How to Create Exclusions in CrowdStrike

Issue

If CrowdStrike Falcon is showing threats that you don’t want to see, or is preventing activity that you want to allow, you can create exclusions to quiet threats for known file paths and allow trusted processes to run.

Environment

CrowdStrike Falcon

Resolution

Sensor support:

Roles:

Exclusions are applied to hosts based on their group membership. Set up host groups before you create an exclusion. For more info, see Managing Host Groups.

Exclusions let you create a specific allowlist, but they aren’t the only way to adjust the threats you see. Review your prevention policy settings to see if any policies are set to a level that's more aggressive than recommended by our best practices. These policies might trigger certain detections about activity that you don’t need to see. For more info, see Prevention Policy Settings.

Occasionally, Falcon might detect or prevent activity that you expect and allow in your environment. By creating exclusions, you can stop seeing threats that you don’t want to see, and allow processes that would otherwise be prevented. The exclusions that you create effectively form an allowlist that explicitly defines your organization’s known trusted activity.

You can create these types of exclusions:

For trusted file paths, reduce false-positive detections by creating machine learning exclusions. Define patterns to exclude files from threats or preventions derived from machine learning techniques:

A machine learning exclusion has three configurable parts:

Any file matching the exclusion pattern won’t be detected or blocked by the Falcon sensor. The activity is logged through events sent to the CrowdStrike cloud, but a detection is not generated.

The most common reason to create a Detect/Prevent exclusion is to minimize false-positive detections for trusted applications. For example, your organization might use an internal tool that's blocked by the Falcon sensor. You can create an exclusion to permit that tool to run without triggering a Detect or Prevent action.

Create Detect/Prevent exclusions to target very specific situations. If your exclusion is too broad, you might inadvertently permit malicious activity that should be detected or blocked.

 

Any file matching the exclusion pattern won’t be available for download in Activity > Quarantined Files, and those files won't be uploaded to the CrowdStrike cloud for analysis.

The most common reason to create this type of exclusion is to prevent certain executable files from being uploaded to the CrowdStrike cloud. For example, you might want to prevent uploads of self-extracting archives containing design files from the group of hosts that includes your engineering department's workstations.

Uploading files to CrowdStrike is disabled by default. To enable it, go to  Configuration > Upload Quarantined Files or Configuration > Prevention Policies.

 

Reduce false-positive threat alerts from IOAs by creating exclusions that stop behavioral IOA threats and preventions. You can create an IOA exclusion directly from a CrowdStrike-generated threat, or by duplicating and then modifying an existing IOA exclusion.

Most types of IOA detections can be excluded through the Falcon console. However, some types of threats (OverWatch, custom IOA, and some others) cannot be excluded.

 

IOA exclusions are created from within a threat, or by duplicating and then modifying an existing IOA exclusion.

You can exclude most types of IOA threats. However, the following types of threats cannot be excluded:

The Falcon console indicates whether you can exclude a specific IOA threat. If you want to exclude a threat that Falcon indicates cannot be excluded, open a Support case.

 

For trusted file paths that you want to exclude from sensor monitoring, sensor visibility exclusions minimize sensor event collection, and stop all associated threats and preventions.

 

Use sensor visibility exclusions with extreme caution. Potential attacks and malware associated with excluded files will not be recorded, detected, or prevented. For more info, see Considerations for Sensor Visibility Exclusions.

 

The most common reason to create a sensor visibility exclusion is to improve endpoint performance at the excluded file paths, where sensor event data collection might interfere with highly resource-sensitive tasks. When planning and configuring sensor visibility exclusions, balance performance and security considerations. We recommend using sensor visibility exclusions only on hosts for which the sensor’s performance overhead without exclusions is unacceptable, and we recommend choosing excluded paths with care.

 

Use sensor visibility exclusions with extreme caution. If you create a sensor visibility exclusion for a file path, Falcon won’t record all events, won’t report any threats, and won’t perform any prevention actions. This means that you won’t have visibility into potential attacks or malware related to that file path.

 

When planning and configuring sensor visibility exclusions, balance performance and security considerations. We recommend using sensor visibility exclusions only on hosts for which the sensor’s performance overhead without exclusions is unacceptable, and we recommend choosing excluded paths with care.

Before creating sensor visibility exclusions, consider the potential security risks. If you do create sensor visibility exclusions, we recommend following these best practices:

Additional sensor visibility exclusion considerations:

Consider the potential implications of an exclusion before you put it into effect in your environment.

To maintain a strong security posture, create exclusions to be as specific as possible while meeting your exclusion needs. If your exclusion is too broad, you might inadvertently permit malicious activity that should be detected or blocked.

