Cynet 360 enables you to list resources that are authorized to run in a user’s environment, for which Cynet 360 will not trigger an alert. It is recommended to whitelist known and legitimate resources to prevent false-positive alerts.As opposed to whitelisting, excluding an activity prevents it from being scanned by the Cynet agent entirely. Exclusion profiles can be applied to a wider set of parameters and are useful for third-party application running on your environment.A whitelist profile is based on a rule that combines an alert type, an alert parameter, and its value. For the whitelisting rule to be effective, it's crucial to understand by which parameter to whitelist. The same information can appear differently in different alerts, so creating a rule for a specific alert is preferable to a rule that applies to all alerts. See whitelisting examples below.There are two ways to create an whitelist profile:From a specific alert, in the Alert page.Cynet 360 automatically populates the profile parameters according to the selected alert.From the Settings page.Quick whitelisting (from an alert) allows whitelisting based on file path or sha256 only. When creating a whitelisting profile from the Settings page, you can create a whitelisting rule based on other alert parameters (such as process command line).To create a whitelist profile from an alert:In the Alert page, select an alert and click.In the Whitelist tab, enter a descriptive profile name. Under Whitelist By select if to whitelist the file path or file SHA256. To whitelist by other parameters, create a whitelisting profile from the Settings page.Whitelist For is populated according to the host and Group that triggered the alert. Select if to apply the profile to the host or the Scan Group.  If you do not select a check box, the whitelist profile applies to all protected endpoints.Click Create Profile.When whitelisting a file from a specific alert, you are preventing this specific alert type from being triggered for this file in the future. The file can still trigger different alert types. To create a whitelist profile from the Settings page:Navigate to Setting > Profiles > Whitelist Alerts.Enter a profile name and description.In the top-right corner, click Create.From the list of alert names, select the alert for which to create a whitelist rule.The Type dropdown list is populated with parameters according to the alert you selected.From the Type dropdown list, select an alert parameter. Additional Field are parameters listed under Extra Info in the alert description (see image above).Enter the parameter value and click +.  Repeat steps 4-6 to create additional rules. OR is applied between rules in the same profile.You cannot use wildcards in whitelisting profiles.If you want to apply the whitelist profile to specific Groups or endpoints, select these from the Group and Hosts dropdown lists. If no Groups/endpoints are specified, the rule applies to all protected endpoints.Click Save.The Whitelist rule is set. Alerts that match the rule are not generated.Whitelisting ExamplesWhitelisting directly from an alert by file path or SHA256: Useful for alerts triggered by a file, such as File Dumped on Disk. Whitelisting based on other alert parameters: For example, in case of a Powershell Malicious Command alert, the parameter for whitelisting is the command line. Create the following whitelisting rule: