How to Manage Antivirus Exclusions in Harmony Endpoint

Antivirus exclusions allow you to prevent Check Point Harmony Endpoint from scanning or blocking specific files, folders, processes, or network resources. Properly configured exclusions help avoid false positives and performance issues while maintaining security. This guide covers how to create and manage exclusions in the Infinity Portal.

Prerequisites

Before configuring exclusions, ensure you have:

• Infinity Portal access with Policy Administrator permissions
• Harmony Endpoint EPMaaS with deployed endpoints
• Documentation of applications requiring exclusions
• Verification that items to exclude are legitimate (not malware)

Understanding Exclusion Types

Harmony Endpoint supports various exclusion types for different scenarios:

Accessing the Exclusions Center

1. Log in to the Infinity Portal at https://portal.checkpoint.com
2. Navigate to Harmony Endpoint > Policy
3. Go to Threat Prevention > Policy Capabilities
4. Select the rule you want to modify
5. In the Capabilities & Exclusions pane, click Exclusions Center

The Exclusions Center provides a unified interface for managing all exclusion types.

Creating Smart Exclusions (Recommended)

Smart Exclusions are the modern exclusion method that applies immediately without requiring a policy installation.

Step 1: Open Smart Exclusions

1. In the Exclusions Center, click the Smart Exclusions tab
2. Click Add Exclusion

Step 2: Configure the Exclusion

1. Name: Enter a descriptive name (e.g., "SQL Server Data Files")
2. Description: Document the business justification
3. Operating System: Select target OS (Windows, macOS, Linux, or All)
4. Capabilities: Choose exclusion scope:
   • All supported: Applies to all protection capabilities
   • Select specific: Choose individual capabilities

Step 3: Define Exclusion Criteria

Select the exclusion type and configure:

File or Folder Exclusion:

C:\Program Files\MyApplication\data\
C:\Users\*\AppData\Local\MyApp\cache\*

Process Exclusion:

C:\Program Files\Development\compiler.exe
*\java.exe

Wildcard Syntax:

• * matches any characters in a single path component
• ** matches across directory levels
• ? matches a single character

Step 4: Configure Advanced Options

Chained Exclusions (Child Processes):

1. For process exclusions, toggle Inherit exclusion to child processes
2. This excludes all processes spawned by the excluded parent

Example: Excluding Visual Studio with child processes:

• Excludes devenv.exe
• Also excludes MSBuild.exe, VBCSCompiler.exe spawned by VS

Step 5: Save the Exclusion

1. Click Add to save the exclusion
2. Smart Exclusions apply automatically to connected endpoints
3. Verify in the exclusions list

Creating Capability-Specific Exclusions

For granular control, create exclusions within specific capabilities.

Anti-Malware Exclusions

1. In Exclusions Center, expand Anti-Malware
2. Select the exclusion type:

File/Folder Exclusions:

C:\DatabaseFiles\*.mdf
C:\DatabaseFiles\*.ldf
C:\LogFiles\**\*.log

File Extension Exclusions:

.mdf
.ldf
.bak

MD5 Hash Exclusions (Endpoint version E80.80+):

1234567890abcdef1234567890abcdef

Riskware Exclusions:

• Select riskware categories to allow (remote admin tools, etc.)

Threat Emulation Exclusions

1. Expand Threat Emulation in Exclusions Center
2. Add exclusions:

Folder Exclusions:

C:\TrustedDownloads\

SHA1 Hash Exclusions:

da39a3ee5e6b4b0d3255bfef95601890afd80709

Domain Exclusions:

trusted-vendor.com
updates.mycompany.com

Anti-Bot Exclusions

1. Expand Anti-Bot in Exclusions Center
2. Add exclusions:

URL Exclusions:

https://internal-app.mycompany.com

Domain Exclusions:

mycompany.com
trusted-partner.com

IP Address Exclusions:

192.168.100.0/24
10.0.0.50/32

Zero-Phishing Exclusions

1. Expand Zero-Phishing in Exclusions Center
2. Add trusted domains and URLs:

sso.mycompany.com
intranet.mycompany.com

Quarantine Exclusions

Prevent specific items from being quarantined even if detected:

1. Expand Quarantine in Exclusions Center
2. Add exclusions by:
   • Certificate (signer identity)
   • File path
   • Folder path
   • MD5 hash
   • SHA1 hash
   • File extension

Warning: Quarantine exclusions allow potentially malicious files to remain active. Use with extreme caution and only for thoroughly verified applications.

Server Role Exclusions

Harmony Endpoint includes built-in exclusions for common server roles based on Microsoft and Check Point recommendations.

