Skip to content

Update application

PATCH/settings/exploit-mitigation/applications/{exploitMitigationApplicationId}

Endpoint API · Exploit Mitigation

Update Exploit Mitigation settings for an application.

Required permissionendpoint-state:update

Parameters

Name In Type Required Description
X-Tenant-ID header string (uuid) Yes Tenant ID.
exploitMitigationApplicationId path string (uuid) Yes Exploit Mitigation application ID.

Request body

Content type: application/json

Request body fields

pathsarray of string
Array of absolute paths to an application file to exclude. You may use HitmanPro.Alert expansion variables (For example, $desktop, $programfiles). Currently, this array may contain only one application path when modifying custom applications, detected applications may contain more than one path but you can't modify them.
Must contain exactly 1 item. Each item must be 1–260 characters long.
modificationsobject
Modifications made to the detected Exploit Mitigation Application. This object does not apply when type is custom. Note that you can pass in one or more settings that apply to the category of this application, any settings that don't apply are disallowed and return a Bad Request.
Show child attributesHide child attributes
protectedboolean
Whether or not this Exploit Mitigation Application is protected.
settingsobject

Request samples

curl -X PATCH "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications/<exploitMitigationApplicationId>" -H "Authorization: Bearer <access-token>" -H "X-Tenant-ID: <tenant-id>" -H "Content-Type: application/json" -d "{
  \"paths\": [
    \"\$programfiles\\\\FooApp\\\\foo.exe\"
  ],
  \"modifications\": {
    \"protected\": true,
    \"settings\": {
      \"ASLR\": true,
      \"BannedAPI\": true,
      \"BottomUpASLR\": true,
      \"DEP\": true,
      \"DeviceAndIoControl\": true,
      \"HeapSpray\": false,
      \"IAF\": true,
      \"Intruder\": false,
      \"KbdGuard\": false,
      \"LoadLib\": false,
      \"LockdownAutorun\": true,
      \"LockdownLoadImage\": false,
      \"LockdownNewFile\": true,
      \"NullCheck\": true,
      \"PreventEtwTampering\": true,
      \"SEHOP\": true,
      \"Caller\": true,
      \"StackExec\": true,
      \"StackPivot\": true
    }
  }
}"


import requests

response = requests.patch(
    "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications/<exploitMitigationApplicationId>",
    headers={
        "Authorization": "Bearer <access-token>",
        "X-Tenant-ID": "<tenant-id>",
        "Content-Type": "application/json",
    },
    json={   'paths': ['$programfiles\\FooApp\\foo.exe'],
    'modifications': {   'protected': True,
                         'settings': {   'ASLR': True,
                                         'BannedAPI': True,
                                         'BottomUpASLR': True,
                                         'DEP': True,
                                         'DeviceAndIoControl': True,
                                         'HeapSpray': False,
                                         'IAF': True,
                                         'Intruder': False,
                                         'KbdGuard': False,
                                         'LoadLib': False,
                                         'LockdownAutorun': True,
                                         'LockdownLoadImage': False,
                                         'LockdownNewFile': True,
                                         'NullCheck': True,
                                         'PreventEtwTampering': True,
                                         'SEHOP': True,
                                         'Caller': True,
                                         'StackExec': True,
                                         'StackPivot': True}}},
)
print(response.json())


$headers = @{
    "Authorization" = "Bearer <access-token>"
    "X-Tenant-ID" = "<tenant-id>"
    "Content-Type" = "application/json"
}
$body = '{
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ],
  "modifications": {
    "protected": true,
    "settings": {
      "ASLR": true,
      "BannedAPI": true,
      "BottomUpASLR": true,
      "DEP": true,
      "DeviceAndIoControl": true,
      "HeapSpray": false,
      "IAF": true,
      "Intruder": false,
      "KbdGuard": false,
      "LoadLib": false,
      "LockdownAutorun": true,
      "LockdownLoadImage": false,
      "LockdownNewFile": true,
      "NullCheck": true,
      "PreventEtwTampering": true,
      "SEHOP": true,
      "Caller": true,
      "StackExec": true,
      "StackPivot": true
    }
  }
}'
Invoke-RestMethod -Method PATCH -Uri "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications/<exploitMitigationApplicationId>" -Headers $headers -Body $body -ContentType "application/json"


