Configure Sophos Central Endpoint exclusions safely

A Sophos Endpoint exclusion is not a harmless compatibility setting. It wholly or partly removes files, processes, websites, or individual protection controls from inspection. An exclusion that is too broad can expose the exact path that malware later uses.

The safe approach is therefore to identify the triggering event and protection module, create the narrowest suitable exclusion in a targeted Threat Protection policy, test it on a few devices, and document its owner and expiry date. A global exclusion is appropriate only when the same verified need genuinely applies to every affected user, computer, and server.

Clarify scope and priority before syntax

Global and policy exclusions are not priority levels that cancel each other out: a global exclusion applies everywhere and cannot be narrowed by a stricter policy. If several policies of the same type match, Central applies only the first active policy in the list; it does not merge its settings with a lower Threat Protection policy. Therefore, place a temporary exclusion policy above the general policy and verify the effective policy on the device. Build Sophos Central Endpoint policies correctly explains the selection model in detail.

Create a global exclusion

1. Open Global Settings > Protection and Remediation > Allow and Block > Global Exclusions.
2. Select Add Exclusion and determine the type under Exclusion Type.
3. Under Value, enter only the verified path, process, host, or traffic parameters.
4. For File or folder under Active for choose between real-time scanning, scheduled scanning or both. Only exclude the scan that is actually affected.
5. Select Add or Add Another and then Save on the page.

If editing is locked, partner or enterprise settings may be locking the global settings. The administrator role also requires access to Endpoint Protection and Server Protection. Do not work around the restriction by using a technically broader action from an event.

Prove the need before each exception

A well-founded request includes:

• Detection name, timestamp, affected device and user;
• full path, process or network endpoint;
• Sophos event and the triggering protection module;
• Manufacturer recommendation for the product version actually used;
• SHA-256 and digital signature if a file is affected;
• smallest necessary target group, responsible person and expiry date;
• a reproducible before-and-after test and a rollback plan.

“The application runs slowly” is not enough. CPU, disk, affected file type, process chain and a timely Sophos event must prove the connection. Without this evidence, an exception would only mask symptoms.

Vendor exclusions for Windows applications

For vendor-recommended exclusions, first record the exact product version, installed components, and demonstrably affected workflow. Then require the application vendor to confirm the paths and processes currently needed for that exact configuration. Match every entry to the relevant Sophos event; add only confirmed entries, one by one, to the narrowest suitable pilot policy. Record the owner, rationale, and expiry date in the change. Do not search for or import a generic vendor list unchanged.

For a folder scan exclusion, preserve the required trailing backslash. Treat a process exclusion as broad: it also bypasses inspection for non-excluded files the process touches or loads and for its network activity. If an application has measured, significant degradation attributable to Sophos, require its vendor to confirm the exclusions for that exact version. Do not guess paths, broaden entries just in case, or disable protection. Sophos Support can verify that confirmed entries were applied correctly; if causality remains unclear, escalate with diagnostic evidence.

Choose the appropriate exclusion type and syntax

A scan exclusion does not automatically disable exploit, ransomware, or behavior checks. Conversely, a module-specific exclusion does not generally disable malware scanning. The event type therefore determines the exclusion type.

Windows: file, folder or process

A full path is narrower than a filename, wildcard, or entire directory. *.* is not a valid blanket Windows wildcard. Entire drives as well as high-ranking or frequently abused directories such as C:\Windows\, C:\ProgramData\, C:\Users\<Username>\ or the Startup folder are not excluded.

The following applies to scan exceptions:

• * represents zero or more characters, but does not exceed any \ or / separator.
• ** can capture separators if it is surrounded by separators or is at the beginning or end of the exception. For example, C:\foo\**\bar captures C:\foo\bar and deeper paths such as C:\foo\more\bar.
• ? represents one character; at the end of a string, it can also match zero characters.
• A single \ or / as an exception extends from the drive root through all folders and is therefore not to be used.

Variables have a large scope. %PROGRAMDATA% corresponds to C:\ProgramData, %USERPROFILE% to all user profiles, %TEMP% and %TMP% respectively to the local user temp directories and %WINDIR% to C:\Windows. They are not used alone as an exception. Wildcard exceptions in the on-access scan also affect monitoring through data loss prevention rules.

