How to create a DeepGuard exclusion for Elements Endpoint Protection?

Issue:

How to exclude a file, folder or application that is incorrectly blocked by Elements Endpoint Protection (EPP for Computers or EPP for Servers) DeepGuard feature?

Resolution:

If a file, that you are sure to be safe, is being blocked by DeepGuard, you can exclude a file or folder from all security measures by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

This would exclude the AppData\Local\test\ folder and all its sub folders for all users.

If you want to locally on the device itself create the exclusion:

1. Open the Elements Agent user interface on the device
2. Go to Settings 
3. Go to the Malware protection settings page
4. Click view quarantine (enter administrator username and password if needed)
5. Select the Excluded tab
6. Click Add new 
7. Add the file path or folder path
8. Click OK

DeepGuard can also be excluded using the SHA-1 of the process:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Global exclusions from all security scans list
5. Click Save profile

The SHA-1 can also be added manually to the DeepGuard protection rules. Follow the steps below to manually add an SHA-1 exclusion in DeepGuard:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to add the exclusion to
4. Go to the Real-time scanning page
5. Scroll down to DeepGuard settings
6. Click on Add rule
7. Fill in the SHA1-hash and a note about the application
8. Click Save profile

Note: If DeepGuard is blocking software that you see as trusted, it is recommended to report the executable to WithSecure Labs for potential whitelisting: Submitting a file sample | Welcome to WithSecure Elements | Latest | WithSecure User Guides