How to Create Exclusions or Inclusions for VMware Carbon Black Cloud

VMware Carbon Black uses Reputation and Permission rules to handle next-generation antivirus (NGAV) exclusions (approved lists) and inclusions (banned lists). VMware Carbon Black Standard, VMware Carbon Black Cloud Advanced, and VMware Carbon Black Cloud Enterprise use Endpoint detection and response (EDR). EDR is also affected by Reputation and Permission rules. This article walks administrators through setting these values along with any caveats that may be relevant.

Affected Products:

• VMware Carbon Black Cloud Prevention
• VMware Carbon Black Cloud Standard
• VMware Carbon Black Cloud Advanced
• VMware Carbon Black Cloud Enterprise

Affected Operating Systems:

• Windows
• Mac
• Linux

VMware Carbon Black Cloud uses a combination of Policies and Reputation to determine what operations take place.

Click the appropriate topic for more information.

Policies

VMware Carbon Black Cloud Prevention policies differ from the policies of VMware Carbon Black Cloud Standard, Advanced, and Enterprise. Click the appropriate product for more information.

Prevention

VMware Carbon Black Cloud Prevention provides a streamlined approach to Permissions Rules and Blocking and Isolation Rules because it does not use EDR.

Click the appropriate topic for more information.

Permissions Rules

Permissions rules determine what operations applications at specified paths can perform.

Permissions rules are path-based and take precedence over both Blocking and Isolation rules as well as Reputation.

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. In the left menu pane, click Enforce.
   
4. Click Policies.
   
5. Select the policy set to modify.
   
   Note: The example images use Standard as the policy set chosen to modify.
6. In the right menu pane, click Prevention.
   
7. Click to expand Permissions.
   
8. Click to expand Add application path.
   
9. Populate the intended path to set a bypass on.
   
   Note:

   • The example image uses the following paths:
     • *:\program files\dell\dell data protection\**
     • *:\programdata\dell\dell data protection\**
   • In this example, the actions that are applied affect all files on all drives containing the paths \program files\dell\dell data protection\ and \programdata\dell\dell data protection\.
   • VMware Carbon Black’s Permissions list leverages a glob-based formatting structure.
   • Environment variables such as %WINDIR% are supported.
   • A single asterisk (*) matches all characters within the same directory.
   • Double asterisks (**) match all characters within the same directory, multiple directories, and all directories above or below the specified location or file.
   • Examples:
     • Windows: **\powershell.exe
     • Mac: /Users/*/Downloads/**
10. Select the Action to be enforced.
    
    Note:

    • In the example image, operation attempts are given different actions by selecting either Allow or Bypass.
    • When the operation attempt of Performs any operation is selected, this overrides any other operation attempt and disables the selection of any other option.
    • Action definitions:
      • Allow - Allows the behavior in the specified path with information about the action being logged by VMware Carbon Black Cloud.
      • Bypass - All behavior is allowed in the specified path. No information is collected.
11. Click Save in the upper right, or at the bottom of the page.
    

Blocking and Isolation Rules

Blocking and Isolation rules are path-based and take precedence over Reputation. Blocking and Isolation rules allow us to set a "Deny operation" or "Terminate process" action when a specific operation is attempted.

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. In the left menu pane, click Enforce.
   
4. Click Policies.
   
5. Select the policy set to modify.
   
   Note: The example images use Standard as the policy set chosen to modify.
6. In the right menu pane, click Prevention.
   
7. Click to expand Blocking and Isolation.
   
8. Populate the application path to set a Blocking and Isolation rule on.
   
   Note:

   • The example image uses excel.exe.
   • The actions set apply to the application with the name excel.exe ran from any directory.
   • VMware Carbon Black’s Permissions list leverages a glob-based formatting structure.
   • Environment variables such as %WINDIR% are supported.
   • A single asterisk (*) matches all characters within the same directory.
   • Double asterisks (**) match all characters within the same directory, multiple directories, and all directories above or below the specified location or file.
   • Examples:
     • Windows: **\powershell.exe
     • Mac: /Users/*/Downloads/**
9. Click Save in the upper right.
   
   Note: Terminate process ends the process once the specified operation attempts to run.

Standard, Advanced, and Enterprise

VMware Carbon Black Cloud Standard, VMware Carbon Black Cloud Advanced, and VMware Carbon Black Cloud Enterprise provide options with Permissions Rules, as well as Blocking and Isolation Rules, due to inclusion of EDR.

Click the appropriate topic for more information.

Permissions Rules

Permissions rules determine what operations applications at specified paths can perform.

Permissions rules are path-based and take precedence over both Blocking and Isolation rules as well as Reputation.

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. In the left menu pane, click Enforce.
   
4. Click Policies.
   
5. Select the policy set to modify.
   
   Note: The example images use Standard as the policy set chosen to modify.
6. In the right menu pane, click Prevention.
   
7. Click to expand Permissions.
   
8. Click to expand Add application path.
   
9. Populate the intended path to set a bypass on.
   
   Note:

   • The example image uses the following paths:
     • *:\program files\dell\dell data protection\**
     • *:\programdata\dell\dell data protection\**
   • In this example, the actions that are applied affect all files on all drives containing the paths \program files\dell\dell data protection\ and \programdata\dell\dell data protection\.
   • VMware Carbon Black’s Permissions list leverages a glob-based formatting structure.
   • Environment variables such as %WINDIR% are supported.
   • A single asterisk (*) matches all characters within the same directory.
   • Double asterisks (**) match all characters within the same directory, multiple directories, and all directories above or below the specified location or file.
   • Examples:
     • Windows: **\powershell.exe
     • Mac: /Users/*/Downloads/**
10. Select the Action to be enforced.
    
