Forum Discussion

masa86's avatar
masa86
Copper Contributor
Mar 27, 2024

Use of wildcards in suppression rule for MDE

I would like to use a wildcard in an alert suppression rule for MDE, do you know the detailed behavior?

 

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-alerts?view=o365-worldwide#suppress-an-alert-and-create-a-new-suppression-rule 

This page says

  • File SHA1
  • File name - wildcard supported
  • Folder path - wildcard supported
  • IP address
  • URL - wildcard supported
  • Command line - wildcard supported

in Folder path how would it work if I configure the following?

c:\windows

-> c:\windows folder only?

c:\windows*

-> ?

c:\windows\

-> c:\windows folder only?

c:\windows\*

-> c:\windows and All files under the c:\windows\ folder?

 

There is a detailed description of MDAV, but not of MDE.

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-extension-file-exclusions-microsoft-defender-antivirus?view=o365-worldwide#exclusion-lists 
The description of MDAV is for Intune and Group Policy use, and may differ from the settings in the MDE Management Console.

 

Regards

No RepliesBe the first to reply