[KB8538] Create exclusions and storage event filters in ESET Inspect On-Prem

Issue

• Create exclusions and storage event filters in ESET Inspect On-Prem
• Create an exclusion
• Create an exclusion for a specified script
• Create an event storage filter

Details

Solution

Create an exclusion

1. Open the ESET Inspect Web console.

2. Open the Exclusions view: in the navigation panel, click More → Exclusions.

3. Click New exclusion.

4. Type a Name. Click Criteria. Criteria determine which processes should be excluded from detection. The criteria are grouped into the following scopes:

   • Current process—Criteria matching the process that triggered the detection you want to exclude.
   • Parent process—Criteria matching the process that launched the current process involved in the detection.
   • Any ancestor process—Criteria matching any process higher up in the process tree that led to the current process.
     
     

5. Define the criteria matching the process you want to exclude from detection using the properties below. Optionally, click Advanced editor to modify the criteria by changing the rule syntax.

   • Process name is one of—The names of the processes that you want to exclude from detection.
   • Process path starts with—The path to the process that you want to exclude from detection (C:\Windows or %SYSTEM% can be used).
   • Cmd. line contains—The command-line parameters used by the process that you want to exclude from detection.
   • Signer is one of—The names of the signers associated with the process that you want to exclude from detection.
   • Signature type is—The type of digital signature used by the process that you want to exclude from detection. Choose comparison operators (e.g., is, is not, greater than or equal, less than or equal) and select a signer type: Trusted, Valid, Self-signed, None, Invalid, or Present. This field is required when a signer is specified.
   • SHA-1 is one of—The SHA-1 hash values of the processes that you want to exclude from detection.
   • SHA-256 is one of—The SHA-256 hash values of the processes that you want to exclude from detection.
   • User is one of—The usernames under which the process that you want to exclude from detection runs.
     
     

6. Click Rules. Select the rules to which you want to apply the exclusion. To narrow the rule list, click Add filter, select the Rule name filter and type a string to search for.

7. In the Auto-resolving section under Rules, decide whether you want to automatically resolve all previous detections matching the defined exclusion criteria. If you want to resolve the detections, leave the check box next to Resolve matching detections selected. Otherwise, deselect it.

8. Click Targets → Assign. Select the computers or groups to which you want to apply the exclusion and click OK.

9. Click Summary, review the exclusion details and click Create exclusion.

10. After creating the exclusion, you will be redirected back to the Exclusions view.

Create an exclusion for a specified script

1. Open the ESET Inspect Web console.

2. Open the Scripts view: in the navigation panel, click Scripts.

3. Select the script for which you want to create an exclusion and click Create exclusion.

4. Type a Name. Click Criteria. Criteria determine which processes should be excluded from detection. As you are creating an exception for a specific script, the criteria will be pre-defined.

5. Review the criteria pre-defined through the parameters below and modify them if needed. Optionally, click Advanced editor to modify the criteria by changing the rule syntax.

   • Process name is one of—The names of the processes that you want to exclude from detection.
   • Cmd. line contains—The command-line parameters used by the process that you want to exclude from detection.
   • User is one of—The usernames under which the process that you want to exclude from detection runs.
     
     

6. Click Targets → Assign. Select the computers or groups to which you want to apply the exclusion and click OK.

7. Click Summary, review the exclusion details and click Create exclusion.

8. After creating the exclusion, you will be redirected back to the Scripts view.

Create an event storage filter

1. Open the ESET Inspect Web console.

2. Open the Executables view: in the navigation panel, click Executables.

3. Select the executable for which you want to create an event storage filter and click Filter events.

4. Review the pre-defined Name and modify it if needed. Click Criteria. Criteria determine which events should be excluded from storage. As you are creating an event storage filter for a specific executable, the criteria will be pre-defined. 

5. Review the criteria pre-defined through the parameters below and modify them if needed. Optionally, click Advanced editor to modify the criteria by changing the rule syntax.

   • Process name is one of—The names of the processes whose events you want to exclude from storage.
   • Process path starts with—The path to the process whose events you want to exclude from storage (C:\Windows or %SYSTEM% can be used).
   • Cmd. line contains—The command-line parameters used by the process whose events you want to exclude from storage.
   • Signer is one of—The names of the signers associated with the process whose events you want to exclude from storage.
   • Signature type is—The type of digital signature used by the process whose events you want to exclude from storage. Choose comparison operators (e.g., is, is not, greater than or equal, less than or equal) and select a signer type: Trusted, Valid, Self-signed, None, Invalid, or Present. This field is required when a signer is specified.
   • SHA-1 is one of—The SHA-1 hash values of the processes whose events you want to exclude from storage.
   • SHA-256 is one of—The SHA-256 hash values of the processes whose events you want to exclude from storage.
   • User is one of—The usernames under which the process, whose events you want to exclude from storage, runs.
     
     

6. Click Event types and select the event types that you want to exclude from storage. You can select the following event types:

   • File system events
   • TCP events
   • Registry events
   • HTTP events
   • DNS events
     
     

7. Click Targets → Assign. Select the computers or groups to which you want to apply the event storage filter and click OK.

8. Click Summary, review the event storage filter details and click Create filter.

9. After creating the event storage filter, you will be redirected back to the Executables view.