diff --git a/defender-endpoint/defender-endpoint-false-positives-negatives.md b/defender-endpoint/defender-endpoint-false-positives-negatives.md index 1f37d43430..a3388497d3 100644 --- a/defender-endpoint/defender-endpoint-false-positives-negatives.md +++ b/defender-endpoint/defender-endpoint-false-positives-negatives.md @@ -212,9 +212,11 @@ To define exclusions across Microsoft Defender for Endpoint, perform the followi - [Create "allow" indicators for Microsoft Defender for Endpoint](#indicators-for-defender-for-endpoint) - [Define exclusions for Microsoft Defender Antivirus](#exclusions-for-microsoft-defender-antivirus) +- For Attack Surface Reduction Rule exclusions [Configure attack surface reduction per-rule exclusions](/defender-endpoint/attack-surface-reduction-rules-deployment-test#configure-attack-surface-reduction-per-rule-exclusions) or you can leverage [ASR rule only exclusions](/defender-endpoint/enable-attack-surface-reduction#exclude-files-and-folders-from-attack-surface-reduction-rules) > [!NOTE] > Microsoft Defender Antivirus exclusions apply only to antivirus protection, not across other Microsoft Defender for Endpoint capabilities. To exclude files broadly, use [custom indicators](indicators-overview.md) for Microsoft Defender for Endpoint and exclusions for Microsoft Defender Antivirus. +> ASR Rules can leverage ASR Rule Exclusions - where the exclusions apply to all ASR Rules; ASR per Rule Exclusions; Defender AV exclusions; as well as allow indicators defined in Custom Indicators. The procedures in this section describe how to define indicators and exclusions.