Antivirus Exclusions for the Agent

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

This document contains the list of both files and folders that should be excluded in any other security software on endpoints that also have an App Control Agent installed.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions
• Linux OS: All Supported Versions
• macOS: All Supported Versions

Resolution

Windows:

Folder Exclusions
Architecture	Path	Information
64-bit only	C:\ProgramData\Bit9\Parity Agent\	Agent Data Directory
	C:\Program Files (x86)\Bit9\Parity Agent\	Agent Application Directory
32-bit only	C:\Documents and Settings\All users\Application Data\Bit9\Parity Agent\	Agent Data Directory
	C:\Program Files\Bit9\Parity Agent\	Agent Application Directory

 

File Exclusions
Architecture	Path	Information
64-bit & 32-bit	C:\Windows\System32\drivers\Parity.sys	Agent Kernel Driver
	C:\Windows\System32\drivers\ParityELAM.sys	Agent ELAM Driver
64-bit only	C:\Program Files (x86)\Bit9\Parity Agent\Crawler.exe	Used for Trusted Directory Scanning
	C:\Program Files (x86)\Bit9\Parity Agent\Dascli.exe	Command Line Interface on 64 bit systems
	C:\Program Files (x86)\Bit9\Parity Agent\Notifier.exe	Used To Display Blocks/Prompts to End Users
	C:\Program Files (x86)\Bit9\Parity Agent\Parity.exe	Agent Process
	C:\Program Files (x86)\Bit9\Parity Agent\ParityHost.exe	Used for installing and registering the ELAM Driver
	C:\Program Files (x86)\Bit9\Parity Agent\Timedoverride.exe	Used for putting a device into timed override
32-bit only	C:\Program Files\Bit9\Parity Agent\Crawler.exe	Used for Trusted Directory Scanning
	C:\Program Files\Bit9\Parity Agent\Dascli.exe	Command Line Interface
	C:\Program Files\Bit9\Parity Agent\Notifier.exe	Used to Displays Blocks/Prompts to End Users
	C:\Program Files\Bit9\Parity Agent\Parity.exe	Agent Process
	C:\Program Files\Bit9\Parity Agent\ParityHost.exe	Used for installing and registering the ELAM Driver
	C:\Program Files\Bit9\Parity Agent\Timedoverride.exe	Used for putting a device into timed override

 

Linux:

Path/Location	Information
/opt/bit9/bin/	Agent Application Directory
/srv/bit9/data/	Agent Data Directory
/lib/modules/kernelversion/kernel/lib/b9k*.ko	Agent Kernel Driver
/lib/modules/kernelversion/kernel/lib/cbproxy_cbp_*.ko	Agent Proxy Module
/etc/rc*/*b9daemon and /etc/init.d/b9daemon	Agent Startup Script
/etc/X11/xinit/xinitrc.d/90b9notifier.sh	Agent Block Notifier

 

macOS:

System Extensions are used with macOS Agent 8.7.x and higher when installed on macOS 11.x and higher
Path/Location	Information
/Applications/Bit9/	Agent Application Directory
/Library/Application Support/com.bit9.Agent/	Agent Data Directory
/Applications/Bit9/Agent/appc-es-loader.app/Contents/MacOS/appc-es-loader	Agent System Extension Bundle ID: com.vmware.carbonblack.appc-es-loader.appc-es-extension
/Library/SystemExtensions/*/com.vmware.carbonblack.appc-es-loader.appc-es-extension.systemextension/	Agent System Extensions

 

Kernel Extensions are used with macOS Agent 8.7.x and lower when installed on macOS 10.15.x and lower
Path/Location	Information
/Applications/Bit9	Agent Application Directory
/Library/Application Support/com.bit9.Agent/	Agent Data Directory (10.9 and higher)
/Library/Extensions/b9kernel.kext/	Agent Driver (10.9 and higher)
/Library/Caches/com.bit9.agent/	Agent Data Directory (10.8 and lower)
/System/Library/Extensions/b9kernel.kext	Agent Driver (10.8 and lower)

 

Additional Information

• Windows Defender is enabled by default on Windows machines, and also requires these exclusions.
• Sub-folders should be included on the exclusion. Some vendors require a trailing asterisks (*) when entering exclusions. Please refer to the vendor's documentation.
• The App Control Agent is considered a "real-time" scanner. It also has a self-protection mechanism (Tamper Protection) to ensure that the average end-user cannot disable it.
• It is important to set up an exclusion policy with your antivirus (or any other real-time scanning application) to provide proper interoperability.
• This exclusion will also eliminate potential performance issues caused by the AV process constantly scanning our cache and transaction log files. The Agent is a real-time scanner, these files are constantly being written to.