Where is the documentation on when to use Policy permissions vs Core Preventions vs the new Event Reporting / Process exclusions?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Where does one find documentation on when and how to use Policy permissions, Core Preventions and the new Event Reporting / Process Exclusions features?

Environment

• Carbon Black Cloud Console: All versions as of February, 2024
• Carbon Black Cloud Standard Endpoint (ES): All versions
• Carbon Black Cloud Enterprise EDR (EEDR): All versions
• Carbon Black Cloud Windows Sensor: Varies by feature. Use the 4.0.x or greater Windows Sensor for all features to be available.
• Microsoft Windows: All supported versions.

Resolution

• User Guide topics
• Event Reporting and Sensor Operation Exclusions Announcement

Additional Information

Carbon Black Cloud has continued to create methods to exclude items for different reasons. We have a number of options depending on the product you own and the goal for the exclusion. Below is a list of some of the common items we see.

Policy permissions:

• Policy — Carbon Black Cloud: How to Set up Exclusions in the Carbon Black Cloud Console for AV Products 
• Policy — Endpoint Standard: How to Create Policy Blocking & Isolation and Permissions Exclusions 
• Policy — Carbon Black Cloud: What are the differences between API Bypass and Full Bypass 
• Expectation — Carbon Black Cloud: Events Still Being Sent When Process is in Full Bypass Rule  
• Wildcards — Carbon Black Cloud: How to specify wildcards in Core Prevention exclusions  
• Auto Delete -— CB Defense: Is A Folder Path Exclusion Possible For The Auto-Delete Feature? 
• IT Tools — Endpoint Standard: Adding approved reputation using IT Tools isnt working properly 
• IT Tools — Carbon Black Cloud: How to Utilize IT Tools Allow list Feature  
• Self Signed Cert — Endpoint Standard: Adding self-signed cert to script and Configuring the system for a bypass 
• Hash — Carbon Black Cloud: How to Add a SHA256 Hash to Approved/Banned List 
• MAC —  NGAV Cb Defense Mac Policy Guidelines

Core Preventions

• Core Rules — Endpoint Standard: How to Configure Exclusions for Core Prevention Rules

Event Reporting / Process Exclusions

• Event Reporting and Sensor Operation Exclusions Announcement
• Enterprise EDR: Is it possible to add scanning exclusions for other security products in an Enterprise EDR console?
• Enterprise EDR: Sensor Does Not Honor Bypass Exclusions

Other

• 3rd party recommendations — Carbon Black Cloud: Recommended Third-Party Anti-virus Exclusions 
• Citrix recommendations —  Carbon Black Cloud Windows Sensor: How to add Citrix exclusions in Windows registry for CBC Sensor