Exclusion List for 3rd Party AntiVirus Products

[fattonymaximus]

Hi All,

Is there a list available that shows you what processes or files or folders that 3rd party vendors should be excluding or whitelisting or McAfee products (McAfee Agent, VSE 8.8.0.1804 and ENS / Threat Prevention)? For example McShield.exe you wouldnt want a 3rd party company to scan that file.

Regards

[Former Member]

We don't have such a list as we don't recommended having multiple AV scanners installed on systems.

Having multiple AVs can cause a number of various issues such as installation and performance issues, dll injections, etc.

[fattonymaximus]

Thanks Chealey,

The below list shows processes that McAfee Agent and VSE use. I presume you could use this as a reference point for 3rd party vendors to whitelist if required?

https://kc.mcafee.com/corporate/index?page=content&id=KB65784

Is there a similar list for ENS?

Regards,

[Former Member · Accepted solution]

A similar list for ENS would be: https://kc.mcafee.com/corporate/index?page=content&id=KB87791

Sorry, but we can't confirm that it is ok to exclude these processes as we do not recommend it.

[fattonymaximus]

Thanks Chealey

[kylekat]

excellent topic and info, thanks!

[bretzeli]

As a reminder we would like to mention as example c:\KWORING Directory and several process which are EXCLUDED fully from KASEYA since years. The breach if fully executed would have killed 30% of IT Services company who use KASEYA.

Mostly the Exclusion because of the NINITE Products which they use often and have a hell of False on Virus total (Referenced by Mcafee GTI also).

[denn]

Maybe there is same KB for Linux ? We want to exclude 3rd party EDR from McAfee ENS on linux

[AdithyanT]

Hi @denn,

EDR uses TRACE and File Hashing features to monitor process and file activities. Trace is not available yet on Linux endpoints and hence, you can use the below document that explains about exclusion of files and folders from File Hashing on Linux.

https://docs.mcafee.com/bundle/mvision-endpoint-detection-and-response-product-guide/page/GUID-9FDCD...