Application whitelisting for Unix IPS Policy

Hi All,

We are in process of implementing IPS policy on Unix Servers. These server have different application running. We have already applied sym_unix_protection_sbp policy in disbaled mode (policy will log any event and sent to the DCS Server but won't block any violation).

I would like to know what is the best way to go about the whitelisting of the applicatio/processes using sym_unix_protection_sbp so that any running application won't get affacted.

Appriciate is someone can share any document, menthod to do whitelistig that can be used for the same.

Thanks in advance !!!