Skip to content
Binalyze Knowledge Base

Responder Exception Rules for EPP and EDR

Overview

Section titled “Overview”

AIR Responders run acquisition tools, create temporary artifacts, and access protected areas of the file system. Endpoint Protection Platform (EPP), Endpoint Detection and Response (EDR), and antivirus products can identify this expected activity as suspicious and interrupt evidence collection.

Add the folder and binary exclusions for each operating system used in your deployment. After saving the rules, follow Validate the exclusions.

Windows

Section titled “Windows”

Folders to exclude

Section titled “Folders to exclude”
  • C:\Program Files (x86)\Binalyze\AIR\agent\
  • C:\ProgramData\.binalyze-air

Binaries to exclude

Section titled “Binaries to exclude”
  • C:\Program Files (x86)\Binalyze\AIR\agent\AIR.exe
  • C:\Program Files (x86)\Binalyze\AIR\agent\DRONE.exe
  • C:\Program Files (x86)\Binalyze\AIR\agent\TACTICAL.exe
  • C:\ProgramData\.binalyze-air\WATCHDOG.exe
  • C:\Program Files (x86)\Binalyze\AIR\agent\utils\curl.exe
  • C:\Program Files (x86)\Binalyze\AIR\agent\utils\osqueryi.exe

Linux

Section titled “Linux”

Folders to exclude

Section titled “Folders to exclude”
  • /opt/binalyze/air/agent/
  • /usr/share/.binalyze-air/

Binaries to exclude

Section titled “Binaries to exclude”
  • /opt/binalyze/air/agent/air
  • /opt/binalyze/air/agent/drone
  • /opt/binalyze/air/agent/tactical
  • /opt/binalyze/air/agent/utils/osqueryi
  • /opt/binalyze/air/agent/utils/curl
  • /usr/share/.binalyze-air/watchdog

macOS

Section titled “macOS”

Folders to exclude

Section titled “Folders to exclude”
  • /opt/binalyze/air/agent/
  • /usr/local/share/.binalyze-air/

Binaries to exclude

Section titled “Binaries to exclude”
  • /opt/binalyze/air/agent/air
  • /opt/binalyze/air/agent/drone
  • /opt/binalyze/air/agent/tactical
  • /opt/binalyze/air/agent/utils/osqueryi
  • /opt/binalyze/air/agent/utils/curl
  • /usr/share/.binalyze-air/watchdog

When an exclusion does not cover subdirectories

Section titled “When an exclusion does not cover subdirectories”

Security products interpret path separators and wildcards differently. In uncommon product-specific cases, a rule that uses a recursive wildcard may still leave immediate subdirectories in scope for scanning, detection, or blocking. Adding a separate, explicit rule for the affected path can resolve the issue.

Check for this behavior when detections continue after you save an exclusion.

Use the folder locations listed above and express them in the syntax required by your security product. Common pattern forms include:

  • Anchored Windows path: C:\Program Files (x86)\Binalyze\AIR\agent\**
  • Windows path without a drive letter: Program Files (x86)\Binalyze\AIR\agent\**
  • Windows path with a wildcard prefix: **\Binalyze\AIR\agent\**
  • Anchored Unix path: /opt/binalyze/air/agent/**
  • Unix path with a wildcard prefix: **/binalyze/air/agent/**

A path beginning with a drive letter or / is typically anchored to that location. A Windows path without a drive letter is relative, while a path beginning with ** can match under any parent directory. A trailing ** commonly makes the rule recursive; a single * often matches only one path segment.

Support for \, /, environment variables, recursive wildcards, and case-sensitive matching varies by product. A folder exclusion also may not cover processes whose image path is under that folder or child processes they launch.

Validate the exclusions

Section titled “Validate the exclusions”
  1. Add exclusions for the folders and binaries listed for your operating system.
  2. Configure each folder rule to include subdirectories. If the product provides an option to apply the exclusion to descendant or child processes, enable it.
  3. Save or assign the policy and wait for the provider-recommended propagation time.
  4. Restart the asset if the security product requires a reboot before updated exclusions take effect.
  5. Run a controlled AIR task. Confirm that the task completes and the expected evidence is uploaded, then check the security product’s detection, quarantine, and event views for new entries that reference the excluded paths or binaries.
  6. If detections continue, verify that immediate subdirectories are covered. Add a separate, explicit rule for the affected path and test again.

Contact your EPP, EDR, or antivirus provider if the behavior still differs from its documented matching rules.

Section titled “Related articles”