For a network share, use the UNC form \\<REMOTESERVER>\<SHARENAME>\. Replace <REMOTESERVER> and <SHARENAME> with the real server and share name; do not guess a mapped drive name.

For a slow application, a Process (Windows) exclusion is often narrower than excluding an entire data folder. If the verified process C:\appfolder\app.exe causes the delay while accessing C:\datafolder\, enter the full application path, not just app.exe. The exclusion also covers files accessed by this process, but not applications that the process itself uses.

macOS: Slash and star mean different things

macOS accepts POSIX paths for volumes, folders or files. The syntax must not be derived from a Windows pattern:

• /myfolder/myapplication captures exactly this file.
• /myfolder/ captures the folder and all subfolders recursively.
• /myfolder// captures the folder but not subfolders.
• /Users/SomeUser/Documents/ExcludeMe/* captures files directly in ExcludeMe, but not folders within it.
• /Users/*/Documents/ExcludeMe/ captures ExcludeMe for all users including files, folders and subfolders.

A pattern without a leading / can capture the matching name anywhere locally or on the network, making it broader. An asterisk at the end of a path is only allowed for file exceptions and does not automatically capture subfolders.

Linux: Check scan and data lake scope separately

For Linux servers, full absolute syntax is easiest to control. /mnt/hgfs/excluded captures the file or folder of that name, but not the contents of the folder. /mnt/hgfs/excluded/ captures the folder with all files and subfolders when scanning. A name or relative path, on the other hand, can fit in several places on the file system.

Server Protection for Linux (SPL) requires the following wildcards for relative expressions: For example, specify a relative path bar/file.name as */bar/file.name and a directory name bar/ as */bar/*. Such patterns are wider than an absolute path and are only used when exactly this location-independent scope is needed.

Data lake exclusions interpret the final slash differently than scan exclusions. To achieve the scan scope of /mnt/hgfs/excluded/ for data lake events as well, two entries are required: /mnt/hgfs/excluded for the directory itself and /mnt/hgfs/excluded/* for its contents. A scan exception alone does not guarantee that data lake events will not appear.

Website, PUA and other global exclusion types

• Website (Windows/Mac): accepts IP address, CIDR range or domain; Wildcards are not allowed. Sophos does not check the website category or Web Control for this. The domain or address is therefore chosen to be as narrow as the application allows.
• Potentially Unwanted Application (Windows/Mac/Linux): uses the exact PUA name detected by Sophos. Global authorization applies everywhere; a policy limits the scope.
• AMSI Protection (Windows): takes code in a full file, folder or drive path from the AMSI scan. * is for filename or extension only.
• Hashing exclusions (Windows): prevents hashes from being generated for specified folders, files, or processes in Sophos Event Journals and Data Lake. Sophos says to use this type only when Sophos Support asks you to.
• Driver Detection (Windows): authorizes a detected driver. This type is only intended for Windows devices. The driver must have at least one valid signer other than Microsoft Windows Hardware Compatibility Publisher.

Ransomware and exploit mitigation

Ransomware Protection (Windows/Mac) only removes an application or folder from ransomware protection. Custom process exclusions aren’t available on macOS; use a folder or the application’s file path there. Windows can use Process or Folder. In Global Exclusions, a folder can use a local path or a UNC path such as \\servername\shared-folder\. In an Endpoint Threat Protection policy, only a local folder path is supported, not a remote UNC path.

Exploit Mitigation and Activity Monitoring (Windows) supports file-path-based application exclusions only. Under Mitigations, keep Protect Application switched on and deselect only the demonstrably disruptive mitigation. If Protect Application is switched off, all exploit checks for the application are eliminated; malware and ransomware checks remain in place. This wide step is the last option.

Exploit or ransomware exceptions have different variables than Windows scanning exceptions. For example, $ represents all available drives, $temp represents, among others, C:\Windows\Temp, $appdata represents AppData areas, $profile represents user profiles, and $windows represents C:\Windows. These variables are not confused with %TEMP% or other scan variables and are never adopted without checking their expanded scope. At the beginning of a path, only ** is supported as a wildcard.

