Site icon Emsisoft Help

How to add a Monitoring Exclusion after our lab whitelisted the app?

How to add a Monitoring Exclusion after our lab whitelisted the app?

Overview:
If a quarantined app was submitted to our lab and subsequently whitelisted as explained here, it usually needs to be added to Monitoring Exclusions, especially if the app is not digitally signed.
If the app is not added, it will be flagged every time it is updated without the necessary certificate.

How to add an app to Monitoring Exclusions:
First, you need to identify the path where the file is located.

Please open Emsisoft and click on: Logs

Then double click the file you want to exclude:

Copy the path:

Next, log into my.emsisoft.com, open the Workspace, and click on Protection Policies.

Choose the desired protection group where you want to apply the Monitoring Exclusion.
It is best to apply exclusions at the root level which always has the name of the Workspace. All subgroups or child groups inherit the settings from the root level.
Further changes can be then made on subgroup levels or the device level.

Next, scroll down on the right to: Exclude from monitoring

Add the desired exclusion for the app by clicking on: Add programs and add the path that you previously copied from the log.

While you can exclude complete folders, this is not recommended for security reasons. Instead, we recommend only adding the affected file to the exclusions For example, instead of excluding:

C:\Program Files\Folder\

We recommend excluding:

C:\Program Files\Folder\abc.exe

The Exclusions section also allows you to view and edit the list of files, folders, and programs that should be exempt from scanning or monitoring.
An exclusion can be easily removed at any time by clicking the Trash can icon.

Best practices
We recommend creating and assigning a Personal Policy Template or Partner Policy Template  if you are an Emsisoft Partner, to globally exclude the app from monitoring in the Workspace under Protection Policies for the Protection Policy group that the device shall be in.

Tips & Tricks

Wildcards and environment variables
You may use Wildcards or environment variables.

When using wildcards:
? specifies one random character and * specifies a sequence of random characters.

Correct examples for Wildcards

Exclusion What it excludes Excludes subfolders
c:\temp\* or c:\temp\ Excludes all files in c:\temp\ X
%temp%\* or %temp%\ Excludes all files in %temp% X
%temp%\apps\ Excludes all files in %temp%\apps\ X
c:\temp\%USERNAME%\*.tmp Excludes all .tmp files in c:\temp\%USERNAME%\ X
c:\temp\*.exe Excludes all .exe files in c:\temp\ X


Environment variables

Open the Emsisoft app locally and click on: Settings

Click on Environment variables to open the Environment variables tester.

Click on a variable to see details of what will be excluded.

Variables as they are seen by the software service do not necessarily resolve to the same paths that you can see as a user. Most variables resolve to multiple paths because the software protects at the system level, across all user accounts.
The Environment variables tester is invaluable for verifying exactly what paths will be excluded if you use a particular variable. Simply select a variable placeholder from the scrollable list on the left and the corresponding paths will be displayed in the adjacent pane to the right.

The Copy selected button copies the placeholder to the clipboard, allowing you to then to quickly and easily paste it when creating an exclusion. Please note that a trailing slash must be added after the placeholder to indicate that it is a path, for example: %temp%\

 

 

Exit mobile version