When you're creating or editing an exclusion, Falcon displays a list of affected threats before you save it. This list shows threats that wouldn’t have been generated if the current exclusion were live in your environment. Previewing threats that you would no longer see helps you quickly understand the expected effect of an exclusion before you save it.

For IOA exclusions that are already in effect in your environment, you can view a log of activity that would have triggered a threat if an IOA exclusion hadn’t been in place. Reviewing activity that’s being excluded helps you understand the actual effects of your IOA exclusions.

CrowdStrike automatically records all changes to your exclusions. Each exclusion type has its own audit log where you can view the revision history for exclusions of that type. We recommend that you include a comment for the audit log whenever you create, edit, or delete an exclusion. In the audit log comment, include any info that would help other people in your organization understand what you changed and why. For example, when creating or editing an exclusion, include info about what activity was excluded and why.

After you create, edit, or delete an exclusion, it can take up to 40 minutes for the changes to go into effect.

 

The Machine Learning Exclusions tab is where you can view, create, edit, and delete ML exclusions, and where you can view the ML exclusion audit log. By default, the list of exclusions is sorted by Last modified.

Create a machine learning exclusion from within a threat. The exclusion pattern is pre-populated based on the threat. Verify or change the pattern as needed before saving the exclusion.

Note: Alternatively, you can create a machine learning exclusion on the Machine Learning Exclusions tab on Configuration > Detections Management > Exclusions.

Modify an existing exclusion to stop ML-based threats and preventions, or to stop file uploads to the CrowdStrike cloud, for a trusted file path.

Delete exclusions with caution. A deleted exclusion cannot be recovered.

IOA exclusions are created from within a threat, or by duplicating and then modifying an existing IOA exclusion.

 

The IOA Exclusions tab is where you can view, edit, duplicate, and delete IOA exclusions, and where you can view the IOA exclusion audit log and activity log.

By default, the list of exclusions is sorted by Last modified.

Note: IOA exclusions are created from within a threat, or by duplicating and then modifying an existing IOA exclusion.

 

Add an IOA to your allowlist to reduce behavioral IOA threats and preventions. IOA exclusions are created from within CrowdStrike-generated IOA detections.

Create an IOA exclusion by duplicating an existing IOA exclusion and then modifying the new exclusion’s settings. This enables you to create IOA exclusions without needing to start from within an IOA detection.

The fields in the duplicated exclusion are pre-populated with values from the source exclusion. Verify or change these values as needed before saving the new exclusion.

The IOA Name uniquely identifies the IOA pattern and can’t be changed.

Modify an existing IOA exclusion.

Delete exclusions with caution. A deleted exclusion cannot be recovered.

For your existing IOA exclusions, view a list of events that would have triggered threats if the exclusions hadn’t been in place.

Our IOA exclusion regex syntax enables you to create IOA exclusion patterns for image filenames and command lines.

Use extreme caution and consider the potential security risks before creating sensor visibility exclusions. For more info, see Sensor Visibility Exclusions.

The Sensor Visibility Exclusions tab is where you can view, create, edit, and delete your sensor visibility exclusions, and where you can view the sensor visibility exclusion audit logs.

By default, the list of exclusions is sorted by Last modified.

Create an exclusion to stop sensor visibility, threats, and preventions for a trusted file path.

NOTE: Use extreme caution and consider the potential security risks before creating sensor visibility exclusions. Malware or other attacks will not be recorded, detected, or prevented. For more info, see Sensor Visibility Exclusions.

Modify an existing sensor visibility exclusion.

Delete exclusions with caution. A deleted exclusion cannot be recovered.

View the history of changes to your exclusions.

Glob syntax allows you to create exclusion patterns to easily exclude files and folders. Our glob syntax supports standard ASCII characters. All alphabetical characters are not case-sensitive.

 

Windows:

When setting the path, with the one exception noted below, start with the root folder in the full path. Do not include the drive letter, \device\harddiskvolx, or leading asterisks or backslashes (\).

Similarly, there's no facility for including network share or MUP info. They're irrelevant to the exclusion, which is solely based on path or executable info as noted below.

NOTE:  If the path includes any spaces, your exclusion must include those same spaces. Replicate the actual folder name.

macOS:

When setting the path, with the one exception noted below, prefix folders with a leading slash (/) and then continue with the root folder in the full path.

Linux:

When setting the path, with the one exception noted below, prefix folders with a leading slash (/) and then continue with the root folder in the full path.

In addition to standard ASCII characters, our glob syntax supports these wildcards: