Environment
- EDR (Formerly CB Response): 6.5.0 and Higher
- Windows Sensor: 6.2.4 and Higher
- Mac Sensor: 6.2.7 and Higher
Objective
To enable Isolation Exclusions
Resolution
- Log in as a Global Administrator (on premises) or Administrator (cloud), or as a user
who has Isolate sensor permission and membership on a team with the Analyst role
for the specific sensor group. - On the navigation bar, click Sensors.
- Click the gear icon next to the sensor group.
- Click Isolation Exclusions and then click Add Exclusion.
- Enter a description that identifies the exclusion (50 character maximum), and the IPv4
address or domain URL that specifies the exclusion (253 character maximum). - Select Enable this exclusion and click OK.
- Click Save Group
Additional Notes
- This feature is disabled by default
- This can be enabled by adding to the /etc/cb/cb.conf the line IsolationExclusionsEnabled=True