topic Re: Exception for Application based on Certificate in Endpoint

Exception for Application based on Certificate

morris — Mon, 12 May 2025 08:24:12 GMT

Hi,

we have some applications which are blocked by Harmony Endpoint. We are very sure, that its a false-positive.

The software is signed with a certificate by the developer.

Is there any configuration where we can whitelist all software which is signed by this certificate.

This behaviour mostly occurs after the software gets an update.

Re: Exception for Application based on Certificate

lluner — Mon, 12 May 2025 11:13:39 GMT

@morris

Could you show the logs to know which blade is blocking?

Re: Exception for Application based on Certificate

lluner — Mon, 12 May 2025 11:21:16 GMT

this sk can help you sk181679 - Smart Exclusions - Syntax and Supported Capabilities for Exclusion Types

Re: Exception for Application based on Certificate

morris — Mon, 12 May 2025 11:44:43 GMT

Its Forensics and Threat Emulation

Re: Exception for Application based on Certificate

lluner — Mon, 12 May 2025 12:01:43 GMT

@morris

You can exclusions it by right-clicking mouse on it.

Re: Exception for Application based on Certificate

morris — Mon, 12 May 2025 15:24:14 GMT

That did the magic. thanks!

But isn't that kinda unsecure somehow? You just paste the signer of the Certificate as a string.

I know from solutions like Cylance that you upload the certificate itself into the management portal.

Re: Exception for Application based on Certificate

lluner — Mon, 12 May 2025 16:48:16 GMT

@morris

Você pode testar e colocar esse problema de certificado na exclusão forense, não sei se vai funcionar? Por algum motivo, esse executável está alertando a lâmina TE