Add publisher and path exclusion note for EDR software (#45833)

2026-05-21 06:57:22 -05:00
parent 5eb0a4c5ba
commit 536c0993ca
1 changed files with 2 additions and 0 deletions
@@ -136,6 +136,8 @@ It's common for security products to be falsely flagged as malicious because the

 Fleet is in active communication with EDR vendors to resolve false-positive flagging of the fleetd agent. If you notice a new flag against the orbit binary, please contact your EDR vendor support team to report the false positive. They will let you know the best path forward to address any exceptions you may want to make.

+If your vendor supports excluding by "Publisher", add `Fleet Device Management Inc` as an exclusion rule that will prevent Fleet software from being mistakenly flagged. Additionally, us a recursive path exclusion with `/opt/obit/` for macOS/Linux and `C:\Program Files\Orbit\` for Windows.
+
 ### SLSA provenance attestation 🌶️

 Fleet's orbit binaries are built via GitHub Actions and include SLSA (Supply-chain Levels for Software Artifacts) provenance attestations. These attestations allow customers to cryptographically verify that a given binary was produced from a specific GitHub build job and source commit—providing confidence that the binary has not been tampered with.