Trusted applications, websites, and services can be excluded from the security engine so they aren't detected, blocked, or quarantined by our software. Super Admins can manage exclusions by adding, editing, or deleting them in the console to prevent disruptions from false positives. See the sections below for steps to manage exclusions.
Before adding exclusions, go through this overview to understand the types of exclusions available and the syntax required.
If you'd rather confirm with the ThreatDown research team if something is malicious, report a false positive instead. For more information, see Report a false positive to ThreatDown.
Configure exclusions
- Go to Configure > Exclusions.
- Click New exclusion.
- Complete the following fields:
- Values: Enter each exclusion on a separate line using the syntax outlined in the overview article.
- Apply to: Select whether to apply the exclusion to all endpoints or specific policies.
- Click Analyze Values. Checks the entered values for syntax errors, whether they're already added in the console, and how much risk they pose to your environment. See table below for more details on validations.
- For High-risk exclusions, a comment is required to note down why the exclusion was added.
- Click Save. In the top-right, a confirmation message displays The exclusions were successfully created.
To edit an exclusion after it's been created, click on the exclusion and make the required changes.
The exclusion is applied to the assigned endpoints within minutes, provided the real-time WebSocket communication occurs between the endpoints and Nebula. For more information, see Manage endpoints in Nebula.
Exclusion validations
| Exclusion validations | Description |
|---|---|
| Type | Automatically detected exclusion type based on the value entered. Click the edit icon |
| Categories | Nebula protection layers affected by the exclusion. Click Edit categories to change the protection layers. |
| Value | Displays the exclusion value entered. |
| Scope | Whether the exclusion applies to all endpoints (Global) or specific policies. |
| Risk | Shows the level of security risk this exclusion introduces to your environment. |
| Actions | Click the |
| Comment | Provide a comment to give the exclusion a unique description. |