Exclusion Type to Reduce False Positive Alerts in XYZ Company
Question
There are multiple false positive alerts generating in a company XYZ.
A security operations analyst working for XYZ needs to exclude an executable file to reduce alerts - c:\myxyzapp\myxyzwinapp.exe, which exclusion type must they use?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: C
File will exclude only this specific file whereas extension would exclude all files with the extensions and folder would exclude all files in a folder.
Registry exclusion doesn't happen.
Reference:
The correct exclusion type that the security operations analyst working for company XYZ should use to exclude the executable file c:\myxyzapp\myxyzwinapp.exe and reduce false positive alerts is "C. File".
Exclusion rules can be used to reduce the number of false positive alerts generated by a security tool. Exclusion rules specify files, folders, processes, or registry keys that should be ignored by the security tool. Excluding these items from scans can reduce the number of alerts generated by the tool and help focus the analyst's attention on more important alerts.
In this case, the security operations analyst needs to exclude a specific executable file, c:\myxyzapp\myxyzwinapp.exe, to reduce false positive alerts. To do this, they should create a file exclusion rule that specifies the path to the file. A file exclusion rule tells the security tool to ignore a specific file when scanning for threats.
An extension exclusion would exclude all files with a specific file extension, such as .docx or .pdf. A folder exclusion would exclude an entire folder and all its contents. A registry exclusion would exclude a specific registry key or value. However, in this case, the analyst needs to exclude a specific file, so a file exclusion is the most appropriate type of exclusion to use.
