[Implemented] Exclude specific drives/folders from scan

[OLLI_S]

I found a little issue:
For testing I wanted to exclude my C drive and changed my batch file:

"C:\Program Files (x86)\SecTeer VulnDetect\secteer.exe" --immediate --ignore="C:\"

But when I do a full system scan then the drive C:\ is not ignored!
When I start the scan then I see In the command line the following line:

ignorePaths : D:\_Bakup_Profile_C-Laufwerk, C:"

The " at the end looks a bit strange.
So I removed the \ at the end of the line:

"C:\Program Files (x86)\SecTeer VulnDetect\secteer.exe" --immediate --ignore="C:"

But when I do a full system scan then the drive C:\ is NOW ignored!

So you should accept in the command line both variants (with the \ at the end and without it).

[Tom]

@OLLI_S No, command line arguments are NOT stored.

[Tom]

@OLLI_S I will talk with a developer about it, but I actually think this is dictated by Windows, as the \ will escape the "
However, doing:

secteer.exe --immediate --ignore=c:\

Will work.

[OLLI_S]

@Tom You never know how users enter the paths in the registry / the Toolbox.

[Tom]

I should also mention that this will be added to the UI at some point, but that is not a high priority as we believe that the registry solution will suffice for most of the current user base.

I would appreciate to get a bit of feedback on how you wish to use this feature as it will tell us a lot about what users wish to ignore and why.

[Tom]

@OLLI_S said in [Work in progress] Exclude specific drives/folders from scan:

@Tom You never know how users enter the paths in the registry / the Toolbox.

That is true, but we don't control how Windows cmd.exe interprets special characters such as \

And in the long run, this will be done via the UI. Only technically savvy users should play with this in the registry or on the command line.

[OLLI_S]

@Tom said in [Work in progress] Exclude specific drives/folders from scan:

I would appreciate to get a bit of feedback on how you wish to use this feature as it will tell us a lot about what users wish to ignore and why.

I want to exclude:

• two external backup-drives (a complete drive like F:\ and G:\ )
• a backup-folder of my user profile
• a transfer-folder where I transfer files from my PC and my VM

Here it would be cool when I have a list of excluded folders in the configuration (web UI).
Add an input field where the user can enter a drive/path and a button "Add".
When the user presses "Add" you can remove unnecessary characters (like the \ at the end).
Below the field there is a list of excluded drives.
Behind each entry there is a small "Delete" icon.

When a full system scan is started, then the agent downloads the list of ignored folders from my account.

[Tom]

@OLLI_S Awesome

This with the \ that you refer to is only a command line thing. In the UI we control it and it will behave differently.

[OLLI_S]

@Tom Thank you for implementing the --ignore command line parameter.
I added some backup folders and drives to the exclusion list and now my list of applications is shorter.
It really helps a lot!

[OLLI_S]

@Tom said in [Work in progress] Exclude specific drives/folders from scan:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\SecTeer\Agent

I imported the reg-file and I saw that you have a list of ignored folders in the registry that looks like this:

C:\Program Files\dotnet
C:\Program Files\Common Files

Is there a way to comment out a path (so that it is not used while scanning but still in the list)?
So in the Toolbox and in the Configuration of VulnDetect users can have a checkbox in front of each path and check it (folder will be ignored) or un-check it (folder will not be ignored).

In the Toolbox this will look like this:

[OLLI_S]

@Tom I suggest that you implement an UI like this:

So users can

• add folders they want to exclude
• remove folders permanently from the list of excluded folders
• remove folders temporarily from the list of excluded folders by unchecking the checkbox

There might be some folders that always will be ignored by default, these folders are greyed out in the folder list.
This should cover all scenarios.

[OLLI_S]

This feature has been implemented in the Corporate Version of VulnDetect.
Here you see a screen shot, how it looks there:

Therefore, I mark this topic as Implemented.