{"id":5106,"date":"2026-03-30T08:00:00","date_gmt":"2026-03-30T05:00:00","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=changelog&#038;p=5106"},"modified":"2026-10-19T11:57:52","modified_gmt":"2026-10-19T08:57:52","slug":"endpoint-security-formerly-endpoint-detection-response-2026-03-30-update","status":"publish","type":"changelog","link":"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-03-30-update\/","title":{"rendered":"Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-03-30 Update"},"content":{"rendered":"<p>To help you create more flexible and maintainable suppression rules, <strong>wildcards are available for Accepted Behavior suppression rule parameters<\/strong>. Wildcards allow you to match patterns instead of exact values, making it easier to suppress recurring or similar events without creating multiple rules.<\/p>\n<p><strong>What are wildcards?<\/strong><\/p>\n<p>Wildcards let you define suppression rules using partial matches rather than exact strings. This is especially useful when values vary slightly, such as file names, paths, or user names.<\/p>\n<p>The following wildcard characters are supported:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*<\/code> \u2013 matches any sequence of characters (including empty)<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*.exe<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file.exe<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test.exe<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">.exe<\/code><\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">?<\/code> \u2013 matches any single character<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file?.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file1.txt<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">fileA.txt<\/code><\/li>\n<\/ul>\n<p>To treat wildcard characters as literal values, use the backslash (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\<\/code>) as an escape character:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\*<\/code> \u2013 matches a literal asterisk<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test\\*.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test*.txt<\/code><\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\?<\/code> \u2013 matches a literal question mark<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test\\?.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test?.txt<\/code><\/li>\n<\/ul>\n<p><strong>Supported parameters<\/strong><\/p>\n<p>Wildcards are supported in suppression rules for Accepted Behavior when matching the following parameters:<\/p>\n<ul>\n<li>Process name<\/li>\n<li>Process path<\/li>\n<li>Process command line<\/li>\n<li>Username<\/li>\n<li>Parent process name<\/li>\n<li>Parent process path<\/li>\n<\/ul>\n<p><strong>How to use wildcards<\/strong><\/p>\n<p>You can create or edit wildcard-based suppression rules in two ways:<\/p>\n<ul>\n<li>From <strong>Events \u2192 Broad Context Detections<\/strong>, when closing a detection as <em>Accepted behavior<\/em> and choosing to create a suppression rule.<\/li>\n<li>From <strong>Security Configurations \u2192 Automated actions \u2192 Suppression rules<\/strong>, by editing an existing rule.<\/li>\n<\/ul>\n<p>In both flows, select <strong>Wildcard<\/strong> for the chosen parameter in the Parameters step, then define the pattern using <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">?<\/code>, or escaped characters as needed.<\/p>\n<p>Using wildcards helps reduce rule duplication, keeps configurations cleaner, and makes suppression rules easier to maintain over time<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp 942w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-300x293.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-768x749.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-447x436.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-150x146.png.webp 150w\" sizes=\"auto, 100vw\" alt=\"image.png\" height=\"919\" width=\"942\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>To help you create more flexible and maintainable suppression rules, wildcards are available for Accepted Behavior suppression rule parameters. Wildcards allow you to match patterns instead of exact values, making&hellip;<\/p>\n","protected":false},"template":"","changelog_product":[110],"class_list":["post-5106","changelog","type-changelog","status-publish","hentry"],"acf":{"release_date":"20260330","version":"","source_system":"vanilla-import","source_foreign_id":"","import_hash":"4eb6a046d41590aa177abf572c4fbc2985c71573","vanilla_article_id":32879,"legacy_author":"Agnieszka","vanilla_url":"https:\/\/community.withsecure.com\/changelogs-en\/kb\/articles\/32879-endpoint-security-formerly-endpoint-detection-response-2026-03-30-update","vanilla_category_id":214,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog\/5106","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/changelog"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=5106"}],"wp:term":[{"taxonomy":"changelog_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/changelog_product?post=5106"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}