Whitelisting the Cyrisma Agent in Common Endpoint Protection Platforms

The Cyrisma Agent runs continuous vulnerability monitoring, configuration audits, and other authorized security operations on your endpoints. Your endpoint protection platform (EDR or antivirus) may see this activity as suspicious and block it. Adding the right exclusions keeps the agent running normally.

This article gives you:

1. The Cyrisma Agent paths and processes for each operating system.

2. General recommendations for building safe, narrow exclusions.

3. Step-by-step procedures for common endpoint protection platforms.

4. A short checklist to confirm the exclusions are working.

Related articles:

• Global Agent Requirements

1. Cyrisma Agent Paths and Processes

Depending on your platform, add the Cyrisma installation directory, executables, or processes to the appropriate exclusion or allowlist policy. Use the values that match the endpoint's operating system.

Windows

Linux

macOS

Note: You do not need to exclude the Cyrisma working or log directories.

Tie processes to their path

If your platform supports path-based process rules, link each process to its installation path or application. Do not create a broad, name-only process exclusion. This matters most for osqueryd, because other applications may also use a process with that name.

2. General Recommendations

• Match the operating system. Use the values from Section 1 for the endpoint's OS.

• Limit the scope. Apply exclusions only to endpoints running the Cyrisma Agent.

• Keep it narrow. Use the narrowest exclusion your endpoint protection platform supports.

• Test first. Try the policy on a small group of endpoints before you deploy it broadly.

• Start with the folder. Add executable or process exclusions only if a folder exclusion does not stop the interference.

3. Platform Procedures

Platforms are listed alphabetically. Menu names come from each vendor's console and may vary by version.

Bitdefender GravityZone

CrowdStrike Falcon

ESET PROTECT

Huntress (Windows)

Malwarebytes Nebula

Microsoft Defender Managed Through Intune (Windows)

SentinelOne

Sophos Intercept X

ThreatLocker (Windows)

Trend Micro Apex One (Windows)

Webroot Business Endpoint Protection (Windows)

Bitdefender GravityZone

Create an antimalware folder exclusion for the Cyrisma Agent installation directory.

1. Sign in to GravityZone Control Center.

2. Go to Policies.

3. Open the policy assigned to the endpoints running the Cyrisma Agent.

4. Go to Antimalware > Settings.

5. Find Exclusions.

6. Select Add.

7. Select Folder (or the matching path-based exclusion type).

8. Enter the Cyrisma Agent installation directory for the endpoint's OS.

9. Enable the exclusion for the required scan types.

10. Save the exclusion and the policy.

If Bitdefender still blocks agent activity, create process exclusions using the executable or process values from Section 1.

CrowdStrike Falcon

Create a Sensor Visibility Exclusion for the Cyrisma Agent installation directory.

1. Sign in to the Falcon console.

2. Go to Endpoint Security > Configure > Sensor Visibility Exclusions.

3. Select Create exclusion.

4. Select the endpoint operating system.

5. Enter the Cyrisma Agent installation directory, using the pattern format CrowdStrike requires.

6. Assign the exclusion to the host groups that contain the Cyrisma Agent.

7. Enter a name and description.

8. Save the exclusion.

For Windows, the exclusion pattern can be:

C:\Program Files\CyrismaAgent\**

If you need a process-specific rule, use the executable or process values from Section 1.

ESET PROTECT

Create a file and folder exclusion for the Cyrisma Agent installation directory.

1. Sign in to ESET PROTECT.

2. Go to Policies.

3. Open the policy assigned to the endpoints running the Cyrisma Agent.

4. Select Settings.

5. Open the detection engine or real-time file system protection settings.

6. Find the performance exclusions or the file and folder exclusions.

7. Add the Cyrisma Agent installation directory for the endpoint's OS.

8. Save the policy.

9. Confirm the policy is assigned to the required endpoints.

If needed, add the Cyrisma executable or process through the matching ESET exclusion settings.

Huntress

Applies to Windows endpoints.

If you are using Huntress Managed Antivirus or Managed Microsoft Defender Antivirus, create organization-level exclusions for the Cyrisma Agent path and processes.

Path to exclude:
C:\Program Files\CyrismaAgent\

Processes to exclude:
C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe

Steps:

1. Log in to the Huntress Portal.

2. From the home page, navigate to Managed Antivirus.

3. Select Create Exclusion Settings.

4. Select Create Organization Exclusion Settings.

5. Select the managed organizations you want to apply the exclusion to.

6. Add an exclusion type of Path and enter:
   C:\Program Files\CyrismaAgent\

• If needed, you can instead add the specific Cyrisma Agent executables.

