> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Excluding Devices from Vulnerability Management
> Exclude devices from vulnerability reporting in Iru Endpoint. Manage CVE exclusions individually or in bulk from a device record, Devices page, or CVE tab.
This guide applies to Mac computers and Windows devices
### About Excluding Devices
Some devices in your fleet may not need to be included in vulnerability reporting, such as dedicated test devices, devices assigned to employees on extended leave, or devices undergoing decommissioning. Excluded devices no longer contribute to affected-device counts, detection counts, the CVE **Devices** view, or vulnerability notifications.
Please see our [Vulnerability Management Overview](/en/endpoint/vulnerability-management/vulnerability-management-overview) article for more information about vulnerabilities.
### How It Works
Device exclusion lets you remove specific devices from fleet-wide vulnerability counts, views, and notifications. When you exclude a device, it no longer appears in CVE affected device totals or the **Devices** tab across Vulnerability Management, and vulnerability notifications for that device are suppressed.
Detections remain visible on the device record, so you keep full visibility at the device level without those results affecting top-line reporting. If a [Vulnerability Response Library Item](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item) is scoped to an excluded device, automated patching continues according to the configured remediation rules.
You can exclude a device from its device record or from the **Devices** tab in any CVE detail view. From the **Devices** page or a CVE **Devices** tab, you can also exclude or remove exclusions for multiple devices at once. You can remove an exclusion at any time to resume monitoring. If a device is deleted from Iru Endpoint, its exclusion is removed automatically.
### Excluding a Device
You can exclude a device from the device record in Iru Endpoint or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app and select the device you want to exclude.
Click the **Device Action Menu** at the top right of the device record.
Click **Exclude device vulnerabilities**.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the device until you remove the exclusion
* **Ignore until a specific date** to exclude the device until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion.
Click **Save**.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE that includes the device you want to exclude.
Select the **Devices** tab.
Click the **ellipsis** (**…**) next to the device you want to exclude.
Click **Exclude device vulnerabilities**.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the device until you remove the exclusion
* **Ignore until a specific date** to exclude the device until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion.
Click **Save**.
### Excluding Multiple Devices
You can exclude multiple devices at once from the **Devices** page or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app.
Select the checkboxes next to the devices you want to exclude.
Click the **ellipsis** (**…**) in the bulk action bar at the bottom of the list.
Click **Exclude device vulnerabilities**.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the devices until you remove the exclusions
* **Ignore until a specific date** to exclude the devices until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion. These details apply to all selected devices.
Click **Save**.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE that includes the devices you want to exclude.
Select the **Devices** tab.
Select the checkboxes next to the devices you want to exclude.
Click **Exclude device vulnerabilities** in the bulk action bar at the bottom of the list.
Choose an **Enforcement timeframe**:
* **Indefinitely** to exclude the devices until you remove the exclusions
* **Ignore until a specific date** to exclude the devices until the date you select
Optionally, enter a **Ticket** URL and **Comment** to document the reason for exclusion. These details apply to all selected devices.
Click **Save**.
### Modifying or Removing a Device Exclusion
You can modify or remove an exclusion from the device record or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app and select the excluded device.
In the banner near the top of the device record, click **Modify**. Update the **Enforcement timeframe**, **Ticket**, or **Comment** as needed, then click **Save**. The dialog matches the one used when you first exclude a device.
In the banner near the top of the device record, click **Remove exclusion**. In the confirmation dialog, click **Remove exclusion** again.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE for the excluded device you want to manage.
Select the **Devices** tab.
Click the **Filters** button at the top right of the device list.
Toggle **Show excluded devices**. Excluded devices appear in the list with an **Excluded** badge.
Click the **ellipsis** (**…**) next to the excluded device you want to modify.
Click **Modify exclusion**. Update the **Enforcement timeframe**, **Ticket**, or **Comment** as needed, then click **Save**.
Click the **ellipsis** (**…**) next to the excluded device you want to remove.
Click **Remove exclusion**.
In the confirmation dialog, click **Remove exclusion** again.
After you remove an exclusion, the device is included again in vulnerability scanning at the next scan cycle.
### Removing Multiple Device Exclusions
You can remove exclusions from multiple devices at once from the **Devices** page or from the **Devices** tab in a CVE detail view.
Navigate to **Devices** in the Iru Endpoint web app.
Select the checkboxes next to the excluded devices whose exclusions you want to remove.
Click the **ellipsis** (**…**) in the bulk action bar at the bottom of the list.
Click **Remove exclusion**.
In the confirmation dialog, click **Remove exclusion** again.
Go to the **Vulnerability Management** section in the Iru Endpoint web app.
From the **Vulnerabilities** list, select the CVE for the excluded devices you want to manage.
Select the **Devices** tab.
Click the **Filters** button at the top right of the device list.
Toggle **Show excluded devices**. Excluded devices appear in the list with an **Excluded** badge.
Select the checkboxes next to the excluded devices whose exclusions you want to remove.
Click **Remove exclusion** in the bulk action bar at the bottom of the list.
In the confirmation dialog, click **Remove exclusion** again.
After you remove exclusions, the devices are included again in vulnerability scanning at the next scan cycle.
### Considerations
Excluding a device removes it from all CVE affected device counts across every vulnerability in Vulnerability Management. Exclusion is not scoped to a single CVE. Vulnerability detections remain visible on the device record. Exclusion affects top-level Vulnerability Management counts, views, and notifications only. To suppress a specific CVE without excluding the device entirely, use [Accepting CVE Risks](/en/endpoint/vulnerability-management/accepting-cve-risks) instead.
If a [Vulnerability Response Library Item](/en/endpoint/vulnerability-management/configure-the-vulnerability-response-library-item) is scoped to an excluded device, it continues to patch the device according to the configured remediation rules. Exclusion does not prevent automated remediation.
If a device is deleted from Iru Endpoint, its exclusion is removed automatically. If the same device re-enrolls, it is monitored by default. Re-apply the exclusion manually if needed.
An excluded device does not count toward the affected-device total for any CVE. Excluding a device does not change the **Remediated** status of a CVE by itself. Remediation status is based on active (non-excluded) devices only. If excluding a device means all remaining affected devices for a CVE are remediated, the CVE status updates to **Remediated**.
Excluded devices are not hidden from the **Devices** section of Iru Endpoint. They are hidden from Vulnerability Management views and counts only. Exclusions are auditable. Each exclusion records who applied it, when, and any comment provided.
Vulnerability notifications for excluded devices are suppressed while the exclusion is active. Removing an exclusion resumes notifications at the next scan cycle.
### Related Articles
Detect CVEs across your fleet, prioritize by severity, and track remediation progress
Accept CVE risks when patching is not feasible, set expiration dates, and track exceptions
Automate remediation for vulnerable Auto Apps on macOS based on CVE severity