Several customers have approached me on how to configure Splunk antivirus exclusions for processes, folders, and files within Microsoft Defender for Endpoint on RedHat Enterprise Linux. This quick reference article has been created to address this common question.
Note: This blog is in support of Microsoft Defender for Endpoint on Red Hat Enterprise Linux 7.9.
Disclaimer: This may not work on all versions of Linux. Linux is a third-party entity with its own potential licensing restrictions. This content is provided to assist our customers to better navigate integration with a 3rd party component or operating system, and as such, no guarantees are implied. Process and folder exclusions could potentially be harmful because such exclusions increase your organizational exposure to security risks.
mdatp exclusion list
[azureuser@redhat /]$ mdatp exclusion list
=====================================
No exclusions
=====================================
[azureuser@redhat /]$
version: |
Directories to exclude: |
Processes to exclude: |
Splunk Enterprise (*nix) |
/opt/splunk ($SPLUNK_HOME) and all sub-directories |
· bloom · btool · btprobe · bzip2 · cherryd · classify · exporttool · locktest · locktool · node · python* · splunk · splunkd · splunkmon · tsidxprobe · tsidxprobe_plo · walklex |
Splunk universal forwarder (*nix) |
/opt/splunkforwarder ($SPLUNK_HOME) and all subdirectories |
· Same as Splunk Enterprise (*nix) |
mdatp exclusion process add --name [nameofprocess]
sudo mdatp exclusion process add --name bloom
sudo mdatp exclusion process add --name btool
sudo mdatp exclusion process add --name btprobe
sudo mdatp exclusion process add --name bzip2
sudo mdatp exclusion process add --name cherryd
sudo mdatp exclusion process add --name classify
sudo mdatp exclusion process add --name exporttool
sudo mdatp exclusion process add --name locktest
sudo mdatp exclusion process add --name locktool
sudo mdatp exclusion process add --name node
sudo mdatp exclusion process add --name python*
sudo mdatp exclusion process add --name splunk
sudo mdatp exclusion process add --name splunkd
sudo mdatp exclusion process add --name splunkmon
sudo mdatp exclusion process add --name tsidxprobe
sudo mdatp exclusion process add --name tsidxprobe_plo
sudo mdatp exclusion process add --name walklex
[azureuser@redhat /]$ sudo mdatp exclusion process add --name bloom
Process exclusion added successfully
[azureuser@redhat /]$ mdatp exclusion list
=====================================
Excluded process
Process name: bloom
---
Excluded process
Process name: btool
---
Excluded process
Process name: btprobe
---
Excluded process
Process name: bzip2
---
Excluded process
Process name: cherryd
---
Excluded process
Process name: classify
---
Excluded process
Process name: exporttool
---
Excluded process
Process name: locktest
---
Excluded process
Process name: locktool
---
Excluded process
Process name: node
---
Excluded process
Process name: python*
---
Excluded process
Process name: splunk
---
Excluded process
Process name: splunkd
---
Excluded process
Process name: splunkmon
---
Excluded process
Process name: tsidxprobe
---
Excluded process
Process name: tsidxprobe_plo
---
Excluded process
Process name: walklex
=====================================
[azureuser@redhat /]$
Note: Now that we have all 17 processes excluded. We can move on to the folder exclusions.
sudo mdatp exclusion folder add --path "/opt/splunk/"
Note: This will exclude all paths and all sub directories under /opt/splunk.
[azureuser@redhat /]$ sudo mdatp exclusion folder add --path "/opt/splunk/"
Folder exclusion configured successfully
[azureuser@redhat /]$ mdatp exclusion list
=====================================
[azureuser@redhat /]$ mdatp exclusion list
=====================================
Excluded folder
Path: "/opt/splunk/"
---
Hopefully this article provides you with added clarity around the common task of adding Splunk exclusions on Linux clients protected by Microsoft Defender for Endpoint on Linux.
Disclaimer
The sample scripts are not supported under any Microsoft standard support program or service. The sample scripts are provided AS IS without warranty of any kind. Microsoft further disclaims all implied warranties including, without limitation, any implied warranties of merchantability or of fitness for a particular purpose. The entire risk arising out of the use or performance of the sample scripts and documentation remains with you. In no event shall Microsoft, its authors, or anyone else involved in the creation, production, or delivery of the scripts be liable for any damages whatsoever (including, without limitation, damages for loss of business profits, business interruption, loss of business information, or other pecuniary loss) arising out of the use of or inability to use the sample scripts or documentation, even if Microsoft has been advised of the possibility of such damages.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.