---
updatedAt: 2026-08-24T11:00:01.000Z
---

# EVE Exception List

# Introduction

Introduced in release 7.3, Encrypted Visibility Engine (EVE) identifies client applications and processes that utilize TLS encryption. It enables visibility and allows administrators to take action and enforce policy within their environments.

In release 7.4, enhancements were added to EVE to block malicious traffic based on threat score. Administrators can adjust the threat score required for EVE to block potentially malicious traffic. This means that as EVE analyzes traffic, it assigns a score based on the probability that the traffic is malware. If the incoming traffic is deemed to be malicious, then based on the threat score, EVE can be configured to block the connection.

However, scenarios like Internal Penetration Testing can create a need to bypass EVE's block verdict. Hence, in release 7.6, an EVE Exception List has been introduced which aims to ensure the continuity of connections and services when EVE’s block feature is enabled.

# Configuration

The EVE Exception List allows customers to bypass EVE’s verdict for blocking a connection based on the below attributes:

1. Process Name
2. Destination IP Address

The configuration of the EVE Exception List can be done in two ways - proactively and reactively.

## Proactive EVE Exception List

1. Navigate to **Policies** > **Access Control**. Click on the Edit icon of the Access Control Policy to be edited.
2. Go to **More** > **Advanced Settings**. Click on the Edit icon against **Encrypted Visibility Engine**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/e2c05a8b486bb7991d16b601e50b516537816ac6235af33620667577c34c8fa9-image.png",
        null,
        "Encrypted Visibility Engine settings"
      ],
      "align": "center",
      "caption": "Encrypted Visibility Engine settings"
    }
  ]
}
[/block]

3. Ensure that the below sliders are turned on:

i. **Recommended Settings**

ii. **Encrypted Visibility Engine (EVE)**

iii. **Use EVE for Application Detection**

iv. **Block Traffic Based on EVE Score**

The block threshold configured in the below example is **Very High**, which means that traffic detected as malicious with **Encrypted Visibility Threat Confidence Score** 99% and above will be blocked. To add an exception to this block verdict, click on **Add Exception Rule**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/c090b5edb1d2c315544b9e9bd5d517b25f10aa145a8074a7dc26adb1d4e44bf8-Screenshot_2024-10-16_at_12.23.41_AM.png",
        null,
        "Encrypted Visibility Engine settings"
      ],
      "align": "center",
      "caption": "Encrypted Visibility Engine settings"
    }
  ]
}
[/block]

4. Navigate to the tab **Process Name**. Type in the Process Name and click on **Add to Process**.

Note that the Process Name should exactly match the EVE Process Name seen in Unified Event Viewer. It is both case and space-sensitive.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/d2b18bdc5e1158c74ac2edf8edddd352fe1832f0add9ed93c9f9835dc20b4509-Screenshot_2024-10-16_at_12.26.50_AM.png",
        null,
        "Process Name under EVE Exception Rule"
      ],
      "align": "center",
      "caption": "Process Name under EVE Exception Rule"
    }
  ]
}
[/block]

5. Navigate to **Network Objects**. Against **Manually Enter IP**, type in the destination IP address to be exempted from EVE block. Click on the **+** sign to add it. Comments can be added in the **Comment** box for the EVE Exception Rule. Click on **Save**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/f8fedb2848ef6ee1d5c6e46bd70f3ecdcb4f37fccfde80f799e20f0ffdae3d0b-Screenshot_2024-10-16_at_12.31.26_AM.png",
        null,
        "Network Objects under EVE Exception Rule"
      ],
      "align": "center",
      "caption": "Network Objects under EVE Exception Rule"
    }
  ]
}
[/block]

<br />

6. The Exception Rule gets added as shown below. Click on **OK**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/92a7a71f0bef1db68ccb6a0e33da46dcb6391e32c087de84267e62dce51b511f-Screenshot_2024-10-16_at_12.33.35_AM.png",
        null,
        "EVE Exception Rule"
      ],
      "align": "center",
      "caption": "EVE Exception Rule"
    }
  ]
}
[/block]

