• Overview
• Version 4.0.0 or later
  • Windows — individual binaries
  • macOS — individual binaries
  • Linux — individual binaries
  • Firefox on Windows
• Legacy versions before 4.0.0
  • Windows — individual binaries
  • macOS — individual binaries
  • Linux — individual binaries

Overview

In some cases, an Anti-Virus (AV) or EDR solution might interfere with the Cloud Secure Edge (CSE) app because of how they interpret the app’s behaviour during installation or runtime. EDR and AV tools can flag behaviour that resembles attacks: since the CSE app is running background services, creating and modifying system files, intercepting network traffic, and maintaining a persistent connection to a cloud service, these actions can signal suspicious behaviour, especially if the EDR/AV tool doesn’t recognize the signing certificate or publisher.

Allow-listing the CSE app in your AV/EDR tool informs the tool that the CSE app software can be trusted and should be ignored during scans or behavioural analysis. This guide lays out the exclusions for each OS, grouped by app version: version 4.0.0 or later and legacy versions before 4.0.0.

Individual process exclusions are subject to change between app versions. Wherever your AV/EDR tool supports it, use the wildcard folder exclusion rather than listing individual binaries — it keeps working across app updates and covers new binaries automatically. List individual binaries only if your tool cannot use a wildcard, and re-check them after upgrading the app.

Version 4.0.0 or later

Recommended: use a wildcard folder exclusion. Exclude the entire CSE application folder with a wildcard:

• Windows: %ProgramFiles%/SonicWall Cloud Secure Edge/*
• macOS: /Applications/SonicWall Cloud Secure Edge.app/*
• Linux: /opt/SonicWall Cloud Secure Edge/*

If your AV/EDR tool cannot use a wildcard and requires individual binaries, use the list below for your platform.

Firefox on Windows

The desktop app installs the CSE certificates in Firefox with certutil.exe, which it runs from this folder:

%ProgramFiles%/SonicWall Cloud Secure Edge/resources/bin/mar-tools/

Firefox needs these certificates to present the device certificate when a user signs in. Some EDR tools identify certutil.exe writing to the Firefox certificate store as a credential stealer, and block it. When that happens, users who sign in through Firefox cannot register the device, or cannot renew its registration. Other browsers are not affected.

Desktop app 4.8.0 ships an updated copy of certutil.exe, signed by SonicWall. An exemption that allows the earlier copy by file hash does not match the new one. To keep Firefox sign-in working, use one of these exemptions:

• Recommended: Exclude the CSE application folder with the wildcard folder exclusion. It covers the new copy without any change.
• If your tool cannot use a wildcard, exclude %ProgramFiles%/SonicWall Cloud Secure Edge/resources/bin/mar-tools/certutil.exe by path.
• If your tool allows files by hash only, add the hash of the 4.8.0 copy. Add the new hash again whenever a desktop app upgrade replaces the file.

If a Firefox user cannot register or renew, check your EDR tool’s alerts for a blocked certutil.exe.

Legacy versions before 4.0.0

These apply to CSE desktop app versions 3.28.1 or earlier (the Banyan-branded app). A wildcard folder exclusion works here too — %ProgramFiles%/Banyan/* (Windows), /Applications/Banyan.app/* (macOS), or /opt/Banyan/* (Linux) — and is preferred. The individual binaries are listed below if your tool requires them.