7. Add a separate exclusion of type Process for each of the following executables:
   C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe

8. Save the exclusion settings.

Malwarebytes Nebula

Create Allow List entries for the Cyrisma Agent.

1. Sign in to Malwarebytes Nebula.

2. Go to Configure > Allow List.

3. Select New.

4. Select File or folder.

5. Enter the Cyrisma Agent installation directory for the endpoint's OS.

6. Select the operating system and the exclusion options your policy requires.

7. Assign the exclusion to the appropriate groups.

8. Save the entry.

If required, create additional entries for the executable or process values from Section 1.

Microsoft Defender Managed Through Intune

Applies to Windows endpoints.

Create antivirus exclusions for the Cyrisma Agent installation directory and processes.

1. Sign in to the Microsoft Intune admin center.

2. Go to Endpoint security > Antivirus.

3. Open an existing Microsoft Defender Antivirus policy, or create a new one.

4. Go to Configuration settings.

5. Find Excluded Paths.

6. Add:

   C:\Program Files\CyrismaAgent\
   

7. Find Excluded Processes.

8. Add:

   C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
   C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe
   

9. Assign the policy to the device groups that contain the Cyrisma Agent.

10. Review and save the policy.

SentinelOne

Create a path exclusion for the Cyrisma Agent installation directory.

1. Sign in to the SentinelOne Management Console.

2. Select the required scope.

3. Go to Sentinels > Exclusions.

4. Select New Exclusion.

5. Select Path.

6. Select the endpoint operating system.

7. Enter the Cyrisma Agent installation directory for that OS.

8. Select the exclusion mode recommended by your SentinelOne administrator.

9. Enter a description.

10. Save the exclusion.

If the agent is still blocked, create additional process exclusions using the executable or process values from Section 1.

Legacy navigation: If your console uses the older layout, go to Policy > Exclusions and create the same exclusions there.

Sophos Intercept X

Create a scanning exclusion for the Cyrisma Agent installation directory.

1. Sign in to Sophos Central.

2. Go to Endpoint Protection.

3. Open Policies.

4. Select the threat protection policy assigned to the endpoints.

5. Open the scanning exclusion settings.

6. Select Add Exclusion.

7. Select the appropriate file or folder exclusion type.

8. Enter the Cyrisma Agent installation directory for the endpoint's OS.

9. Save the exclusion and the policy.

If an executable-specific protection still interferes with the agent, add the executable or process through the matching Sophos application or mitigation policy.

ThreatLocker

Applies to Windows endpoints.

Create an allow policy for the Cyrisma Agent installation directory and executables.

1. Sign in to the ThreatLocker portal.

2. Go to Application Control.

3. Select the organization that contains the endpoints.

4. Create an application or path-based allow policy.

5. Add this installation directory:

   C:\Program Files\CyrismaAgent\
   

6. Add these executables:

   C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
   C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe
   

7. Assign the policy to the required computers or computer groups.

8. Set the action to Permit.

9. Save and deploy the policy.

For Linux or macOS endpoints, check with your ThreatLocker administrator before creating equivalent policies.

Trend Micro Apex One

Applies to Windows endpoints.

Create scan exclusions for the Cyrisma Agent installation directory and executables.

1. Sign in to the Apex One console.

2. Go to Policies > Policy Management.

3. Open the policy assigned to the endpoints.

4. Go to Real-Time Scan Settings.

5. Find Scan Exclusions.

6. Add this directory:

   C:\Program Files\CyrismaAgent\
   

7. If required, add these files:

   C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
   C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe
   

8. Apply the exclusions to the required scan types.

9. Save and deploy the policy.

Webroot Business Endpoint Protection

Applies to Windows endpoints.

Create folder and file overrides for the Cyrisma Agent.

1. Sign in to the Webroot Management Console.

2. Select the required site.

3. Go to Overrides.

4. Create a new file or folder override.

5. Add this installation directory:

   C:\Program Files\CyrismaAgent\
   

6. If required, add these executables:

   C:\Program Files\CyrismaAgent\CyrismaAgent.Windows.exe
   C:\Program Files\CyrismaAgent\CyrismaPatchingExecutor.Worker.Windows.exe
   

7. Set the determination or action to Good or Allow.

8. Assign the override to the required endpoints.

9. Save the override.

4. Verify the Exclusions

After you deploy the exclusions:

1. Confirm the policy has reached the endpoint.

2. Check that the Cyrisma Agent service is running.

3. Confirm the endpoint is checking in to Cyrisma.

4. Review your endpoint protection console for any detections involving the Cyrisma Agent.

5. Watch an authorized Cyrisma operation to confirm the agent works correctly.

Still blocked? Review the event details in your endpoint protection console. They will show which path or process needs an additional product-specific policy.