Sensor Side Exclusions for Windows are Still Sending Events.

Products

• Carbon Black EDR

Issue/Introduction

After enabling sensor side exclusions, the process events in the path are still being sent to the console. 

Environment

• Carbon Black EDR Server: All Supported Versions
• Carbon Black EDR Sensor: 7.3.0 and Higher
• Microsoft Windows

Cause

Incorrect configuration. 

Resolution

1. Does the path match exactly to what is on the endpoint? 
   • Sensor Exclusions are case sensitive. 
   • The console stores the paths in all lowercase, this is not accurate to what is on the endpoint. 
2. Was the executable filename provided?
   • C:\Program Files\Folder\* will not work
   • C:\Program Files\Folder\*.exe will work
3. Is the process already running? 
   • PIDs that are already running before the exclusions is entered will not be excluded.
4. Verify the endpoint is in the group with the exclusions enabled. 
   • To verify via postgres, utilize this command with the hostname of the example endpoint. (hostname is case sensitive, use the console to verify or use b.id for the sensor id):

     psql -p 5002 cb -c "select a.*, b.id as sensor_id, b.computer_name, c.name as sensor_group from sensor_registrations b join sensor_groups c on b.group_id = c.id join group_exclusion a on a.group_id = c.id where b.computer_name = '<hostname>;"