package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    req, err := http.NewRequest("PATCH", "https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications/<exploitMitigationApplicationId>", strings.NewReader(`{
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ],
  "modifications": {
    "protected": true,
    "settings": {
      "ASLR": true,
      "BannedAPI": true,
      "BottomUpASLR": true,
      "DEP": true,
      "DeviceAndIoControl": true,
      "HeapSpray": false,
      "IAF": true,
      "Intruder": false,
      "KbdGuard": false,
      "LoadLib": false,
      "LockdownAutorun": true,
      "LockdownLoadImage": false,
      "LockdownNewFile": true,
      "NullCheck": true,
      "PreventEtwTampering": true,
      "SEHOP": true,
      "Caller": true,
      "StackExec": true,
      "StackPivot": true
    }
  }
}`))
    if err != nil {
        panic(err)
    }
    req.Header.Set("Authorization", "Bearer <access-token>")
    req.Header.Set("X-Tenant-ID", "<tenant-id>")
    req.Header.Set("Content-Type", "application/json")

    resp, err := http.DefaultClient.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    body, _ := io.ReadAll(resp.Body)
    fmt.Println(string(body))
}


const response = await fetch("https://api-<data-region>.central.sophos.com/endpoint/v1/settings/exploit-mitigation/applications/<exploitMitigationApplicationId>", {
  method: "PATCH",
  headers: {
    "Authorization": "Bearer <access-token>",
    "X-Tenant-ID": "<tenant-id>",
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
  "paths": [
    "$programfiles\\FooApp\\foo.exe"
  ],
  "modifications": {
    "protected": true,
    "settings": {
      "ASLR": true,
      "BannedAPI": true,
      "BottomUpASLR": true,
      "DEP": true,
      "DeviceAndIoControl": true,
      "HeapSpray": false,
      "IAF": true,
      "Intruder": false,
      "KbdGuard": false,
      "LoadLib": false,
      "LockdownAutorun": true,
      "LockdownLoadImage": false,
      "LockdownNewFile": true,
      "NullCheck": true,
      "PreventEtwTampering": true,
      "SEHOP": true,
      "Caller": true,
      "StackExec": true,
      "StackPivot": true
    }
  }
}),
});
const data = await response.json();
console.log(data);

Responses

200 — Exploit Mitigation exclusion updated.

Response fields

idstring (uuid)required
ID of an Exploit Mitigation application.
namestringrequired
Name of this Exploit Mitigation application.
Must be 1–1000 characters long.
pathsarray of stringrequired
Paths included in this Exploit Mitigation application.
Must contain at most 100 items. Each item must be 1–260 characters long.
categorystringrequired
Exploit Mitigation category ID.
Must be one of: browsers, exclude, java, media, office, plugins, test, other.
typestringrequired
Whether the application was detected by the system or added by the user.
Must be one of: detected, custom.
modificationsobject
Modifications made to the detected Exploit Mitigation Application. This object does not apply to when type is custom.
Show child attributesHide child attributes
protectedbooleanrequired
Whether or not this Exploit Mitigation Application is protected.
settingsobject

Errors

Status Meaning
400 Bad request.
500 Unexpected error.

All error responses share the same shape — see the error response object.

Response examples

200

{
  "id": "00000000-0000-0000-0000-000000000000",
  "name": "string",
  "paths": [
    "string"
  ],
  "category": "browsers",
  "type": "detected",
  "modifications": {
    "protected": true,
    "settings": {
      "ASLR": true,
      "BannedAPI": true,
      "BottomUpASLR": true,
      "Caller": true,
      "DEP": true,
      "DeviceAndIoControl": true,
      "HeapSpray": true,
      "IAF": true,
      "Intruder": true,
      "KbdGuard": false,
      "LoadLib": true,
      "LockdownAutorun": true,
      "LockdownLoadImage": false,
      "LockdownNewFile": false,
      "NullPage": true,
      "PreventEtwTampering": true,
      "SEHOP": true,
      "StackExec": true,
      "StackPivot": true
    }
  }
}

See the guide for a narrative walkthrough of this API.