# !!! Don't change this file !!!
# Put user-defined patterns in /etc/sysconfig/kcare/libcare-blacklist.d/
#
# Symantec
path:/opt/Symantec/*
filename:symcfgd
filename:rtvscand
filename:smcd
# McAfee
path:/opt/McAfee/*
filename:masvc
filename:macmnsvc
filename:macompatsvc
# CylancePROTECT
path:/opt/cylance/*
filename:cylancesvc
# LinuxShield
path:/opt/NAI/*
filename:nailsd
filename:nailslogd
filename:logepo
filename:mon
filename:scanner
# Trend Micro Deep Security Agent
path:/opt/ds_agent/*
filename:ds_agent
# OSSEC
path:/var/ossec/*
filename:ossec-syscheckd
# File Access Policy Daemon
path:/usr/sbin/fapolicyd
# BitDefender
path:/opt/bitdefender-security-tools/*
filename:epagngd
filename:bdsecd
filename:updated
filename:bdsecd
path:/opt/BitDefender/*
filename:bdregd
filename:bdlogd
filename:epagd
filename:bdepsecd
filename:bdmond
filename:bdupdated
filename:bdsrvscand.bin
# CrowdStrike
path:/opt/CrowdStrike/*
filename:falcond*
filename:falconctl*
filename:falconstore*
filename:falcon-*
# Microsoft Defender
path:/opt/microsoft/mdatp/*
filename:mdatp
filename:mdatp_*
filename:wdavdaemon
# Fstrim
path:/sbin/fstrim
path:/usr/sbin/fstrim
#
# cgroup-based rules for container processes.
# Uncomment to exclude Docker/Podman/k8s containers from patching.
# These patterns do NOT match the container runtime daemons themselves
# (dockerd, containerd, etc.) — only the containerized processes.
#
# Docker containers (both cgroupfs and systemd cgroup drivers):
#cgroup:*/docker/*
#cgroup:*docker-*.scope
#
# Podman containers (cgroupfs and systemd cgroup drivers):
#cgroup:*/libpod_parent/*
#cgroup:*libpod-*.scope
#
# Kubernetes / containerd (cgroupfs and systemd cgroup drivers):
#cgroup:*/kubepods/*
#cgroup:*cri-containerd-*.scope
#
# All of the above via a single regex (BRE syntax -- \( \| are metacharacters):
#cgroup_regex:\(docker[-/]\|libpod[-_]\|cri-containerd-\|kubepods/\)[a-f0-9]