Best Practice for Endpoint Agents with Antivirus Protection - CyberOrchard

Created OnNovember 20, 2020

byJosh Kee

With a typical antivirus program, excluding a folder prevents the AV program from monitoring data that are written to, or read from, the folder.

Excluding a binary or executable file prevents the AV engine monitoring executable during read and write operations.

It is recommended to whitelist all of the processes, files, and folders that are listed below.

Windows

Endpoint Agent Installation Location	C:\Program Files\Manufacturer\Endpoint Agent
Endpoint Agent Temp Folder Location	C:\Program Files\Manufacturer\Endpoint Agent\temp
Processes	edpa.exe wdp.exe cui.exe cuil.exe kvoop.exe brkrprcs.exe brkrprcs64.exe prcs32.exe
Drivers	vfsmfd.sys vrtam.sys vnwcd.sys
Files	C:\Program Files\Manufacturer\Endpoint Agent\*.ead

Endpoint Agent Installation Location	/Library/Manufacturer/Endpoint Agent
Endpoint Agent Temp Folder Location	/Library/Manufacturer/Endpoint Agent/Temp
Processes	edpa wdp cui kvoop
Drivers	N/A
Files	/Library/Manufacturer/Endpoint Agent/*.ead

Was this article helpful?