topic Why is the (smart) exclusion not working? in Endpoint

Why is the (smart) exclusion not working?

CP-Shark — Mon, 07 Sep 2026 18:17:23 GMT

Hey guys,

we recently upgraded several servers to E89.25 and have noticed that certain Smart Exclusions are no longer working as expected.

While reviewing the TE.log collected via CPInfo, I found indications that the exclusions are not being applied correctly.

The screenshot below shows how the exclusion was configured. Based on the information provided in sk181679 - Smart Exclusions - Syntax and Supported Capabilities for Exclusion Types, this exclusion should also be valid for Forensics and therefore should prevent the related processing.

Has anyone seen similar behavior after upgrading to E89.25, or does anyone have an idea what might be causing this?
And please not again the answer that this is a case for a TAC ...

Cheers,
Oliver

Re: Why is the (smart) exclusion not working?

lluner — Wed, 09 Sep 2026 13:51:14 GMT

@CP-Shark

From what I can see in the images, Blade Forensics is showing an alert. Could you check what is happening?

Re: Why is the (smart) exclusion not working?

CP-Shark — Wed, 09 Sep 2026 14:26:30 GMT

@lluner thanks for the reply. This is just a hint we find in every exclusion:

Re: Why is the (smart) exclusion not working?

lluner — Wed, 09 Sep 2026 18:11:54 GMT

@CP-Shark

Put it in this field.

Process name

manager.exe

Process path

**\manager.exe

Keep only the forensics blade. I believe each blade has a different configuration and support.

Re: Why is the (smart) exclusion not working?

CP-Shark — Wed, 09 Sep 2026 20:35:25 GMT

I guess this could be an idea, but not the solution. And you mean EFR-M and not EFR-AR?
In an older version we had no issues and we cannot separate all exclusions.
We´ve opened a ticket via our SP.