Endpoint Global Settings - Part Deux

Three months ago we released our first set of APIs to manage endpoint-related global settings, specifically, allowed/blocked items, web control settings, and global tamper-protection. We now have a second set of routes available in the Endpoint API to allow you to manage some additional global settings: scanning exclusions and Exploit Mitigation settings. Read on for how to use these new APIs.

Add a new scanning exclusion¶

In Central Admin, you can add scanning exclusions through the Global Exclusions section under Global Settings.

You can now use the Endpoint API to exclude files or folders, processes, websites, Potentially Unwanted Applications (PUAs), applications that have previously been detected as exploits, and applications that are checked using the Windows Antimalware Scanning Interface (AMSI).

For example, to exclude all files in the folder C:\Program Data\Acme\MyITApp\db from all real-time and scheduled scans, use this API call:

POST /endpoint/v1/settings/exclusions/scanning

Request body:

{
  "value": "C:\\Program Data\\Acme\\MyITApp\\db",
  "type": "path",
  "scanMode": "onAccessAndOnDemand",
  "comment": "Excluding MyITApp database from Sophos scanning"
}

Only "value" and "type" are required in the request above. The response is a scanning exclusion object.

{
  "id": "11b79eb7-68d3-4098-9124-6c0928602042",
  "value": "C:\\Program Data\\Acme\\MyITApp\\db",
  "type": "path",
  "scanMode": "onAccessAndOnDemand",
  "comment": "Excluding MyITApp database from Sophos scanning"
}

See the API reference for details on how to list, update, and delete scanning exclusions.

List detected exploits¶

You can add a scanning exclusion for a previously detected exploit by passing the unique signature (thumbprint) for that detection to the API above.

To get that thumbprint, first list the detected exploits, like so:

GET /endpoint/v1/settings/exploit-mitigation/detected-exploits

The response is a page of detections reported by the Exploit Mitigation component of our endpoint agent.

{
  "items": [
    {
      "id": "ad82690f-2c3d-46d6-8bb7-07bf155b4aca",
      "thumbprint": "00f76dcfecffd82a4a78696d531cb8b925c20cdec735061dd2a389ee2561d9c2",
      "count": 12,
      "description": "CryptoGuard detected ransomware in C:\\Users\\johndoe\\Desktop\\SophosTester.exe",
      "lastSeenAt": "2019-12-11T16:07:34.000Z"
    },
    {
      "id": "8faa345d-73af-4e0a-afe0-0e1fdf2e3dd0",
      "thumbprint": "05a1b871d8c648c211509b948168e2f428f72db1ca93ca4d982056427cf998e2",
      "count": 1,
      "description": "'ROP' exploit prevented in Firefox",
      "lastSeenAt": "2020-03-29T07:28:41.000Z"
    },
    // ... other items
  ],
  "pages": {
    "current": 1,
    "size": 50,
    "maxSize": 100
  }
}

Then, to suppress a specific detection, say, the ROP exploit above:

POST /endpoint/v1/settings/exclusions/scanning

Request body:

{
  "value": "05a1b871d8c648c211509b948168e2f428f72db1ca93ca4d982056427cf998e2",
  "type": "detectedExploit",
  "scanMode": "onAccess",
  "comment": "Excluding ROP exploit triggered in Firefox by my custom extension"
}

Customize an application for Exploit Mitigation¶

We have added new routes to allow you to customize settings for the Exploit Mitigation endpoint functionality. You can retrieve a list of all the applications, those detected by the endpoint agent, as well as custom one. Each application belongs to a category of applications, with its own set of settings. You can fetch the list of application categories using this API.

Customizing the Exploit Mitigation functionality for a specific application is as simple as:

POST /endpoint/v1/settings/exploit-mitigation/applications

Pass the path to the application in the request body:

{
  "paths": [
    "C:\\Users\\johndoe\\Desktop\\MyApp.exe"
  ]
}

This adds a new application of type "custom" and category "other". Only one path may be passed to this API at this time. See the API documentation for more details.

You can easily update or delete this custom application. You can modify applications detected by the Exploit Mitigation component on the endpoint using this PATCH API.

Please try out these new APIs and send us feedback through your account manager or join the conversation on our community forum.