EDR: How to Enable Isolation Exclusions

[#1]

Environment

• EDR (Formerly CB Response): 6.5.0 and Higher
• Windows Sensor: 6.2.4 and Higher
• Mac Sensor: 6.2.7 and Higher

Objective

To enable Isolation Exclusions

Resolution

1. Log in as a Global Administrator (on premises) or Administrator (cloud), or as a user
   who has Isolate sensor permission and membership on a team with the Analyst role
   for the specific sensor group.
2. On the navigation bar, click Sensors.
3. Click the gear icon next to the sensor group.
4. Click Isolation Exclusions and then click Add Exclusion.
5. Enter a description that identifies the exclusion (50 character maximum), and the IPv4
   address or domain URL that specifies the exclusion (253 character maximum).
6. Select Enable this exclusion and click OK.
7. Click Save Group

Additional Notes

• This feature is disabled by default
• This can be enabled by adding to the /etc/cb/cb.conf the line IsolationExclusionsEnabled=True