You can create scan-path exclusion rules in Software Vulnerability Manager (SVM) to keep specified locations out of scan results. These rules can help you exclude backup directories, temporary folders, legacy software repositories, and other locations that are outside your organization's vulnerability-management scope.

Define exclusions as narrowly as possible. SVM excludes the specified path and its subfolders, which could hide vulnerable software that your organization needs to assess or remediate.

When to use a scan-path exclusion

Consider creating an exclusion when a directory contains software or executable files that your organization intentionally doesn't manage through SVM. Examples include:

• Backup directories containing older application versions
• Temporary directories containing installation or application files
• User profile or application-data directories that are outside your assessment scope
• Legacy software repositories retained for compatibility purposes
• Operating system directories containing software that another management process maintains
• External or personal-file locations that are outside your organization's deployment policies

Example paths include:

• C:\Windows\InfusedApps\Packages\...
• ....\Backup\ directory
• C:\Users\%Profile%\<YourApp>\
• E:\External\Personal\Files\....
• %AppData%
• %Temp%
• Other paths that do not correspond to your organization's deployment policies and standard procedures.

Benefits of using scan-path exclusions

A scan-path exclusion can help you:

• Exclude application files in locations your organization's update tools don't manage.
• Exclude backup directories that contain old software versions retained for compatibility or recovery purposes.
• Reduce irrelevant results from user-profile and temporary directories.
• Limit scan results to software that falls within your organization's vulnerability-management scope.
• Apply an exclusion to hosts within a specific SVM site.

Create a scan-path exclusion rule

1. In SVM, go to Scanning > Filter Scan Results > Scan Paths.

2. Select Block List.

3. Select Add Blocklist Rule.

4. Enter a descriptive rule name that clearly identifies the exclusion's purpose.

5. Enter the full path that you want to exclude.

   Include a backslash at the end of the path. For example:

   C:\Users\<user-profile>\AppData\Local\

6. To limit the rule to hosts in a particular SVM site, select the appropriate value in the Site field.

   A site can represent a device collection, an Active Directory organizational unit, a domain, or a custom group configured in SVM.

7. Save the rule.
   
   

Path requirements

• Enter the complete path that SVM should exclude.
• Include a trailing backslash in the path.
• Don't use wildcard characters, such as an asterisk (*).
• Don't enter regular expressions.
• Make each rule as specific as possible.

Outcome

SVM excludes scan results from the specified path and all its subfolders. If you limit the rule to an SVM site, the exclusion applies only to hosts within that site.

Choose a specific exclusion path

Avoid excluding a broad parent directory when you need to exclude only one subfolder.

For example, suppose you need to exclude this directory:

D:\Program Files\Backup\Adobe\OldVersions\Reader\Version3.x\

Don't exclude the following parent directory:

D:\Program Files\Backup\Adobe\

Excluding the broader directory also removes results for other applications and versions stored in its subfolders.

Important: Review exclusions regularly. An exclusion can prevent SVM from reporting vulnerable software in the excluded path, including software added after you create the rule.