IPS and device isolation

A Malicious Network Traffic Prevention (IPS) (Windows) exception limits Direction, Remote address, Remote port, and Local port; at least one address or port option must be set. Remote refers to the other computer, local refers to the protected endpoint. Local port 3389 is therefore relevant for incoming RDP for the admin case viewed in isolation; In addition, the exact remote address of the released administration device is set if only this device is to communicate.

A Device isolation exception allows limited communication despite isolation. For Inbound Connection, a local port such as 3389 for RDP or 22 for SSH makes this service accessible on the isolated device. With Outbound Connection, the remote address limits the target server, such as a server for cleanup tools. General internet sharing would defeat the purpose of isolation.

Allow false positives with the narrowest possible scope

Allow legitimate application

A verified safe application detected as a threat should not be allowed through a broad file-path exclusion. Depending on the platform, the following identities are available under My Environment > Computers & Servers > device > Events > detection > Details > Allow this application:

• Certificate is the Sophos recommendation, but also allows other applications with the same certificate. The publisher and certificate must therefore be correct.
• SHA-256 allows exactly this file version. A new detection may occur after an update.
• Path (Windows/Linux) allows application at the specified location. Forward slashes are required for Linux; Linux paths that are not UTF-8 encoded cannot be restored via this and require SHA-256.

Allow applies to all computers and users, prevents the same threat detection and can restore cleaned-up copies. Sophos still checks the application for exploits, ransomware, and malicious behavior when it runs. These entries are managed and removed again under Allowed Applications.

Detected exploits and ransomware

With a confirmed exploit false positive, Don’t detect this again offers two very different global actions:

1. Exclude this Detection ID from checking suppresses this behavior for the application. Different paths, files or behavior can produce a different detection ID.
2. Exclude this application from checking turns off all exploit checks for the application and is the riskiest final step.

Detection ID exceptions end up in Global Exclusions, application exceptions end up in Exploit Mitigation Exclusions. For a limited target group, the appropriate endpoint or server threat protection policy is opened instead and detection is selected under Settings > Exclusions > Add Exclusion > Detected Exploits (Windows/Mac). Other exploit checks in the application remain active.

With a confirmed ransomware false positive, the event only offers Exclude this Detection ID from checking. The action also creates a global exception for all users and computers. Hash, signature, process chain, affected files and reproducibility must therefore be checked before clicking.

Test, validate, and roll back

1. Before making the change, save the event, detection time and effective policy on the device.
2. Create the exception in a small, higher priority pilot policy. If it has to be global, initially only test it in a controlled maintenance window.
3. Wait until the pilot device communicates with Central again and check the applied policy name under My Environment > Computers & Servers > device > Policies.
4. Reproduce the original error while observing Events, Alerts and Health State. Success means: The documented fault disappears without another scope being released than planned.
5. Perform a negative test outside of the exception scope, such as with a non-excluded file or an unassigned test device. The protection there must react unchanged.
6. Only then expand the target group. Document responsible person, reason, compensating control and expiration date.
7. After a vendor or Sophos fix, remove the exception, repeat the original test and check for new events.

If the event simply disappears, it only proves that the test was bypassed. If the application remains disrupted, another module such as Exploit Mitigation, Web Control, Peripheral Control or DLP was probably involved. Then the exception is not expanded, but the new event type is examined.

If only a broad exclusion appears to work, the effective policy or syntax remains uncertain, or a confirmed false positive returns, roll back the pilot change and escalate to the software vendor or Sophos Support with the event, detection ID, timestamps, process chain and relevant diagnostic logs. Do not widen the exclusion while the cause remains unproven.

Operate existing exceptions

Global exclusions, allowed applications and the exceptions to the policies actually applied are checked at least quarterly. Entries without an owner, expired workarounds, applications that are no longer installed, duplicates and wildcards or variables that are too wide are removed.

The Account Health Check shows detected problems with global and policy exceptions. A score of 100 just means that this check found no problem; it replaces neither the technical justification nor the process and negative test.

Frequently Asked Questions