From 536c0993ca1ae2511d1797edbdb8ae35aed416e4 Mon Sep 17 00:00:00 2001
From: Steven Palmesano <3100993+spalmesano0@users.noreply.github.com>
Date: Thu, 21 May 2026 06:57:22 -0500
Subject: [PATCH] Add publisher and path exclusion note for EDR software
 (#45833)

---
 docs/Get started/FAQ.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/Get started/FAQ.md b/docs/Get started/FAQ.md
index 6719ec13b4..fd214705c1 100644
--- a/docs/Get started/FAQ.md	
+++ b/docs/Get started/FAQ.md	
@@ -136,6 +136,8 @@ It's common for security products to be falsely flagged as malicious because the
 
 Fleet is in active communication with EDR vendors to resolve false-positive flagging of the fleetd agent. If you notice a new flag against the orbit binary, please contact your EDR vendor support team to report the false positive. They will let you know the best path forward to address any exceptions you may want to make.
 
+If your vendor supports excluding by "Publisher", add `Fleet Device Management Inc` as an exclusion rule that will prevent Fleet software from being mistakenly flagged. Additionally, us a recursive path exclusion with `/opt/obit/` for macOS/Linux and `C:\Program Files\Orbit\` for Windows.
+
 ### SLSA provenance attestation 🌶️
 
 Fleet's orbit binaries are built via GitHub Actions and include SLSA (Supply-chain Levels for Software Artifacts) provenance attestations. These attestations allow customers to cryptographically verify that a given binary was produced from a specific GitHub build job and source commit—providing confidence that the binary has not been tampered with.