Configure Antivirus Exclusions for the octoja Agent

Antivirus and EDR products may flag the octoja agent, installer, or check applications as suspicious and block or quarantine them. This can happen during installation, an update, or only at runtime: the agent fails to start, checks return no values, or the AV console repeatedly reports detections. Investigate the detection in your security product before treating it as a false positive. This article shows which folders and processes you can exclude for confirmed false positives.

Windows

Add the following folder exclusions in your antivirus or EDR console:

If your product supports process-based exclusions, additionally exclude these executables:

ESET check reports application-info: empty result

If the ESET check reports application-info: empty result, first check the RMM access settings in ESET. A real-time detection exclusion alone does not authorize the check to access the eRmm interface. If ESET has actually detected and quarantined an octoja file, investigate the detection and restore the file if it is a confirmed false positive. Then run the check again. An empty result does not prove that protection is disabled.

If files are still blocked

• With Securepoint Antivirus Pro, a process-only exclusion may not be enough for checks. Confirm that the folder exclusion for C:\Program Files\octoja GmbH, including subfolders, applies.
• WatchGuard EDR/EPDR in Blocked mode may block files that have not yet been classified as Goodware. Test new agent and check versions on a test device before rollout and have them classified according to your EDR product's procedure. Audit mode does not block; use it only after assessing your security policy.
• Investigate each detection in the AV/EDR console first. If it is a false positive, report it to the vendor, restore affected files from quarantine and deploy the appropriate exclusions through your policies.

Why certificate-based rules do not work

octoja signs its Windows binaries with short-lived code-signing certificates that rotate automatically. A rule pinned to a specific certificate or thumbprint therefore stops matching after the next agent update. If your antivirus product supports it, filter on the publisher name octoja GmbH instead — it stays stable across rotations. Otherwise use the folder and process exclusions above.

macOS and Linux

On macOS and Linux the agent installs to a fixed location as well:

Tips

• Roll the exclusions out before deploying the agent to a customer's fleet — most AV alerts happen during the first installation and the first agent update.
• Many AV products let you manage exclusions per policy or per customer. Create the exclusions once in a baseline policy so every new customer inherits them.
• If a check or remote session still fails after adding the exclusions, check your AV product's quarantine or event history for blocked actions by one of the processes above. See Known issues to check whether the symptom is documented.

See also: Deploy the Agent on Windows