Memory actions

This setting specifies whether to enable memory protection settings in this policy. When enabled, the agent detects various types of process calls that may be a threat and handles each type according to the setting that you choose.

This setting specifies the relative path of the files that you want to ignore.  When files are added to this exclusion list, you allow them to run or be installed on devices that are assigned this policy.

You specify the relative path of the file and the violation types that you want to ignore. On

Windows

devices, you can also specify the absolute file path. Use shortened relative paths with caution because it may exclude other executables that have the same relative path.

After applying the exclusion, all instances of that process must be terminated to stop the driver from injecting into it.

You can can also use wildcards for memory protection exclusions. For more information, see Wildcards in memory protection exclusions.

When you add an exclusion, select this checkbox to ignore a file violation based on any or all of the following:

Violation type categories (for example, Exploitation, Process Injection, Escalation)
Individual violations types under each category (for example, Stack Pivot, Remote Allocation of Memory, Zero Allocate, and so on)

When adding exclusions to a memory protection policy, if you want the policy to apply to memory protection violations only and not script control violations, specify at least one violation type that you want to ignore. If you do not select any violation types to ignore, a warning message appears and the exclusion will apply to both memory protection and script control policies.

For existing memory protection policies:

If you edit an existing policy and add an exclusion, the “Ignore specific violation types” checkbox is not displayed until you modify the violation type (for example, move it from block to terminate or alert).

For each file that has specific violation types that are ignored, you can view detailed information, edit, or delete the settings.

Select this setting when you want to add exclusions for third-party DLLs. For example, if you are running third-party security products in addition to

CylancePROTECT Desktop

for

Windows

, you can add an exclusion for the appropriate .dll files so that

CylancePROTECT

ignores specific violations for those products. This feature supports the Malicious Payload and System DLL Overwrite violation types only.

The following rules apply when you specify a DLL exclusion:

For more information about supporting DLL exclusions, visit support.blackberry.com to read KB 108909.