> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md). # Set up exception profiles and rules Exception profiles override the security policy in scenarios such as: * Allow a process or a file to run on an endpoint * Allow a known digital signer * Allow access to specific URLs (via Safari) or telephone numbers * Disable a specific behavioral threat protection (BTP) rule * Import exceptions from the Cortex XSIAM support team **Add a legacy exception rule for endpoints** Legacy Exception rules enable you to configure an exception to prevention and protection modules on endpoints for selected profiles. Items included in allow lists may continue to generate Cortex XSIAM security events. If you want to exclude event reporting, configure this on the **Issue Exclusions** page (**Settings** → **Exception Configurations** → **Issue Exclusions**). Keep in mind the following: * Prior to Cortex XSIAM version 1.3, legacy exceptions were configured through profiles. * Starting with version 1.3, Cortex XSIAM enables you to manage the malware security exceptions from a central location and easily apply them across multiple profiles in the **Legacy Agent Exceptions Management** page. To manage the prevention profile exceptions from **Exception Configuration**, you must first migrate your existing exceptions configured via the prevention profiles. Your migrated rules are displayed on the **Settings** → **Exception Configurations** → **Legacy Agent Exceptions** page. For more information about the migration, see [Exception configuration](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/exception-configuration.md). 1. Select **Settings** → **Exception Configurations** → **Legacy Agent Exceptions**, and then click **+ Add Rule**. 2. Select the platform for which you want to create an agent exception. 3. Select the module for which you want to create an exception. Optionally, select **Select all** to apply the exception to all profiles for this module or select specific profiles. | Type | Module | Platform | Parameters | | ------------ | ---------------------------------------------- | --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Malware | Respond to Malicious Causality Chains |

Windows,

MacOS

| Add to your allow list specific and known safe IP address or IP address ranges that you do not want Cortex XSIAM to block. | | | Behavioral Threat Protection | Windows, MacOS, Linux | Add to your allow list the file or folder path you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Office Files with Micros Examination | Windows | Add to your allow list the file or folder path you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Portable Executable and DLL Examination | Windows | Add to your allow list the file or folder path and the signers you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Malicious Child Process Protection | Windows, MacOS, Linux | Add to your allow list the parent processes that can launch child processes to your allow list with optional execution criteria. Specify the allow list criteria including the **Parent Process Name**, **Child Process Name**, and **Command Line Params**. Use ? to match a single character or \* to match any string of characters. | | | Endpoint Scanning | Windows, MacOS, Linux | Add to your allow list the file or folder path and the signers you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | PDF Examination | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Credential Gathering Protection | Windows, MacOS, Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Anti Webshell Protection | Windows, MacOS, Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Financial Malware Threat Protection | Windows, MacOS, Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Cryptominers Protection | Windows, MacOS, Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | In-process Shellcode Protection | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Malicious Device Prevention | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | UAC Bypass Prevention | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Anti Tampering Protection | Windows, MacOS | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | UEFI Protection | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | PowerShell Script Files | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Mach-O Execution Examination | MacOS | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Mach-O Loading Examination | MacOS | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | DMG File Examination | MacOS | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Local File Threat Examination | Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | ELF File Examination | Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Reverse Shell Protection | Linux | Specify the **Process Path**. Local IP Address and port, and the Remote IP Address and port of the process you want to allow. Use ? to match a single character or \* to match any string of characters. | | | Loaded Kernel Modules Examination | Linux |

Add to your allow list the file or folder paths to exclude from evaluation.Use ? to match a single character or \* to match any string of characters.

Please note that the exception applies to the kernel module, not the process that loads it.

| | | APK Files Examination | Android | Specify the signers you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | SMS and MMS Malicious URL filtering Allow list | iOS | Add to your allow list and known safe URLs that you do not want Cortex XSIAM to block. | | | Call and Messages Blocking Allow list | iOS | Add to your allow list names and phone numbers of contacts that you do not want Cortex XSIAM to block. | | | Dynamic Kernel Protection | Windows | Add to your allow list the file or folder path you want to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | ASP and ASPX File Examination | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | VB Scripts Examination | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | JScript File Examination | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | LDAP Query Protection | Windows |

Add to your allow list specific and known safe IP address or IP address ranges that you do not want Cortex XSIAM to block.

Add to your allow list users whom you do not want to block.

| | | Operational Agent Exceptions | Windows |

Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters.

Note

This exception prevents the agent from examining the specified file. Use with caution, as it may unintentionally allow unwanted or malicious behavior to go undetected.

| | | Portable executable files (Windows) | Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Mach-O files (macOS) | Linux | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | Restrictions | Executable Files | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Network Location Files | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Optical Drive Files | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Removable Media Files | Windows | Add to your allow list the file or folder paths to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | Exceptions | Process Exceptions | Windows, MacOS, Linux | Add to your allow list the process and the module names to exclude from evaluation. Use ? to match a single character or \* to match any string of characters. | | | Operational Agent Exceptions | Windows |

This option excludes any intervention from a given list of processes, which are specified by their full path.

When you create this exception rule, it will disable the following modules:

Perform these steps:

1. For Target Properties Process Path, enter the path of the process that you want to exclude, and press ENTER. To add additional processes, repeat this step.

2. For Scope, select a rule scope.

3. Go to step 6.

| 4. For each module, enter the file or folder path that you want to add to the exception rule, and press ENTER. Repeat this step to add additional paths to the rule. 5. Select the endpoint profiles to which you want to apply this rule. 6. Click **Next**. 7. Review the rule, and then select the warning message checkbox. 8. Click **Create**. {% hint style="info" %} ### Important If you don't migrate the legacy exceptions, you can continue to create exceptions through the profiles. * [Add a new exceptions security profile](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md) * [Add a global endpoint policy exception](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-global-endpoint-policy-exception.md) * [Set up exploit prevention profiles](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exploit-prevention-profiles.md) * [Set up malware prevention profiles](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-malware-prevention-profiles.md) * [Set up restrictions prevention profiles](/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-restrictions-prevention-profiles.md) {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.