Exempting downloads from particular domains from scanning

[Denis_Wahome_9A]

Hi,

We have a scenario where files that have MS excel macros are needed for day to day running of the business.

We are using Harmony Endpoint Client on all our machines, the files that we download are from legitimate sites that are familiar with, would like to exempt them from both Browse protection and Emulation, these two protections identify the legitimate files as malicious.

How can we exempt using the source as the domain? 

[the_rock]

I will check tomorrow for you, but though I dont do much endpoint myself, I believe this can be done in the policy.

Best,

Andy

[PhoneBoy]

See: https://support.checkpoint.com/results/sk/sk128472 

[Denis_Wahome_9A]

Thank you for this. Will follow the steps and give feedback.

[the_rock]

As promised, this is it. But, what Phoneboy sent appears to be the right sk.

Best,

Andy

 

[Denis_Wahome_9A]

Thank you for getting back to me. I will try the solution and give feedback.

[Denis_Wahome_9A]

We were able to get the files from the site (there are multiple xls with macros from the same site) however, when the users try to open them, the files are Quarantined by Threat Emulation and Anti-Exploit. I still need assistance with this.

[the_rock]

Did you make an exceptions as we discussed?

Andy

[Denis_Wahome_9A]

Yes i did. 

[the_rock]

If that did not work, I would see if you can do remote with TAC, not sure what else could be missing.

Best,

Andy

[Denis_Wahome_9A]

Will open case later in the day. 

Thank you for your time.

[the_rock]

Sounds like a plan. Keep us posted how it gets solved.

Best,

Andy

[AdiGH]

Hey, 

According to the screenshot, you've excluded it from web downloads but not from other blades. 

I would also suggest to move to smart exclusions where creating exclusions provides many more capabilities and is also more user friendly. If you want to join the EA provide me with your tenant ID via a private msg or alternatively reach out to us via the feedback button in the portal.