Documentation forSecurity Event Manager

Create FIM file and directory exclusions

On the Applied conditions page, you can create, edit, delete, and import exclusions for a FIM file and directory connector.

  1. In the SEM Events Console, click the Nodes tab.
  2. Select an agent node, and then click Manage node connectors.
  3. Select a configured FIM file and directory connector, and then click Edit.
  1. On Applied conditions page toolbar, click Create exclusion.

  2. Enter a mask using the asterisk (*) as a wildcard, for example: *.exe or directory*.

    Directory* can be used as an exclusion, and it will exclude any file/folder that matches the name from monitoring. It will not exclude the contents of the directory from monitoring.

    For example, if there is directory named DirectoryContent with files content1.txt and content2.txt in it, modifications to the directory itself will not be monitored (for example, a permissions change), but changes to the files in that directory will be monitored. You cannot exclude files in specific folders from being monitored, other than set up inclusions to not watch the folder at all.

  3. Click Create.