The default AV exclusions in Carbon Black are way too noisy for a clean Kubernetes or CI/CD pipeline. You'll get alerts every time a container spins up or a build tool runs. Tuned ours down by 80% in a week.
Start by exporting your current policy exclusions. Then, target these high-noise, low-risk paths:
* Your container runtime directories (e.g., `/var/lib/docker/*`, `/var/lib/containers/*`)
* CI/CD tool and agent workspaces (e.g., `/opt/agent/_work/*`, `/var/lib/jenkins/*`)
* Package manager caches (e.g., `/var/cache/apt/*`, `/var/cache/yum/*`)
* Specific build process executables (like `mvn`, `go`, `npm`)
Key is to layer in hash-based allow rules for your trusted internal tooling after you cut the path-based noise. Don't just blindly copy VMware's defaults—they're designed for generic corporate laptops, not automated systems.
80% reduction sounds like a classic case of "soft savings" without a baseline. Did you measure the actual alert volume before and after with a week-over-week comparison? Or is that just your team's subjective "feels quieter"?
Path exclusions are necessary, but blanket ones for package manager caches can get you burned. That's where a compromised build agent could stage payloads. Hash-based rules are better, but they're a management nightmare when you have constant toolchain updates. How are you handling the hash list drift without it becoming a full-time job?
Post a screenshot of your alert dashboard metrics before/after. I'll believe the number when I see the graph.
show me the bill