Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

After approving banned file, banned state persists

After approving banned file, banned state persists

Version

7.2.x

Issue

After explictly approving a banned file, the file is still showing up as banned.

Symptoms

You may still see blocks or would-have-blocked report events for files that have been approved.

Cause

It is possible in some circumstances that the file ban was done for one hash type, and the approval was done for another. In this situation, the ban will take precedence. For example, if the original ban was based on the md5 hash, but the approval was done for the sha256 hash, the file will still be considered banned.

Solution

To check to see if a file still has a ban for any of its hashes, do the following:

Go to Assets > Files and search for the file name. Look at the file details and make a note of the 3 hash values.

Go to Rules > Software Rules > Files, and then use the following Filter:

     File or Hash contains <md5 hash value>

                                      or <sha1 hash value>

                                      or <sha256 hash value>

If there are any rows returned with Type = Ban or Type = Ban (Report Only), go to Edit File Rule, change the Rule Type to Approval, and Save.  That will completely remove the ban.

Labels (1)
Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎12-28-2016
Views:
1081
Contributors