Exclusions

1. Click the Add exclusions button and start defining the new exclusion rule.

2. Select the exclusion object type from the menu:

   • File: only the specified file

   • Folder: all files and processes inside the specified folder and from all of its subfolders

   • Extension: all items having the specified extension

   • Process: any object accessed by the excluded process

   • File hash: the file with the specified hash (in SHA-256 format)

   • Certificate hash: all the applications and PowerShell scripts (for Windows endpoints) under the specified certificate hash (thumbprint, in SHA-1 and SHA-2 format)

   • Threat name: any item having the detection name (not available for Linux operating systems)

   • Command line with regex: the specified command line using regular expressions (available only for Windows operating systems)

   • Command line: the specified command line (available only for Windows operating systems)

   • IP/mask: The IP address or IP mask (0-255 format) for which inbound and outbound traffic will be excluded from scanning.

3. Provide the details specific to the selected exclusion type:

   File, Folder or Process

   Enter the path to the item to be excluded from scanning. You have several helpful options to write the path:

   • Declare the path explicitly.

     For example: C:\temp

     To add exclusions for UNC paths, use any of the following syntaxes:

     \\hostName\shareName\filePath

     \\IPaddress\shareName\filePath

     Supported path delimiters are the backslash character (\), the slash character (/), and the colon (:).

   • Use wildcards.

     The asterisk (*) substitutes for zero or more characters. Double asterisk (**) substitutes for zero or more characters. The question mark (?) substitutes for exactly one character. You can use several question marks to define any combination of a specific number of characters. For example, ??? substitutes for any combination of exactly three characters.

     For example:

     C:\Test\*.* – excludes all files in the Test folder.

     C:\Test\*.png – excludes all PNG files in the Test folder.

     C:\Test\* - excludes all files in the Test folder.

     **\file.txt - excludes all the files that have the name file.txt, regardless where these files are located.

     **\my_folder\*\file.txt - excludes all the folders on all levels above my_folder and all subfolders on a single level under my_folder that contain file.txt.

     **\application*.exe - excludes all the files that have the name application and variations of this name followed by one or more characters, regardless where the files are located.

     C:\MyApp\** - excludes all files and folders in MyApp folder, regardless of the depth level.

     C:\Program Files\WindowsApps\Microsoft.Not??.exe – excludes the Microsoft Notes processes.

   Note

   • On macOS, the asterisk (*) and the question mark (?) can substitute path delimiters, unlike on Windows and Linux. Only the double asterisk (**) on Windows substitutes path delimiters.

   • The double asterisk (**) can lead to undesired exclusions when misused, therefore we recommend caution.

   • The double asterisk (**) is not available on macOS. On this operating system you can only use the asterisk (*) and the question mark (?) as wildcards.

   • Process exclusions do not support wildcards on Linux operating systems.

   Extension

   Enter one or more file extensions to be excluded from scanning, separating them with a semicolon ";". You can enter extensions with or without the preceding dot. For example, enter txt to exclude text files.

   Note

   On Linux-based systems, file extensions are case sensitive and the files with the same name but with different extension are considered distinct objects. For example, file.txt is different from file.TXT.

   File hash, Certificate hash, Threat name, Command line, or Command line with regex

   Enter the file hash, certificate thumbprint (hash), the exact name of the threat or the command line depending on the exclusion rule. You can use one item per exclusion.

   Note

   A limitation is currently present for command line exclusions when quotation marks are involved in the command line of the process.

   Command line examples:

   npm install
   npx nx format
   tester.exe acceptance --run-all-tests      

   Command line with regex example:

   C\:\\Users\\[a-z]+\\Desktop\\app.exe param1 param2.value
   

4. Select the scanning methods to which the rule applies. Some exclusions may be relevant for just one of the scanning modules (On-access scanning, On-demand scanning, ATC/IDS, Ransomware Mitigation, LSASS Protection), while others may be recommended for all of the modules.

5. Optionally, click the Show remarks button to add a note in the Remarks column about the rule.

6. Click the Add button.

   The new rule will be added to the list.

   To remove a rule from the list, click the corresponding Delete button.

   Important

   On-demand scanning exclusions will not apply to contextual scanning. Contextual scanning is initiated by right-clicking a file or folder and selecting Scan with Bitdefender Endpoint Security Tools.

To assign an exclusion rule to one or multiple lists:

1. In the grid area, click the More button, and then Edit list assignment.

   

2. In the configuration page, from the drop-down menu, select the lists that will add the exclusion rule to their content and click Apply.

   

   In the Lists preview area you can see the exclusion lists you are about to update.

   

3. Click Save to complete the process.

1. In the grid area, select one or more exclusions.

2. Click the Assign to lists button.

3. In the configuration page, from the drop-down menu, select the lists that will add the exclusion rules to their content and click Apply.

   In the Lists Preview area you can see the exclusion lists you are about to update.

4. Click Assign to complete the process.