're confident aren't malicious.
43
43
44
44
## Supported exclusion scopes
45
45
46
46
As described in an earlier section, we support two exclusion scopes: antivirus (`epp`) and global (`global`) exclusions.
47
47
48
-
Antivirus exclusions can be used to exclude trusted files and processes from real-time protection while still having EDR visibility. Global exclusions are applied at sensor level and to mute the events that match exclusion conditions very early in the flow, before any processing is done, thus stopping all EDR alerts and antivirus detections.
48
+
Antivirus exclusions can be used to exclude trusted files and processes from real-time protection while still having EDR visibility. Global exclusions are applied at sensor level and to mute the events that match exclusion conditions early in the flow, before any processing is done, thus stopping all EDR alerts and antivirus detections.
49
49
50
50
> [!NOTE]
51
-
> Global (`global`) is a new exclusion scope that we are introducing in addition to antivirus (`epp`) exclusion scopes that are already supported by Microsoft.
51
+
> Global (`global`) is a new exclusion scope that we're introducing in addition to antivirus (`epp`) exclusion scopes that are already supported by Microsoft.
| Antivirus Exclusion | Antivirus engine <br/>*(scope: epp)*| Excludes content from antivirus (AV) scans and on-demand scans.|
56
56
| Global Exclusion | Antivirus and endpoint detections and response engine <br/>*(scope: global)*| Excludes events from real time protection and EDR visibility. Doesn't apply to on-demand scans by default. |
57
57
58
58
> [!IMPORTANT]
59
-
> Global exclusions do not apply to network protection, so alerts generated by network protection will still be visible.
59
+
> Global exclusions don't apply to network protection, so alerts generated by network protection will still be visible.
60
60
> To exclude processes from network protection, please use `mdatp network-protection exclusion`
61
61
62
62
## Supported exclusion types
@@ -77,15 +77,15 @@ File, folder, and process exclusions support the following wildcards:
77
77
78
78
> [!NOTE]
79
79
> File path needs to be present before adding or removing file exclusions with scope as global.
80
-
> Wildcards are not supported while configuring global exclusions.
80
+
> Wildcards aren't supported while configuring global exclusions.
81
81
82
82
Wildcard|Description|Examples|
83
83
---|---|---
84
84
\*|Matches any number of any characters including none <br/> *(note if this wildcard isn't used at the end of the path then it substitutes only one folder)* | `/var/*/tmp` includes any file in `/var/abc/tmp` and its subdirectories, and `/var/def/tmp` and its subdirectories. It doesn't include `/var/abc/log` or `/var/def/log` <p> <p> `/var/*/` only includes any files in its subdirectories such as `/var/abc/`, but not files directly inside `/var`.
85
85
?|Matches any single character|`file?.log` includes `file1.log` and `file2.log`, but not`file123.log`
86
86
87
87
> [!NOTE]
88
-
> For antivirus exclusions, when using the * wildcard at the end of the path, it will match all files and subdirectories under the parent of the wildcard.
88
+
> For antivirus exclusions, when using the * wildcard at the end of the path, it matches all files and subdirectories under the parent of the wildcard.
89
89
90
90
## How to configure the list of exclusions
91
91
@@ -157,7 +157,7 @@ mdatp exclusion
157
157
158
158
Examples:
159
159
160
-
- Add an exclusion for a file extension *(Extension exclusion isn't supported for global exclusion scope)* :
160
+
- Add an exclusion for a file extension *(Extension exclusion isn't supported for global exclusion scope)* :
161
161
162
162
```bash
163
163
mdatp exclusion extension add --name .txt
@@ -257,14 +257,14 @@ Examples:
257
257
- Add an exclusion fora folder with a wildcardin it:
258
258
259
259
> [!NOTE]
260
-
> Wildcards are not supported while configuring global exclusions.
260
+
> Wildcards aren't supported while configuring global exclusions.
261
261
262
262
```bash
263
263
mdatp exclusion folder add --path "/var/*/tmp"
264
264
```
265
265
266
266
> [!NOTE]
267
-
> This will only exclude paths under */var/\*/tmp/*, but not folders which are siblings of *tmp*;for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
267
+
> This excludes paths under */var/\*/tmp/*, but not folders which are siblings of *tmp*; for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
0 commit comments