Cisco-Maintained Exclusion List Changes for Cisco Secure Endpoint Console

Available Languages

Download Options

  • PDF     (108.0 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (172.1 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (136.2 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:December 12, 2025
Document ID:214809

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Introduction

This document describes the changes added to the Cisco-Maintained Exclusions.

Cisco-Maintained Exclusions are created and maintained by Cisco to provide better compatibility between the Advanced Malware Protection (AMP) for Endpoints Connector and antivirus, security or other software, these exclusions can be added to new versions of an application.

Prerequisites

Requirements

Cisco recommends that you have knowledge of these topics:

  • Exclusions in AMP for Endpoints
  • AMP console

Components Used

The information in this document is based on these software and hardware versions:

  • AMP for Endpoints console version 5.4.20190820

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Expectations When You Update

Secure Endpoint Maintained Exclusions

When the Cisco-Maintained lists are changed, a policy update occurs on the backend to reflect that change.  As each of the Endpoints use that list check in on their heartbeat, they pull the updated policy.  These policy changes are not reflected in the audit log as it is technically a change to the exclusion list, not the policy itself, and Cisco-maintained exclusion lists do not exist within the normal audit log on individual consoles.  For large scale environments, this looks like a flood of policy updates and the end result will be better performance on each of the Endpoints. 

The update period depends on each endpoint.  If all the machines are online, the updates would take place within 1-2 heartbeats.  If this is a global environment, updates continue to occur as machines come online so don't be surprised to see additional policy updates 24-48 hours after the maintained list is pushed.

Changes

December 18th - 2024

VEEAM

Addition of:

  • CSIDL_PROGRAM_FILES\Veeam\Backup and Replication\Threat Hunter\

Cisco WebEx

Addition of:

  • CSIDL_LOCAL_APPDATA\WebEx\WebEx64\Meetings\webexmta.exe
  • CSIDL_PROGRAM_FILES\Cisco Spark\CiscoCollabHost.exe

Microsoft Windows Default

Small adjustment of existing process omadmclient.exe to include child processes.

June 4th - 2025

Microsoft Windows Default

addition of:

  • CSIDL_PROGRAM_FILES\Cisco\Cisco Secure Client\CM\*\CMID\*\csc_cmid.exe
  • CSIDL_PROGRAM_FILES\Cisco\Cisco Secure Client\CM\*\CMPM\*\csc_pm.exe
  • CSIDL_PROGRAM_FILES\Cisco\Cisco Secure Client\EVM\bin\csc_evm.exe
  • CSIDL_PROGRAM_FILES\Microsoft Device Inventory Agent\InventoryService\InventoryService.exe
  • CSIDL_PROGRAM_FILESX86\Cisco\Cisco Secure Client\NVM\acnvmagent.exe
  • CSIDL_COMMON_APPDATA\Cisco\Cisco Secure Client\EVM\*
  • CSIDL_PROGRAM_FILES\Microsoft Device Inventory Agent\InventoryService\

Apple macOS Default

addition of:

  • /opt/cisco/secureclient/evm/bin/csc_evm.app/Contents/MacOS/csc_evm
  • /Library/Cisco/evm/Log Files
  • /Library/Cisco/evm/Upload\ Queue/

September 17th - 2025

Microsoft Windows Default

addition of:

  • CSIDL_PROGRAM_FILES\Cisco\Forensics\AIR\**
  • CSIDL_PROGRAM_FILES\Cisco\Forensics\AIR\

Apple macOS Default

addition of:

  • /opt/cisco/forensics/air/
  • /opt/cisco/forensics/air/**
note-icon

Note: Windows Secure Endpoint Versions 8.4.0+ resolves pathing for all CSIDL exclusions.

December 17th - 2025

Microsoft Teams

addition of:

  • CSIDL_PROGRAM_FILES\WindowsApps\MSTeams_*\

February 4th - 2026

Microsoft Windows Default

addition of:

  • CSIDL_PROGRAM_FILESX86\Cisco\Cisco Secure Client\**

Microsoft Exchange Server

addition of: 

  • CSIDL_PROGRAM_FILES\Microsoft\Exchange Server\**

Appsense

addition of:

  • CSIDL_PROGRAM_FILES\AppSense\Environment Manager\Agent\EmSystem.exe

September 23 - 2026

Windows Default

addition of:

  • CSIDL_PROGRAM_FILES\Orbital\

Splunk - Windows

addition of:

  • CSIDL_PROGRAM_FILES\SplunkUniversalForwarder\bin\splunk-winevtlog.exe
  • CSIDL_PROGRAM_FILES\SplunkUniversalForwarder\bin\splunkd.exe

Hyper-V - Windows

addition of:

  • C:\ClusterStorage\

  • CSIDL_WINDOWS\Cluster\
  • CSIDL_WINDOWS\Cluster\clussvc.exe
  • CSIDL_WINDOWS\Cluster\rhs.exe

Revision History

Revision Publish Date Comments
5.0
12-Dec-2025
Removed previous update notes from 2019-2024.
4.0
20-Sep-2023
Added September 2023 Changes
3.0
22-Jun-2022
Added June 29th Changes
2.0
17-Mar-2022
Added March 23rd changes.
1.0
22-Sep-2021
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • Caly Hess
    Cisco AMP Escalations
  • Edited by Yeraldin Sanchez
    Cisco TAC Engineer

Was this Document Helpful?

FeedbackFeedback

Contact Cisco