Skip to content

Commit ee70dc2

Browse files
committed
Update linux-exclusions.md
1 parent ebfe801 commit ee70dc2

File tree

1 file changed

+12
-12
lines changed

1 file changed

+12
-12
lines changed

defender-endpoint/linux-exclusions.md

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,8 @@
22
title: Configure and validate exclusions for Microsoft Defender for Endpoint on Linux
33
description: Provide and validate exclusions for Microsoft Defender for Endpoint on Linux. Exclusions can be set for files, folders, and processes.
44
ms.service: defender-endpoint
5-
ms.author: deniseb
6-
author: denisebmsft
5+
ms.author: ewalsh
6+
author: emmwalshh
77
ms.reviewer: gopkr, ardeshmukh
88
ms.localizationpriority: medium
99
manager: deniseb
@@ -39,24 +39,24 @@ You can exclude certain files, folders, processes, and process-opened files from
3939
Exclusions can be useful to avoid incorrect detections on files or software that are unique or customized to your organization. Global exclusions are useful for mitigating performance issues caused by Defender for Endpoint on Linux.
4040

4141
> [!WARNING]
42-
> Defining exclusions lowers the protection offered by Defender for Endpoint on Linux. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you are confident are not malicious.
42+
> Defining exclusions lowers the protection offered by Defender for Endpoint on Linux. You should always evaluate the risks that are associated with implementing exclusions, and you should only exclude files that you're confident aren't malicious.
4343
4444
## Supported exclusion scopes
4545

4646
As described in an earlier section, we support two exclusion scopes: antivirus (`epp`) and global (`global`) exclusions.
4747

48-
Antivirus exclusions can be used to exclude trusted files and processes from real-time protection while still having EDR visibility. Global exclusions are applied at sensor level and to mute the events that match exclusion conditions very early in the flow, before any processing is done, thus stopping all EDR alerts and antivirus detections.
48+
Antivirus exclusions can be used to exclude trusted files and processes from real-time protection while still having EDR visibility. Global exclusions are applied at sensor level and to mute the events that match exclusion conditions early in the flow, before any processing is done, thus stopping all EDR alerts and antivirus detections.
4949

5050
> [!NOTE]
51-
> Global (`global`) is a new exclusion scope that we are introducing in addition to antivirus (`epp`) exclusion scopes that are already supported by Microsoft.
51+
> Global (`global`) is a new exclusion scope that we're introducing in addition to antivirus (`epp`) exclusion scopes that are already supported by Microsoft.
5252
5353
| Exclusion Category | Exclusion Scope | Description |
5454
| --- | --- | --- |
5555
| Antivirus Exclusion | Antivirus engine <br/>*(scope: epp)* | Excludes content from antivirus (AV) scans and on-demand scans.|
5656
| Global Exclusion | Antivirus and endpoint detections and response engine <br/>*(scope: global)* | Excludes events from real time protection and EDR visibility. Doesn't apply to on-demand scans by default. |
5757

5858
> [!IMPORTANT]
59-
> Global exclusions do not apply to network protection, so alerts generated by network protection will still be visible.
59+
> Global exclusions don't apply to network protection, so alerts generated by network protection will still be visible.
6060
> To exclude processes from network protection, please use `mdatp network-protection exclusion`
6161
6262
## Supported exclusion types
@@ -77,15 +77,15 @@ File, folder, and process exclusions support the following wildcards:
7777

7878
> [!NOTE]
7979
> File path needs to be present before adding or removing file exclusions with scope as global.
80-
> Wildcards are not supported while configuring global exclusions.
80+
> Wildcards aren't supported while configuring global exclusions.
8181
8282
Wildcard|Description|Examples|
8383
---|---|---
8484
\*|Matches any number of any characters including none <br/> *(note if this wildcard isn't used at the end of the path then it substitutes only one folder)* | `/var/*/tmp` includes any file in `/var/abc/tmp` and its subdirectories, and `/var/def/tmp` and its subdirectories. It doesn't include `/var/abc/log` or `/var/def/log` <p> <p> `/var/*/` only includes any files in its subdirectories such as `/var/abc/`, but not files directly inside `/var`.
8585
?|Matches any single character|`file?.log` includes `file1.log` and `file2.log`, but not`file123.log`
8686

8787
> [!NOTE]
88-
> For antivirus exclusions, when using the * wildcard at the end of the path, it will match all files and subdirectories under the parent of the wildcard.
88+
> For antivirus exclusions, when using the * wildcard at the end of the path, it matches all files and subdirectories under the parent of the wildcard.
8989
9090
## How to configure the list of exclusions
9191

@@ -157,7 +157,7 @@ mdatp exclusion
157157
158158
Examples:
159159

160-
- Add an exclusion for a file extension *(Extension exclusion isn't supported for global exclusion scope)* :
160+
- Add an exclusion for a file extension *(Extension exclusion isn't supported for global exclusion scope)* :
161161

162162
```bash
163163
mdatp exclusion extension add --name .txt
@@ -257,14 +257,14 @@ Examples:
257257
- Add an exclusion for a folder with a wildcard in it:
258258

259259
> [!NOTE]
260-
> Wildcards are not supported while configuring global exclusions.
260+
> Wildcards aren't supported while configuring global exclusions.
261261
262262
```bash
263263
mdatp exclusion folder add --path "/var/*/tmp"
264264
```
265265
266266
> [!NOTE]
267-
> This will only exclude paths under */var/\*/tmp/*, but not folders which are siblings of *tmp*; for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
267+
> This excludes paths under */var/\*/tmp/*, but not folders which are siblings of *tmp*; for example, */var/this-subfolder/tmp*, but not */var/this-subfolder/log*.
268268
269269
```bash
270270
mdatp exclusion folder add --path "/var/" --scope epp
@@ -276,7 +276,7 @@ Examples:
276276
```
277277
278278
> [!NOTE]
279-
> This will exclude all paths whose parent is */var/*; for example, */var/this-subfolder/and-this-subfolder-as-well*.
279+
> This excludes all paths whose parent is */var/*; for example, */var/this-subfolder/and-this-subfolder-as-well*.
280280
281281
```console
282282
Folder exclusion configured successfully

0 commit comments

Comments
 (0)