Skip to content

Add cado host exclusions for S1 and DfE #679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cadosecurity merged 1 commit into from
Feb 10, 2026
Merged

Add cado host exclusions for S1 and DfE #679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions docs/cado/integrations/xdr/defender.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,13 @@ Select the following API permissions:
4. Navigate to the 'Accounts' table and the newly created Defender account should present. If configured correctly, you will see a green coloured health status.
5. An alternative way to check the account has been set up correctly is to browse to any investigation, and click **Import > XDR > Defender**. If configured correctly, a paginated list of hosts with the Defender agent installed will be displayed.

## Add exclusions for Cado Host
1. Create exclusions with the following patterns to enable Windows integration:
- `Windows\Temp\_MEI*\**\CadoHostRawGrabber.exe`
- `Windows\Temp\cado-host-*\cado-host.exe`
2. Create exclusions with the following patterns to enable Linux integration:
- `/tmp/cado-host-*/cado-host`

## Limitations

- Microsoft Defender limits to 25 concurrent Live Response sessions.
Expand Down
7 changes: 7 additions & 0 deletions docs/cado/integrations/xdr/sentinelone.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,3 +46,10 @@ To use the integration between SentinelOne and Cado, you need the SentinelOne Re
:::note
Currently, Windows and Linux operating systems are supported with the SentinelOne integration.
:::

## Add exclusions for Cado Host
1. Create exclusions with the following patterns to enable Windows integration:
- `Windows\Temp\_MEI*\**\CadoHostRawGrabber.exe`
- `Windows\Temp\cado-host-*\cado-host.exe`
2. Create exclusions with the following patterns to enable Linux integration:
- `/tmp/cado-host-*/cado-host`