Exclusions for ENSM Threat Prevention:
When configuring exclusions, a single asterisk (*) is used to represent a single folder or multiple folders. For example, /Users/*/myfolder/ would exclude the following folders:

/Users/folder1/myfolder/
/Users/folder1/folder2/myfolder/

NOTE: The forward slash character (/) that precedes the ePolicy Orchestrator (ePO) commands is needed when you apply these policies from ePO because of the check that ePO performs.

To exclude specific folders under the user's profile using regular expressions from ePO:

/Users/*/<your folder path>/*

To exclude Virtual Machine Disk (VMDK) files residing anywhere on the Mac system:

/*.vmdk

To exclude any file based on extension:

/*.(ext)

To exclude .log files from scanning:

/*.log

To exclude multiple files based on extensions:

/*.(log|ext)

To exclude each user's Outlook files for Microsoft Outlook 2016:

           /Users/*/Library/Group Containers/UBF8T346G9.Office/Outlook/Outlook 15 Profiles/*

To exclude each user's Outlook files for Microsoft Outlook 2011:

           /Users/*/Documents/Microsoft User Data/Office*Identities/* Identity/*

To exclude all Info.plist and version.plist files under /Applications:

/Applications/*/Contents/(version|Info).plist

To exclude files with the extension .jar, .rar, or .war under /private/var/tmp:

/private/var/tmp/*.?ar

To exclude files under /private/var/tmp starting with an alpha character and ending with a numeral:

/private/var/tmp/([A-Z]|[a-z])*[0–9]$

Exclusions for VSMac:
When configuring exclusions, a single asterisk (*) is used to represent a single folder or multiple folders. For example, /Users/*/myfolder/ would exclude the following folders:

/Users/folder1/myfolder/
/Users/folder1/folder2/myfolder/

NOTE: The forward slash character (/) that precedes the ePO commands is needed when you apply these policies from ePO because of the check that ePO performs.

To exclude specific folders under the user's profile using regular expressions from ePO:

/Users/.*/<your folder path>/.*

To exclude VMDK files residing anywhere on the Mac system:

.*\.vmdk - locally
/.*\.vmdk - from ePO

To exclude any file based on extension:

.*\.ext - locally
/.*\.ext - from ePO

To exclude .log files from scanning:

.*\.log - locally
/.*\.log - from ePO

To exclude multiple files based on extensions:

.*\.(log|ext) - locally
/.*\.(log|ext) - from ePO

To exclude each user's Outlook Database files for Microsoft Office 2011:

/Users/.*/Documents/Microsoft\ User\ Data/Office\ \d+\ Identities/.*Identity/.*

To exclude all Info.plist and version.plist files under /Applications:

/Applications/.*/Contents/(version|Info).plist

To exclude files with the extension .jar, .rar, or .war under /private/var/tmp:

/private/var/tmp/.*\..+ar

To exclude files under /private/var/tmp starting with an alpha character and ending with a numeral:

/private/var/tmp/([A-Z]|[a-z]).*[0–9]$