# Creating Endpoint Exception for one endpoint

**URL:** <https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593>\
**Category:** Elastic Security\
**Created:** [February 27, 2023, 1:57pm UTC](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593 "2023-02-27T13:57:07Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![slash24](https://avatars.discourse-cdn.com/v4/letter/s/a4c791/32.png) [@slash24](https://discuss.elastic.co/u/slash24)\
**Post date:** [February 27, 2023, 1:57pm UTC](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593/1 "2023-02-27T13:57:07Z")

</div>

How do I create an Endpoint Exception that only apply to one specfic host? I have alot of servers in one Fleet policy and would like to excluse w3wp.exe. This however a dangerous blindspot so of course i want to limit that exception.

is it enough to add "host.name IS specifichostname" as a condition into a policy- (Got Premium) or global exception?

---

<div class="post-metadata">

**Author:** ![spong](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spong/32/54343_2.png) [@spong](https://discuss.elastic.co/u/spong)\
**Post date:** [March 9, 2023, 11:41pm UTC](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593/2 "2023-03-09T23:41:43Z")

</div>

Hey there @slash24 👋

So as far as I recall Endpoint Exceptions remain global (no way to separate by policy at this time), but adding a `host.name` qualifier AND'ed to the `w3wp.exe` exclusion exception will ensure that it's isolated to that host. It is slight overhead for the remaining hosts, but I'm not aware of any other way to accomplish this at this time.

You could of course add this as a Rule Exception instead, that way the underlying endpoint event still gets generated, but the rule just won't create an alert for it.

Hope this helps!

Cheers!  
Garrett

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 6, 2023, 11:41pm UTC](https://discuss.elastic.co/t/creating-endpoint-exception-for-one-endpoint/326593/3 "2023-04-06T23:41:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.