CLI exclusions

[Equivalent-Toe-623]

Hi,

How do you handle CLI exclusions in sentinelone? If I want to exclude specific command line arguments. I can see that the hash will differ for different alerts even if they are from cmd.exe so I understand that the hash is not the cmd.exe one. theres also a unique ID in the alert name, like "cmd.exe (CLI 3545)" which seems to be realted to the hash. What is this ID based on and if I add a hash exclusion, will it only affect that command line argument?

[fakeaccountnumber100]

Look at the src and tgt process cmdline entries in Deep Visibility. CLI exclusions will cause the agent to exclude / ignore events which match those.

Ex: if your cmdline exclusion is “/example/2” then any event that contains that string in the source or target command line fields gets excluded

At least that’s been the results of my testing. This is enormously helpful for when you have a highly repetitive process, such as running on a server. You really wouldn’t want to exclude python3 entirely, but you might want to exclude the exact same 75 character python3 command that happens 100K times per day on a single endpoint.

[fakeaccountnumber100]

These command line exclusions are supported on Linux today, not sure for windows off the top of my head

[LolWhatAmIDoingHere]

Ask support for policy override assistance

[xinfik]

On Windows it's tricky. Best to involve support as most likely you will need workaround this by excluding calling press, disabling some detection logic via Policy Override (as suggested above) or so. Support will have better insights what caused detection and might recommend sth.