Create exclusion for specific process

[DanielTveriya]

Hi,

I am having trouble excluding processes that Harmony EDR blocks.
The Protection name is: RAT_Linux_NukeSped_D
I tried a few exclusions, but it didn't work.

It's happening when we're running a build with Docker on Linux endpoints.
In the log, it shows 2 preventive actions.

My goal is to exclude this kind of process and not all the Protection name.

Thanks

  

[the_rock]

Does it give an option anywhere from the log itself to add an exception?

[DanielTveriya]

Hi Andy,
No, its not supported with creation of rule from logs view, becasue its linux agent.

[the_rock]

Understood Daniel. Maybe worth TAC case to confirm.

[DanielTveriya]

Thanks Andy

Yes, I spoke with the support team, and they are testing it internally.

[the_rock]

Let us know how it goes.

[lluner]

@DanielTveriya 

Right-clicking on the "prevent" alert (as shown in the image) does not display the exclusion option ?

[DanielTveriya]

Hi @lluner 

Unfortunately, this type of process is not supported for Linux endpoints.

Thanks

[lluner · Accepted solution]

@DanielTveriya 

You can create the exclusion; the link for help is below.

sk181679 - Smart Exclusions - Syntax and Supported Capabilities for Exclusion Types

[DanielTveriya]

@lluner 

Thanks, my friend.

Yesterday I excluded the path for this process and it worked,

Wanted to update after I received feedback from the user.

Thanks for the help

[the_rock]

Excellent, thanks for letting us know!