# Add alert exclusion for "grandfather" process

**URL:** <https://discuss.elastic.co/t/add-alert-exclusion-for-grandfather-process/344835>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [October 11, 2023, 3:36pm UTC](https://discuss.elastic.co/t/add-alert-exclusion-for-grandfather-process/344835 "2023-10-11T15:36:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stenbot1](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@stenbot1](https://discuss.elastic.co/u/stenbot1)\
**Post date:** [October 11, 2023, 3:36pm UTC](https://discuss.elastic.co/t/add-alert-exclusion-for-grandfather-process/344835/1 "2023-10-11T15:36:28Z")

</div>

We have an agent on our Linux servers that will spawn a shell and then that shell will spawn a process that creates an alert. This agent is trusted software on the host, and I have added it to the whitelist. The problem is from the specific alert, there is no way to exclude the agent process (which is the parent of the parent process).

Is there anyway to exclude the agent process when it is the parent of the parent process that alerts?

---

<div class="post-metadata">

**Author:** ![stenbot1](https://avatars.discourse-cdn.com/v4/letter/s/71e660/32.png) [@stenbot1](https://discuss.elastic.co/u/stenbot1)\
**Post date:** [October 25, 2023, 1:44pm UTC](https://discuss.elastic.co/t/add-alert-exclusion-for-grandfather-process/344835/2 "2023-10-25T13:44:53Z")

</div>

I'm still looking for guidance on this. We have instances of alerts being generated by our vulnerability scanning agent on a host. The agent will spawn a shell, that shell will spawn another process, which will spawn the process that is alerted on. So the agent is 3 degrees separated by the alert which means when I look at the log for the alert the agent is not present, but if I look at the "Analyze Event" I can see the agent in the process tree. I have whitelisted the agent executable but that has not helped.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 22, 2023, 1:44pm UTC](https://discuss.elastic.co/t/add-alert-exclusion-for-grandfather-process/344835/3 "2023-11-22T13:44:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.