Creating an Exception Set

Jamf Protect Documentation
Solution
Application
Content Type
Technical Documentation
Utilities & Services
ft:locale
en-US

You can create a new exception set from a blank form, or you can clone an existing exception set and modify it to suit your needs.

Note:

A Jamf-managed exception set that is cloned becomes a user exception set and will no longer receive updates for Jamf-managed exceptions.

  1. In Jamf Protect, click Plans.
  2. Click the Exception Sets tab.
    Note:

    To clone an exception set, select the desired exception set. On the Exception Set screen, click Clone in the upper-right.

  3. Click Create Exception Set at the top of the screen.
  4. Complete the Name field.
  5. In the Total Rules section, click Add.
  6. Choose one of the following exception types from the pop-up menu:
    • Override Threat Prevention — Provides management capabilities to allow execution of processes that would otherwise be blocked by Threat Prevention.
      Note:

      This is an exception to Jamf Protect's managed malware feed.

    • Ignore System Events for Analytics —Provides management capabilities to optimize performance of the agent by ignoring trusted locations or processes on a monitor-wide basis. Select a system event from the pop-up menu.
    • Ignore for Analytic —Provides management capabilities to reduce noise of trusted activity on a per-analytic basis. Select an analytic from the pop-up menu.
    • Ignore for Telemetry —Provides management capabilities to reduce noise of trusted activity for telemetry.
    • Ignore for Telemetry (Deprecated) —Provides management capabilities for use with the deprecated version of telemetry.
  7. Click Add to add the rule.
  8. In the Rules section, choose one of the following identifiers from the pop-up menu and complete the field:

    File Path
    The location of an item starting at the root of the file system. Wildcards are supported to implement exceptions for File Path. The following are examples of a File Path:
    /tmp/log/*
/Users/*/Pictures/Photos Library.photoslibrary/resources/*
*/Library/Cookies/Cookies.binarycookies*
    Note:

    File Path exceptions will only apply to the following event monitors:

    • File System Event

    • Download System Event

    • Screenshot System Event

    App Signing Info
    An application's identifier, such as com.apple.calculator. Signing ID requires both a Team ID and an App ID or Signing ID. This only applies to Threat Prevention, Process, File, Click, and Keylogger events.

    Both the App ID and Signing ID of an application can be found by running the codesign command in a terminal window; for example, codesign -dv /Applications/JamfProtect.app.

    The following are examples of Signing IDs:
    Example:

    • App ID: com.jamf.protect.daemon

    • Jamf Team ID: 483DWKW443

    Platform Binary
    A Platform Binary is built into macOS and is specially signed by Apple. These specially signed binaries do not have an associated Team ID, and are referenced by the App ID, such as com.apple.calculator. The App ID of a Platform Binary can be found by running the codesign -dvv /System/Applications/Calculator.app command in a terminal window.
    The following are examples of the Platform Binary:
    com.apple.calculator
com.apple.news.widget
com.apple.photolibrary
    Team ID
    A unique code issued by Apple that identifies an application developer in the signed certificate. Team IDs are alphanumeric, for example 526FTYP998. This only applies to Threat Prevention, Process, File, Click, and Keylogger events.
    Process Path
    The full path to an application or binary. The path is responsible for the system event or activity targeted by an exception, such as File, Keylogger, and Click events, or to the application itself being launched (process event) or prevented (Threat Prevention). Wildcards are supported to implement exceptions for Process Path.

    The following are examples of a Process Path:

    /Applications/1Password\7.app
/System/Applications/Calculator.app
/Applications/ThisApp.app
    User
    The local account name responsible for generating the event on the monitored computer. This can include system accounts.
    Example:
    User account
    janet.smith
    System account
    jamfpro
    Group
    The local group name responsible for generating the event on the monitored computer.
    Example:
    Group account
    threat.analysts
    System account
    jamfprotect
    Note:

    File Path and Process Path exceptions provide support for the following Unix shell wildcards.

    PatternDescription
    *Matches everything
    ?Matches any single character
    [seq]Matches any character in seq
    [!seq]Matches any character not in seq

    Unix shell wildcards and Regular Expressions are similar, however the two are not explicitly interchangeable. For a literal match, wrap the meta-character in brackets. Typing [*] matches the character * instead of using it as a wildcard. For example, to match Application/Data/*profiletemplate enter Application/Data/[*]profiletemplate .

  9. (Optional) Click Add Rule to configure additional rules.

    Exception Sets can contain up to 1000 rules.

  10. Click Save.