<br />

7. Click on **Save** to save the changes to the Access Control Policy and click on **Deploy** to deploy the changes to the firewall.
8. Navigate to **Analysis** > **Unified Events**. In the search bar filter with the values configured in the exception list -- i.e. for the columns **Encrypted Visibility Process Name** and **Destination IP**. Click on **>** against the event to expand it.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/aa6e4d5cbc21767cba11b9939c4808b67a4a49b2a3658ad80cc385b4b2a0ec9a-Screenshot_2024-10-16_at_9.44.39_AM.png",
        null,
        "EVE Exempted traffic in Unified Event Viewer"
      ],
      "align": "center",
      "caption": "EVE Exempted traffic in Unified Event Viewer"
    }
  ]
}
[/block]

<br />

9. Note that the traffic has been allowed even though EVE detected it as malicious with **Encrypted Visibility Threat Confidence Score** equal to 100%. The **Reason** is seen as **EVE Exempted**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/478a0d4666257f29090524a00a5d43b449aab223a0ac8035938e33aeccc13f66-Screenshot_2024-10-16_at_9.49.54_AM.png",
        null,
        "EVE Exempted traffic in Unified Event Viewer"
      ],
      "align": "center",
      "caption": "EVE Exempted traffic in Unified Event Viewer"
    }
  ]
}
[/block]

<br />

<br />

## Reactive EVE Exception List

1. Navigate to **Analysis** > **Unified Events**. In the search bar filter with **Reason**: **Encrypted Visbility Block** to view all the traffic blocked based on EVE block threshold.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/5d759b96cbd94fd72ff227f84665c7ef8477b26ff691e2d9254e3e8a604f7537-Screenshot_2024-10-16_at_1.35.56_AM.png",
        null,
        "EVE Blocked traffic in Unified Event Viewer"
      ],
      "align": "center",
      "caption": "EVE Blocked traffic in Unified Event Viewer"
    }
  ]
}
[/block]

2. Click on the three dots against **Encrypted Visibility Block** for the event that needs an exemption from the EVE block verdict. Click **Add EVE Exemption Rule**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/fed6c18a954909bb8450640d0e60311d2cf780d267213f835f0158320e5276d9-Screenshot_2024-10-16_at_10.43.22_AM.png",
        null,
        "Adding EVE Exception Rule from Unified Event Viewer"
      ],
      "align": "center",
      "caption": "Adding EVE Exception Rule from Unified Event Viewer"
    }
  ]
}
[/block]

<br />

3. This opens the Encrypted Visibility Engine settings page under the Access Control Policy mapped to the Device, with the newly added rule at the bottom of the EVE Exception List.

Click on **Save** to save the Encrypted Visibilty Engine and then on **Save**  on the top right corner to save the changes to the Access Control Policy. Click on **Deploy** to deploy the changes to the firewall.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/2098d7bb6475cd121df955ad60139ea53c2138092cacb055dd6537a847fa2c3d-Screenshot_2024-10-16_at_10.45.46_AM.png",
        null,
        "EVE Exception rule added automatically"
      ],
      "align": "center",
      "caption": "EVE Exception rule added automatically"
    }
  ]
}
[/block]

<br />

4. Go back to **Analysis** > **Unified Events**. In the search bar filter with the values in the exception list i.e. the columns **Encrypted Visibility Process Name** and **Destination IP**. The exempted event is now allowed through the firewall with the **Reason**: **EVE Exempted**.

[block:image]
{
  "images": [
    {
      "image": [
        "https://files.readme.io/95c8fb3fa957cdc8ec0e5722a72193bef6445259c6a8689077514b2fd8c823f5-Screenshot_2024-10-16_at_7.49.49_PM.png",
        null,
        "EVE Exempted traffic in Unified Event Viewer"
      ],
      "align": "center",
      "caption": "EVE Exempted traffic in Unified Event Viewer"
    }
  ]
}
[/block]

## Summary

With EVE Exception List, trusted networks and penetration testing scenarios can be easily exempted while continuing to block other malicious traffic with Encrypted Visibility Engine.