VMware Carbon Black Cloud: Which sensor directories need exclusion from third party antivirus scans? – Red Canary Support

Issue

How can the VMware Carbon Black Cloud sensor be excluded in other security or antivirus products?

VMware Carbon Black recommends that you exclude the following locations if using another security or antivirus utility.

Operating System

Paths/files to exclude

Microsoft Windows

C:\Program Files\Confer\

C:\ProgramData\CarbonBlack\

C:\Windows\System32\drivers\ctifile.sys

C:\Windows\System32\drivers\ctinet.sys

C:\Windows\System32\drivers\cbelam.sys

C:\Windows\system32\drivers\cbdisk.sys

C:\Windows\Syswow64\ctintev.dll

C:\Program Files\Confer\BladeRunner.exe

C:\Program Files\Confer\CbNativeMessagingHost.exe

C:\Program Files\Confer\RepCLI.exe

C:\Program Files\Confer\RepMgr.exe

C:\Program Files\Confer\RepUtils.exe

C:\Program Files\Confer\RepUx.exe

C:\Program Files\Confer\RepWAV.exe

C:\Program Files\Confer\RepWmiUtils.exe

C:\Program Files\Confer\RepWSC.exe

C:\Program Files\Confer\Uninstall.exe

C:\Program Files\Confer\VHostComms.exe

C:\Program Files\Confer\Blades\LiveQuery\osqueryi.exe

C:\Program Files\Confer\scanner\scanhost.exe

C:\Program Files\Confer\scanner\upd.exe

Apple macOS

Pre-3.5.x.x:

/applications/Confer.app/

3.5.x.x and higher:

/Applications/VMware Carbon Black Cloud
/Library/Application Support/com.vmware.carbonblack.cloud/
/Library/Extensions/CbDefenseSensor.kext

Linux

/var/opt/carbonblack/

/opt/carbonblack/

Please refer to product specific vendor documentation on how to implement exclusions
Some security products require an asterisk (*) to denote entire directory and its contents