    Note:

    • In the example image, operation attempts are given different actions by selecting either Allow, Allow & Log, or Bypass.
    • When the operation attempt of Performs any operation is selected, this overrides any other operation attempt and disables the selection of any other option.
    • Every action except Performs any operation can be applied to multiple operation attempts.
    • Action definitions:
      • Allow - Allows the behavior in the specified path; none of the specified behavior at the path is logged. No data is sent to the VMware Carbon Black Cloud.
      • Allow & Log - Allows the behavior in the specified path; all activity is logged. All data is reported to the VMware Carbon Black Cloud.
      • Bypass - All behavior is allowed in the specified path; nothing is logged. No data is sent to the VMware Carbon Black Cloud.
11. Click Confirm at the bottom of the Permissions to set the policy change.
    
12. Click Save in the upper right.
    

Blocking and Isolation Rules

Blocking and Isolation rules are path-based and take precedence over Reputation. Blocking and Isolation rules allow us to set a "Deny operation" or "Terminate process" action when a specific operation is attempted.

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. In the left menu pane, click Enforce.
   
4. Click Policies.
   
5. Select the policy set to modify.
   
   Note: The example images use Standard as the policy set chosen to modify.
6. In the right menu pane, click Prevention.
   
7. Click to expand Blocking and Isolation.
   
8. Click to expand Add application path.
   
9. Populate the application path to set a Blocking and Isolation rule on.
   
   Note:

   • The example image uses excel.exe.
   • The actions set apply to the application with the name excel.exe ran from any directory.
   • VMware Carbon Black’s Permissions list leverages a glob-based formatting structure.
   • Environment variables such as %WINDIR% are supported.
   • A single asterisk (*) matches all characters within the same directory.
   • Double asterisks (**) match all characters within the same directory, multiple directories, and all directories above or below the specified location or file.
   • Examples:
     • Windows: **\powershell.exe
     • Mac: /Users/*/Downloads/**
10. Select the Action to be taken when the operation attempt is met and then click Confirm.
    
11. Click Save in the upper right.
    
    Note:

    • Deny operation prevents the listed application from performing the specified operation that it attempted to perform.
    • Terminate process ends the process once the specified operation attempts to run.

Reputation

VMware Carbon Black assigns a Reputation to every file that is run on a device with the sensor installed. Pre-existing files begin with an effective reputation of LOCAL_WHITE until run or until the background scan has processed them and gives a more definitive reputation.

Either Add an Application to the Reputation List or reference Reputation Descriptions. Click the appropriate topic for more information.

Add an Application to the Reputation List

An application may be added to the reputation list through either the Reputations Page or the Alerts Page. Click the appropriate option for more information.

Reputations Page

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. In the left menu pane, click Enforce.
   
4. Click Reputation.
   

An administrator may add an application to the reputation list using the SHA256 Hash, IT Tool, or Signing Certificate. Click the appropriate option for more information.

SHA256 Hash

5. Click Add.
   
6. From Add Reputation:
   1. Select Hash for the Type.
   2. Select either Approved List or Banned List for the List.
   3. Populate the SHA-256 hash.
   4. Populate a Name for the entry.
   5. Optionally, populate Comments.
   6. Click Save.
   
   Note:

   • Approved List automatically sets any affected and known file to have a reputation of Company Approved.
   • Banned List automatically sets any affected and known file to have a reputation of Company Banned.

IT Tool

5. Click Add.
   
6. From Add Reputation:
   1. Select IT Tools for the Type.
   2. Populate the relative Path of trusted IT tool.
   3. Optionally, select Include all child processes.
   4. Optionally, populate Comments.
   5. Click Save.
   
   Note:

   • IT Tools may only be added to the Approved List. Approved List automatically sets any affected and known file to have a reputation of Local White.
   • The option Include all child processes notes that, if selected, all files that are dropped by child processes of the newly defined trusted IT tool also receive the initial trust.
   • Relative paths for IT tools indicate that the path defined can be fulfilled by the defined pathing.

Example:

For the following examples, the Path of trusted IT tool is set to:

• \sharefolder\folder2\application.exe

If an administrator attempts to run the file in these locations, the exclusion succeeds:

• \\server\tools\sharefolder\folder2\application.exe
• D:\ITTools\sharefolder\folder2\application.exe

If an administrator attempts to run the file in these locations, the exclusion fails:

• E:\folder2\application.exe
• H:\sharefolder\application.exe

In the failed examples, the path cannot be fulfilled entirely.

Signing Certificate

5. Click Add.
   
6. From Add Reputation:
   1. Select Certs for the Type.
   2. Populate the Signed by field.
   3. Optionally, populate the Certificate Authority.
   4. Optionally, populate the Comments.
   5. Click Save.

Alerts Page

1. In a web browser, go to [REGION].conferdeploy.net.
   Note: [REGION] = Region of tenant

   • Americas = https://defense-prod05.conferdeploy.net
   • Europe = https://defense-eu.conferdeploy.net/
   • Asia Pacific = https://defense-prodnrt.conferdeploy.net/
   • Australia and New Zealand = https://defense-prodsyd.conferdeploy.net
2. Sign In to the VMware Carbon Black Cloud.
   
3. Click Alerts.
   
4. Select the chevron next to the alert to approve the application.
   
5. Click Show all under the Remediation subsection.
   
6. Click to Add the file to either the banned list or to the approved list depending on whether the hash is untrusted or trusted.
   
   Note: The signing certificate may be added so that other applications that share this certificate are added automatically to the local approved list.

Reputation Descriptions

To contact support, reference Dell Data Security International Support Phone Numbers.
Go to TechDirect to generate a technical support request online.
For additional insights and resources, join the Dell Security Community Forum.