Technical Tip: How to create application exclusions for Linux operating systems in FortiEDR

Description

This article describes the needed steps to create application exclusions for Linux operating systems.

Scope

 FortiEDR.

Solution

Steps to Create Exclusions for Linux in FortiEDR:

1. Access the Exclusion Manager:
   Log in to the FortiEDR console.
   Navigate to the Exclusion Manager section to manage exclusions.
   
   

2. Define the Exclusion:
   Select the option to add a new exclusion.
   Choose the operating system as Linux from the dropdown menu if available.
   
   

3. Specify the Exclusion Details:
   Process Path Exclusion: Specify paths that should be excluded from monitoring. For Linux, common paths include:

   /opt/FortiEDRCollector/*

   /sbin/FortiEDRCollector/*

   Process Name Exclusion: If applicable, specify the process names that should be excluded.
   
   

4. Configure the Exclusion Type:

   Determine whether the exclusion is for execution prevention or process monitoring.

   For execution prevention, ensure that the paths or processes are correctly specified to avoid blocking legitimate activities.

   
   

5. Apply and Save the Exclusion:

   Once the exclusion details are configured, apply the changes.
   Save the exclusion to ensure it is active.

   
   

6. Propagation and Testing:
   Allow some time (approximately 15 minutes) for the exclusion to propagate to all relevant collectors.
   Test the exclusion to ensure it is functioning as expected and not interfering with legitimate processes.

Important Considerations:

• Security Risks: Be aware that adding exclusions can introduce security risks. Ensure that exclusions are well-understood and necessary for the environment.

• Documentation Discrepancies: If the documentation does not align with the options available in the console, it might be due to updates or specific configurations in the FortiEDR deployment.
  Always verify with the latest console options and consult Fortinet Support if needed.