Endpoint 7.9.x Process/Folder exemptions with ingest manager?

This may seem like a really simple question... For some reason the obvious answers are escaping me at the moment.

For Endpoint how do you set an exemption for a folder and process? This is not for an entire fleet of machines only select ones as white listing for everything really isn't a good idea.

By exemption do you mean a process/folder Endpoint would not monitor entirely or processes/folders that Endpoint will not alert on?

If the former, that's a coming feature we have roadmapped for the near term. We understand how important it is.

If the later, you can do that via the exceptions workflow in the Security app. Go to the Detections tab, click "Manage Detection rules", click on "Elastic Endpoint Security" rule, then the "Exceptions" tab in the middle of the page. Click the drop down for "Add new exception" button and select "Add Endpoint exception" to create an exception that will be sent down to the Endpoint rather than applied after Endpoint generates an alert. If you want to apply the rule to just a small number of machines you can add machine specific fields from the alert, like hostname, into the exception criteria.

So I did run into that part and it seems like the logical location for it with how Elastic is designed. The how-to " https://www.elastic.co/guide/en/security/master/detections-ui-exceptions.html " lead me over to it as well.

The issue comes down to the drop down even after entering process.name for example all variables always say doesn't match any option. Even the well known agent.hostname is not present. The option to add is grayed out no matter what I enter. For example the primary ones I see causing issues currently is MsMPEng "windows defender" and TiWorker. When these kick off filebeat will be shortly behind causing memory starvation.

Sorry to be a pain I know I've posted a fair bit on the forums about endpoint I don't use Github very often. I do follow some of the progress so some of the post are just visibility for other people that come here first to know they are not alone.