Sign In with your
Trend Micro Account
Need Help?
Need More Help?

Create a technical support case if you need further support.

Preventing Behavior Monitoring False Detection in Deep Security

    • Updated:
    • 4 Nov 2019
    • Product/Version:
    • Deep Security 10.0
    • Deep Security 10.1
    • Deep Security 10.2
    • Deep Security 10.3
    • Deep Security 11.0
    • Deep Security 11.1
    • Deep Security 11.2
    • Deep Security 11.3
    • Deep Security 12.0
    • Platform:
    • N/A
Summary

When Behavior Monitoring is enabled, it may falsely detect some applications as suspicious or malicious, and then block it. If you have defined that the blocked application is a trusted resource, you can whitelist applications to avoid false detection.

Details
Public

To add the full path of an application to the Exception list, do the following:

  1. Login to the Deep Security web console.
  2. On the Policies tab, double-click a policy you want to configure.
  3. Click Anti-Malware in the left pane, and select Advanced tab.
  4. Under Behavior Monitoring Protection Exceptions, enter the full path of the application (i.e. C:\Program Files\Outlook\Outlook.exe) you want to exclude and then click Add.

Add the application's full path to Deep Security Behavior Monitoring Protection Exception List

If you have seen the detection under Events tab, you can simply right-click the event and click Allow to whitelist.

Allow the event to be whitelisted

An application can be submitted to Trend Micro Technical Support for verification and whitelisting. Once the application has been verified to be normal, it will be whitelisted to avoid further detection.

Software developers can apply for the Trend Micro GRID program where they can submit the application before public release. You may refer to The GRID: Goodware Resource and Information Database for more information.

Premium
Internal
Rating:
Category:
Configure; SPEC
Solution Id:
000152502
Feedback
Did this article help you?

Thank you for your feedback!

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.

If you need additional help, you may try to contact the support team. Contact Support

To help us improve the quality of this article, please leave your email here so we can clarify further your feedback, if neccessary:
We will not send you spam or share your email address.

*This form is automated system. General questions, technical, sales, and product-related issues submitted through this form will not be answered.