Forum Discussion
ASR Rules - Outlook Spawning Child Process
DannyC_Gamma Maybe this has already been resolved, but the exclusions should target the file that would be the child process started by Outlook, in the case of your situation. The docs linked weren't very clear on that before, and we were a bit confused by the language, so we tested it ourselves. I think the docs may have been updated a little since then.
It does explain that exclusions apply across all rules, however - so you can't exclude a file only for a specific rule. I'm not sure there is a scenario where a file would really need one ASR blocked activity but not another.
Exclusion info here:
Chris Boggs - appreciate the reply and also appreciate that my question wasn't worded particularly eloquently :)
To be honest, I guess I kind of the knew the answer to the question but just needed confirmation for the business more than anything
- Ah, sorry, didn't mean to imply you worded your question poorly - I meant to say we had the same question when we were needing to make our first exclusion and couldn't find a definite answer in the docs - so we tested it ourselves.
Chris Boggs - Oh, I see! Well, I still believe I could have worded the question better :)
Good to have my findings verified, thanks for posting.
