Exclude directories from running process-based discovery
Exclude specific directories from running process-based discovery so that processes running from those locations aren't recorded or included in File-Based Discovery scans.
Before you begin
Running process-based discovery must be enabled. For details, see Enable running process-based discovery.
Role required: disco_admin
About this task
Some running processes have no Software Asset Management (SAM) value and only add noise to discovery output, such as security tooling or the agent's own processes. Use the FBD Process Path Exclusions [sn_acc_vis_content_fbd_proc_path_exclude] table to prevent those directories from being recorded. A set of common exclusions is included in the base system.
Procedure
Navigate to the FBD Process Path Exclusions [sn_acc_vis_content_fbd_proc_path_exclude] table.
Select New.
Complete the fields for the exclusion record.
Field Description Path Absolute directory prefix to exclude. Any process running from this directory or a subdirectory of it is ignored. Platform Operating system the exclusion applies to: Windows or Unix. Unix covers Linux and macOS. There is no combined option; specify the platform explicitly. Active When selected (the default), the exclusion is enforced. Clear this check box to disable the exclusion temporarily without deleting the record. Description Optional notes describing the purpose of the exclusion. Select Submit.
Result
The exclusion is pushed to the relevant agents automatically. New collection cycles skip the excluded directories. Any previously collected paths that match the exclusion are removed during the next daily maintenance cycle.
Parent Topic:Running process-based discovery