Exploit prevention exclusions - rule specific

[Jmac24]

Is there a way put an exclusion in place just for a specific rule rather than a blanket exclusion for everything.

[Kenchee_etf · Accepted solution]

Hello @Jmac24 

That depends on nature of the signature, please refer to:

*** Excluding items from Exploit Prevention
https://docs.mcafee.com/bundle/endpoint-security-10.6.0-threat-prevention-product-guide-windows/page...

for example, if signature belongs to "Files, processes, and registry" then you can not specify specific signature, however, if signature belongs to "Buffer Overflow and Illegal API Use" then you may specify which signature to exclude.

I hope this answers your question.