Enable Server Optimization

1. Go to Policy > Threat Prevention > Policy Capabilities
2. Select the rule for server endpoints
3. Click Advanced Settings
4. Enable Endpoint for Server Optimization
5. Select server roles:
   • SQL Server
   • Exchange Server
   • SharePoint Server
   • IIS Web Server
   • File Server
   • Domain Controller
   • Hyper-V Host

Review Applied Exclusions

1. In Exclusions Center, view Server Role Exclusions
2. Review the automatically applied exclusions:
   • Database files and processes
   • Mail store locations
   • Active Directory files
   • IIS application pools
3. Add custom exclusions for additional server applications

Global Exclusions

Create exclusions that apply to all policy rules.

Step 1: Access Global Exclusions

1. Go to Policy > Threat Prevention > Exclusions Center
2. Click Global Exclusions tab

Step 2: Add Global Exclusion

1. Click Add Exclusion
2. Configure exclusion criteria
3. Global exclusions apply to all rules and virtual groups

Best Use Cases for Global Exclusions

• Enterprise backup software
• Centralized management agents
• Company-wide development tools
• Universal security software

Common Exclusion Scenarios

Development Environment

Exclude development tools and build output:

# Visual Studio
C:\Program Files\Microsoft Visual Studio\**\*
C:\Users\*\AppData\Local\Microsoft\VisualStudio\**\*

# Build output
C:\Projects\**\bin\**\*
C:\Projects\**\obj\**\*

# Node.js
*\node.exe
C:\Users\*\AppData\Roaming\npm\**\*

Database Servers

Exclude database files for performance:

# SQL Server
C:\Program Files\Microsoft SQL Server\**\*.mdf
C:\Program Files\Microsoft SQL Server\**\*.ldf
C:\Program Files\Microsoft SQL Server\**\*.ndf

# Process exclusions
*\sqlservr.exe
*\sqlagent.exe

Backup Software

Exclude backup agents and storage:

# Veeam
C:\Program Files\Veeam\**\*
C:\VeeamBackup\**\*

# Process exclusions
*\VeeamAgent.exe
*\VeeamBackupSvc.exe

Virtualization

Exclude hypervisor components:

# Hyper-V
C:\ProgramData\Microsoft\Windows\Hyper-V\**\*
C:\ClusterStorage\**\*.vhdx

# VMware
C:\Program Files\VMware\**\*
*\vmware-vmx.exe

Exclusion Best Practices

Security Guidelines

Exclusion Hierarchy (Most to Least Specific)

1. Hash (SHA1/MD5) - Most secure, specific file version
2. Certificate - All files from trusted signer
3. Full file path - Specific file location
4. Process with path - Specific executable
5. Folder path - Directory contents
6. File extension - Least specific, use sparingly

Performance Considerations

• Excessive exclusions can slow down policy evaluation
• Wildcard exclusions (**) are more resource-intensive
• Consider using hash exclusions for static files
• Review and consolidate exclusions periodically

Auditing and Managing Exclusions

Export Exclusions

1. In Exclusions Center, click Export
2. Select export format (CSV or JSON)
3. Save for documentation or backup

Review Exclusion Usage

1. Go to Logs & Events
2. Filter by exclusion-related events
3. Identify unused exclusions for cleanup

Bulk Operations

For large-scale exclusion management:

1. Export current exclusions
2. Modify in spreadsheet application
3. Import updated exclusions
4. Verify changes applied correctly

Troubleshooting Exclusion Issues

Exclusion Not Working

Symptoms: Files still being scanned or blocked despite exclusion.

Solutions:

1. Verify exclusion syntax (check wildcards)
2. Confirm exclusion applies to correct capability
3. Check exclusion scope (correct virtual groups)
4. For Smart Exclusions, verify client version supports feature
5. Force policy download on endpoint
6. Check if file matches multiple rules (more specific may override)

False Positives Persist

Symptoms: Application still flagged after exclusion.

Solutions:

1. Use more specific exclusion (hash vs. path)
2. Add exclusion to multiple capabilities if needed
3. Check if child processes need exclusion
4. Review exact file path being flagged in logs
5. Contact Check Point support with detection details

Performance Issues After Exclusions

Symptoms: Scans taking longer with many exclusions.

Solutions:

1. Consolidate overlapping exclusions
2. Use folder exclusions instead of individual files
3. Review exclusions for necessity
4. Consider hash exclusions for static files
5. Remove deprecated or test exclusions

Next Steps

After configuring exclusions:

1. Document all exclusions in your security policy documentation
2. Monitor for new false positives as applications update
3. Review quarterly to remove unnecessary exclusions
4. Train IT staff on exclusion request procedures
5. Implement approval workflow for new exclusion requests

Additional Resources

• Check Point Exclusions Documentation
• Legacy Exclusions Guide
• sk162553 - Understanding Anti-Malware Exclusions
• Check Point CheckMates Community

Need help configuring Harmony Endpoint exclusions? Inventive HQ provides expert Check Point configuration services to ensure optimal protection while minimizing false positives. Contact us for a free consultation.