> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md). # Add a new exceptions security profile You can configure exceptions that apply to specific groups of endpoints or you can add a global endpoint policy exception. {% hint style="info" %} ### Important Starting with version 1.3, Cortex XSIAM enables you to manage the exception security rules from a central location and easily apply them across multiple profiles in the **Legacy Agent Exceptions management** page. To manage the exceptions from **Exception Configuration**, you must first migrate your existing exceptions configured via the exceptions security profiles. To create new exception security profile rules using the **Legacy Agent Exceptions management** page, see [Add a legacy exception rule for endpoints](#UUID-5d26f4f4-345d-a0e7-ee52-d70e1a310a86). If you don't migrate the legacy exceptions, you can continue to create exceptions as described below. {% endhint %} How to create an endpoint-specific exception 1. Add a new profile. 1. From Cortex XSIAM, select **Inventory** → **Endpoints** → **Policy Management** → **Prevention** → **Profiles** → **+Add Profile** and select whether to **Create New** or **Import from File** a new profile.

Note

New imported profiles are added and not replaced.

2. Select the platform to which the profile applies and **Exceptions** as the profile type. 3. Click **Next**. 2. Define the basic settings. 1. Select a unique **Profile Name** to identify the profile. The name can contain only letters, numbers, or spaces, and must be no more than 30 characters. The name will be visible from the list of profiles when you configure a policy rule. 2. To provide additional context for the purpose or business reason for creating the profile, specify a profile **Description**. For example, you might include a case identification number or a link to a help desk ticket. 3. Configure the exceptions profile.
Configure a process exception 1. Select the operating system. 2. Enter the process name. 3. Select the endpoint protection modules that allow the process to run. * Select **All** to apply the exception across all security modules. * Select **Disable Injection** to apply the exception across these exploit modules: APC Guard, CPL Execution Protection, DEP, DLL Hijacking Protection, DLL Security, EPM D02, Exception Heap Spray Check, Exception SysExist Check, Exploit Kit Fingerprinting Protection, Font Protection, Hot Patch Protection, JIT Mitigation, Library Preallocation, Memory Limit Heap Spray Check, Null Dereference Protection, Password Theft Protection, ROP Mitigation, SEH Protection, Shellcode Preallocation, and UASLR. 4. Click the adjacent arrow. 5. After adding all processes, select **Create**. You can later edit these settings from the **Process Execution** profile.
Configure a support exception 1. Import the JSON file from Palo Alto Networks Support. Browse for it or drag it onto the page. 2. Click **Create**.
Configure module-specific exceptions for the selected profile platform * **Behavioral Threat Protection Rule Exception**: Right-click a Behavioral Threat alert and select **Create alert exception**. Review the platform and rule name. Select **CGO hash**, **CGO signer**, **CGO process path**, or **CGO command arguments** as needed. Select **Profile** from **Exception Scope**, then click **Create**. * **Digital Signer Exception**: Right-click a Digital Signer Restriction issue and select **Create issue exception**. Set **Exception Scope** to **Profile**, select the exception profile name, then click **Add**. * **Java Deserialization Exception**: Right-click a benign Suspicious Input Deserialization issue and select **Create issue exception**. Set **Exception Scope** to **Profile**, select the exception profile name, then click **Add**. * **Local File Threat Examination Exception**: Right-click a PHP file issue and select **Create issue exception**. Set **Exception Scope** to **Profile**, select the exception profile name, then click **Add**. * **Gatekeeper Enhancement Exception**: Right-click the issue and select **Create issue exception**. Set **Exception Scope** to **Profile**, select the exception profile name, then click **Add**. This keeps enforcement active for other child processes. At any point, click the **Generating Issue ID** to return to the issue that generated the exception. You cannot edit module-specific exceptions.
4. Apply profiles to endpoints. To remove an exceptions profile, go to the **Profiles** page, right-click the profile, then select **Delete**. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/protect-your-endpoints/endpoint-security/install-and-manage-endpoints/set-up-endpoint-protection/set-up-endpoint-profiles-and-exception-rules/set-up-exception-profiles-and-rules/add-a-legacy-exception-rule-for-endpoints/add-a-new-exceptions-security-profile.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.