Skip Navigation
  1. BlackBerry Docs
  2. CylanceON-PREM
  3. Cylance ONPREM Administration Guide
  4. Configuring the CylanceON-PREM console
  5. CylanceON-PREM policies
  6. Wildcards in memory violation exclusions

Wildcards in memory violation exclusions

Memory violation exclusions can include the following special characters (all OS): ^ & ' @ { } [ ] , $ = ! - # ( ) % . + ~ _
In
Cylance
 agent 1560 or later, the following additional special characters are also supported for Windows:
  • Asterisk (*)
  • Any letter value followed by colon (C:)
In a normal wildcard, three asterisks "***" are valid and equal a single asterisk"*". However, three asterisks are not valid for exclusions because it would hide typos. For example, in the pattern "C:\***.exe", users might have wanted to type "c:\**\*.exe" but missed one "\". If "***" were treated as a single "*" it could result in different behavior than was intended.
Pattern Syntax for * Wildcard on Windows
Characters
Usage
Details
*
Excluding executables and applications
Matches zero or more characters, except the platform-specific path separator ('\' on Windows).
  • At this time, "*" escaping is not supported. For example, you cannot exclude a file that contains an asterisk "*" in the file name.
  • Wildcard exclusions for Memory Violations apply only to Windows at this time.
**
Excluding drives and directories. This can be used to include child directories.
Matches zero or more layers of a directory (e.g. "\**\").
Note that "**" is not just a double "*", it is a special notation. To avoid confusion, review the following rules when using this special character:
  • "**\" is valid if it is at the beginning of pattern, only for Windows. It will match all directories inside all drives.
  • "\**\" can appear in the pattern string multiple times, there is no limitation.
Wildcard exclusions for Memory Violations apply only to Windows at this time.
The following are examples based on the following path. Relative paths can also be used.
C:\Application\TestApp\MyApp\program.exe
Example
Description
Correct Exclusions
The following is an example of a correct relative path exclusion without any wildcards:
  • \Application\TestApp\MyApp\program.exe
The following would exclude program.exe as long as program.exe is located under "MyApp" child directory in C: drive:
  • C:\Application\**\MyApp\program.exe
The following would exclude any .exe extension file as long as the executable is located under "MyApp" child directory in C: drive:
  • C:\Application\**\MyApp\*.exe
The following would exclude any executable as long as the executable is located under "MyApp" child directory in C: drive:
  • C:\Application\**\MyApp\*
The following would exclude program.exe as long as program.exe is located under any child directory that belongs to "TestApp" parent directory in C: drive:
  • C:\Application\TestApp\**\program.exe
The following would exclude program.exe as long as program.exe is located under \Application\TestApp\MyApp\ for any drive:
  • **\Application\TestApp\MyApp\program.exe
The following would exclude any .exe extension file as long as the executable is located under \Application\TestApp\MyApp\ for any drive:
  • **\Application\TestApp\MyApp\*.exe
The following would exclude any executable as long as the executable is located under \Application\TestApp\MyApp\ for any drive.
  • **\Application\TestApp\MyApp\*
Incorrect Exclusions
The following example is incorrect because "**" is used for directories. Use a single asterisk "*" for executables:
  • C:\Application\TestA**.exe
The following example is incorrect because "**" is used for directories. There is no single asterisk "*" specifying executables to exclude:
  • C:\Application\**
Not Recommended Exclusions
The following is correct, but not recommended. It would effectively exclude anything in any directory (including child directories) under the C: drive:
  • C:\**\*
The following is correct, but not recommended. It would effectively exclude anything in any directory (including child directories) in any drive:
  • **\*