Configuring and Managing Exclusions in Hexnode XDR

Hexnode XDR continuously monitors system calls across your endpoints to detect suspicious behavior. While this vigilance keeps your environment secure, it can occasionally lead to performance overhead or flag a trusted item, such as an internal application, as a threat.

Exclusions in Hexnode XDR let you specify exactly what the XDR agent should ignore. When you exclude a trusted file, folder, publisher, hash, or file extension, real-time monitoring is disabled for that item. Routine activity involving it (opening, editing, moving) no longer triggers incident alerts.

This guide covers how to create exclusions and how to manage them in Hexnode XDR.

Exclusion types at a glance

Create Exclusions

You can create an exclusion in two ways:

1. From the Policies tab: Add exclusions as part of a policy’s configuration.
2. From the Incidents tab: Add an exclusion directly from a flagged incident.

To view and manage all exclusions afterward, use the Exclusions Repository.

Method 1: Creating exclusions from the Policies tab

1. Log in to Hexnode XDR.
2. Go to the Policies tab and click New Policy.

Step 1: Configuration

3. Select the OS platform — Windows, or macOS.
4. Click on Exclusions. The Exclusions section expands into four exclusion types:
   • File/Folder
   • Publisher
   • Hash
   • File Extension (Windows only)
5. Select an exclusion type and click on Configure, then follow the instructions for that type below.
6. Click Next when you’ve finished configuring your exclusions.

Follow the steps below to configure each exclusion type.

File/Folder

Specify the file or folder paths you want to exclude from your incident stream.

• From the dropdown, choose File or Folder.
• In the text field, enter the full path of the file or folder. For example, C:\Program Files\Acme\acme.exe on Windows or /Applications/Acme.app on macOS.
• For a folder, enable the Include sub-folder option if the exclusion should also cover every sub-folder inside the specified folder.
• Click Add to save the entry to the table.

Publisher

Exclude trusted software from being flagged as threats by specifying its publisher and code-signing identity.

• Enter the Publisher Name.
• (Optional, recommended) Enter the Certificate Thumbprint (Windows) or Team ID (macOS). Adding one verifies the publisher’s identity and makes the exclusion more precise.
• Click Add to save the entry to the table.

Hash

Exclude a specific binary by its hash value.

• Choose SHA 1 or SHA 256 from the dropdown.
• Enter the hash value in the text field.
• Click Add to save the entry to the table.

File Extension (Windows only)

Exclude all files with a particular extension (for example, .xml or .tmp) so they are no longer flagged as threats. Once an extension is excluded, files of that type no longer trigger incident notifications.

• Enter the file extension in the text field.
• Click Add to save the entry to the table.

Step 2: Targets

7. On the Targets page, choose where the policy should apply:
   • Endpoints: Click Add Endpoints, select endpoints from the list, then click Add.
   • Endpoint groups: Click Add Endpoint Group, select groups from the list, then click Add.
8. Click Next to reach the Review page.

Step 3: Review

The Review page displays a preview of the policies you’ve configured in the previous steps.

9. In the policy preview, under Exclusions, click Edit to go back to the configuration page and make changes.

10. Click Save, then choose one of the following:
    • Save Draft: saves the policy so you can publish it later.
    • Publish: applies the policy to the selected targets immediately.

Once the policy is published, the exclusions you configured apply to the selected endpoints and endpoint groups. On those endpoints, the excluded items are no longer flagged as threats, and activity involving them won’t trigger incident notifications.

Method 2: Creating an exclusion from the Incidents tab

Use this method when you want to exclude a specific file, publisher, or hash directly from a flagged incident.

1. Open the Incidents tab and click on the specific incident.
2. Click on Action, then select Add to Exclusion Policy.

3. In the window that appears, select the exclusion types.
Note:


The available exclusion types for the incident depend on the data captured from the incident. Depending on the incident, you may see the following extension types:

• File/Folder
• Publisher
• Hash (SHA-256 / SHA-1)
• File Extension



4. As you select each type, it’s added to the right side of the window with its fields already filled in from the incident’s data. These values are read-only and can’t be edited.

4. Click Next.
5. Select the policy you want to add the exclusion to, and then click Save.

Once saved, the selected items are added as exclusions to that policy. On every endpoint the policy applies to, these items are no longer flagged as threats, and activity involving them won’t trigger incident notifications.

Managing exclusions: The Exclusions Repository

The Exclusions subtab, located under the Incidents tab, provides a centralized, tabular view of all active exclusions created across the Hexnode XDR portal.

You can use the Group by option to organize the table by Exclusion Type, or use the Filter menu to narrow results by Exclusion Type (File, Folder, Publisher, File Extension, Hash based – SHA 1 or Hash based – SHA 256) or Platform (Windows, macOS).

Table columns: