topic Re: Exempting downloads from particular domains from scanning in Endpoint

Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Wed, 07 Feb 2024 02:03:00 GMT

Hi,

We have a scenario where files that have MS excel macros are needed for day to day running of the business.

We are using Harmony Endpoint Client on all our machines, the files that we download are from legitimate sites that are familiar with, would like to exempt them from both Browse protection and Emulation, these two protections identify the legitimate files as malicious.

How can we exempt using the source as the domain?

Re: Exempting downloads from particular domains from scanning

the_rock — Wed, 07 Feb 2024 03:40:09 GMT

I will check tomorrow for you, but though I dont do much endpoint myself, I believe this can be done in the policy.

Best,

Andy

Re: Exempting downloads from particular domains from scanning

PhoneBoy — Wed, 07 Feb 2024 13:38:12 GMT

See: https://support.checkpoint.com/results/sk/sk128472

Re: Exempting downloads from particular domains from scanning

the_rock — Wed, 07 Feb 2024 13:44:44 GMT

As promised, this is it. But, what Phoneboy sent appears to be the right sk.

Best,

Andy

Re: Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Wed, 07 Feb 2024 17:37:06 GMT

Thank you for getting back to me. I will try the solution and give feedback.

Re: Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Wed, 07 Feb 2024 17:37:44 GMT

Thank you for this. Will follow the steps and give feedback.

Re: Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Fri, 09 Feb 2024 01:18:52 GMT

We were able to get the files from the site (there are multiple xls with macros from the same site) however, when the users try to open them, the files are Quarantined by Threat Emulation and Anti-Exploit. I still need assistance with this.

Re: Exempting downloads from particular domains from scanning

the_rock — Fri, 09 Feb 2024 01:20:48 GMT

Did you make an exceptions as we discussed?

Andy

Re: Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Fri, 09 Feb 2024 01:55:36 GMT

Yes i did.

Re: Exempting downloads from particular domains from scanning

the_rock — Fri, 09 Feb 2024 02:02:14 GMT

If that did not work, I would see if you can do remote with TAC, not sure what else could be missing.

Best,

Andy

Re: Exempting downloads from particular domains from scanning

Denis_Wahome_9A — Fri, 09 Feb 2024 02:07:28 GMT

Will open case later in the day.

Thank you for your time.

Re: Exempting downloads from particular domains from scanning

the_rock — Fri, 09 Feb 2024 02:09:02 GMT

Sounds like a plan. Keep us posted how it gets solved.

Best,

Andy

Re: Exempting downloads from particular domains from scanning

AdiGH — Tue, 13 Feb 2024 17:38:58 GMT

Hey,

According to the screenshot, you've excluded it from web downloads but not from other blades.

I would also suggest to move to smart exclusions where creating exclusions provides many more capabilities and is also more user friendly. If you want to join the EA provide me with your tenant ID via a private msg or alternatively reach out to us via the feedback button in the portal.