Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: How to ignore a Directory During Initialization

App Control: How to ignore a Directory During Initialization

Environment

  • App Control Console: All Supported Versions
  • App Control Agent: All Supported Versions

Objective

Describe how to create the agent_config value to ignore directories during Initialization and Cache Consistency Checks.

Resolution

Warning: Ignoring files during Initialization will prevent the Agent from knowing about these files.
This could result in unexpected blocks or a potential performance issue.
Executing a file from a local volume will be slower if the Agent must also discover & analyze it on execution.
 
  1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
  2. Click Show Filters > Add Filter > Value > Begins with: cc_ignore_patterns=
    • If an Agent Config exists it can be added to by clicking the Edit (pencil) icon. Example:
      Value: cc_ignore_patterns=*.vmhd,*.vmhdx,*.bigfile
    • Alternatively a new Agent Config can be created to target a specific endpoint, Policy, Platform, or combination of those options. Example:
      Name: Ignore Developer Directories
      Host ID: 0
      Value: cc_ignore_patterns=*\Developers\Builds\*,*\PlatformSDK\TMP\*
      Platform: Windows
      Status: Enabled
      Create For: Selected Policies > Developers-HE
      

Additional Notes

  • Test on single endpoint first to validate configuration. Make the path directory as specific as necessary.
  • Typically this setting is used to ignore large files (or directories with large numbers of files) that would not be expected to otherwise execute.
  • Executing a file from a local volume will be slower if the Agent must also discover & analyze it on execution.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎09-25-2023
Views:
169
Contributors