Create path exclusion in SentinelOne

Home > Security tips > End point security > SentinelOne > Create path exclusion in SentinelOne

Sometimes application such as end-point backup may not work properly if we have SentinelOne based End-point protection as backup tools will try to work with Volume Shadow Copy (VSS) and other OS files. In that case we may have to create interoperability exclusion for the backup tool for it to work properly. To create a path exclusion in SentinelOne use:

1. Login into SentinelOne Dashboard
2. Go to Sentinels -> Exclusions
3. There are two broad types of exclusions
4. Hash exclusions
   1. If executable is already installed then we can exclude its hash. For this we can get SHA1 hash of the file in Windows via Useful Windows cmd options#Calculate_hash_such_as_md5_or_sha1_for_a_file_in_Windows. In MAC / Linux we can use sha1sum command.
   2. Then click on "Create Exclusion" -> "Create Exclusion"
   3. Let exclusion type be hash
   4. Choose appropriate OS platform eg Windows
   5. Copy the hash calculated in above steps
   6. Add appropriate description
   7. Click Save
5. Path exclusions
   1. If we want to exclude a path (typically under C:\Program Files) for a installed program so that it works properly then we need to get the parent path to be excluded along with sub-folders
   2. Then click on "Create Exclusion" -> "Create Exclusion"
   3. Change exclusion type to path
   4. Select appropriate OS platform eg Windows
   5. Copy the full path to be excluded such as "C:\Program Files (x86)\ParaBlu"
   6. Enable include sub-folders
   7. Enable exclude path for alerts and mitigation
   8. Click on "More options" and select "Interoperability - Extended" option
   9. Give useful description for the path exclusion requirement
   10. Click Save
6. As per guidelines we may have to reboot the machine for agent to get latest exclusions and for system to work properly.

Refer:

• https://www.cybervigilance.uk/post/sentinelone-path-exclusion

Home > Security tips > End point security > SentinelOne > Create path exclusion in SentinelOne