Configuring Allow List Policies for Third-Party Antivirus (AV) Interoperability in Symantec CBX

Products

• CBX Complete
• CBX Essentials

Issue/Introduction

Problem: You need to prevent interference between Symantec CBX and third-party antivirus (AV) solutions on the same endpoint. Conflicts between multiple security agents can cause performance degradation, system instability, or blocked functionality.

Environment

 

• Product: Symantec CBX (Complete/Essentials)
• Operating System: Microsoft Windows

 

Resolution

Overview: In Symantec CBX, you mitigate interoperability conflicts by configuring Allow List policies. These policies exclude the files, folders, and processes of third-party security agents from Symantec CBX scans and behavioral monitoring.

Important Caveats

• Performance vs. Security: Folder exclusions suppress detection visibility. Use them cautiously to address verified performance issues, but be aware that overly broad exclusions can hide malicious activity.
• Policy Limits: An Allow List policy supports a maximum of 1,000 combined file path and folder exclusions for Auto-Protect on Windows.
• Wildcard Support: You can use * and ? wildcards in file and folder paths to cover multiple versions or directory variations of third-party AV components.

Procedure: Adding Folder Exclusions for Third-Party AV

Use this method to exclude the installation and data directories of the third-party software.

1. In the Symantec CBX console, navigate to Endpoint Security > Policies.
2. Select the Allow List policy you wish to edit, or create a new one.
3. In the Allowed by section, select File / Folder.
4. Click Add.
5. Configure the Folder Exclusion Settings:
   • Prefix: Choose a predefined system prefix (e.g., [PROGRAM_FILES]) or select [NONE] to enter a literal path.
   • Folder: Enter the full path to the third-party AV directory (e.g., C:\Program Files\ThirdPartyAV).
   • Include subfolders: Check this box to ensure all components within that directory are excluded.
6. Under the list of technologies, ensure the following are selected (enabled by default):
   • Auto-Protect: Excludes the folder from real-time scans.
   • Scheduled and On-Demand scans: Excludes the folder from background scans.
   • Behavioral Analysis: Excludes the folder from real-time heuristic scans.
   • Custom Application Behavior: Prevents rule sets from modifying the files.
7. Click Save to add the exclusion to the list.
8. Click Save at the top level to update and apply the policy.

 

Alternative Method: Certificate Exclusions

If the third-party AV solution uses a consistent digital signature for all its executables, you can exclude all files signed by that vendor, which is often more efficient than manual path exclusions.

1. In the Allow List policy, navigate to Allowed by > Certificate.
2. Click Add.
3. Upload the signing certificate used by the third-party AV vendor.
4. Select the security technologies from which to exclude the signed files (e.g., Essential Prevention scans).
5. Click Save to update the policy.

Additional Information

Allow List Policies