CBC: Where is the documentation on when to use Policy permissions vs Core Preventions vs the new Event Reporting / Process exclusions?

[#1]

Environment

• Carbon Black Cloud Console: All versions as of February, 2024
• Carbon Black Cloud Standard Endpoint (ES): All versions
• Carbon Black Cloud Enterprise EDR (EEDR): All versions
• Carbon Black Cloud Windows Sensor: Varies by feature. Use the 4.0.x or greater Windows Sensor for all features to be available.
• Microsoft Windows: All supported versions.

Question

Where does one find documentation on when and how to use Policy permissions, Core Preventions and the new Event Reporting / Process Exclusions features?

Answer

• User Guide topics
• Event Reporting and Sensor Operation Exclusions Announcement

Additional Notes

Carbon Black Cloud has continued to create methods to exclude items for different reasons. We have a number of options depending on the product you own and the goal for the exclusion. Below is a list of some of the common items we see.

Policy permissions:

• Policy — Carbon Black Cloud: How to Set up Exclusions in the Carbon Black Cloud Console for AV Products 
• Policy — Endpoint Standard: How to Create Policy Blocking & Isolation and Permissions Exclusions 
• Policy — Carbon Black Cloud: What are the differences between API Bypass and Full Bypass 
• Expectation — Carbon Black Cloud: Events Still Being Sent When Process is in Full Bypass Rule  
• Wildcards — Carbon Black Cloud: How to specify wildcards in Core Prevention exclusions.  
• Auto Delete -— CB Defense: Is A Folder Path Exclusion Possible For The Auto-Delete Feature? 
• IT Tools — Endpoint Standard: Adding approved reputation using IT Tools isnt working properly 
• IT Tools — Carbon Black Cloud: How to Utilize IT Tools Allow list Feature  
• Self Signed Cert — Endpoint Standard: Adding self-signed cert to script and Configuring the system for a bypass. 
• Hash — Carbon Black Cloud: How to Add a SHA256 Hash to Approved/Banned List 
• MAC —  NGAV Cb Defense Mac Policy Guidelines

Core Preventions

• Core Rules — Endpoint Standard: How to Configure Exclusions for Core Prevention Rules

Event Reporting / Process Exclusions

• Event Reporting and Sensor Operation Exclusions Announcement
• Enterprise EDR: Is it possible to add scanning exclusions for other security products in an Enterpri...
• Enterprise EDR: Sensor Does Not Honor Bypass Exclusions

Other

• 3rd party recommendations — Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions 
• Citrix recommendations —  Carbon Black Cloud Windows Sensor: How to add Citrix exclusions in Windows registry for CBC Sensor 

Related Content

Carbon Black Cloud: How to Set up Exclusions in the Carbon Black Cloud Console for AV Products
Endpoint Standard: How to Create Policy Blocking & Isolation and Permissions Exclusions
Carbon Black Cloud: Events Still Being Sent When Process is in Full Bypass Rule
Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions
Carbon Black Cloud: How to specify wildcards in Core Prevention exclusions.
Endpoint Standard: How to Configure Exclusions for Core Prevention Rules
CB Defense: Is A Folder Path Exclusion Possible For The Auto-Delete Feature?
Endpoint Standard: Adding approved reputation using IT Tools isnt working properly
Carbon Black Cloud: How to Utilize IT Tools Allow list Feature
Carbon Black Cloud: What are the differences between API Bypass and Full Bypass
Carbon Black Cloud: How to Add a SHA256 Hash to Approved/Banned List
Enterprise EDR: Is it possible to add scanning exclusions for other security products in an Enterpri...
Carbon Black Cloud Windows Sensor: How to add Citrix exclusions in Windows registry for CBC Sensor
NGAV Cb Defense Mac Policy Guidelines