Have a look on this page at Microsoft:
you find most on all their products regarding Exclusions.
To be good best check it after with some McAfee products and advisories too:
They have a special kb for sql too, best to query for them in the McAfee KB.
After that just run it with that exclusions and add some extra logging to get the notifications you want in the threatlogs in ePO. From there you can investigate if more exclusions would be needed or not.
Some products are just well designed and do not need exclusions