App Control: How to Ban Or Approve Bulk Hashes

[#1]

Environment

• App Control Console: All Supported Versions

Objective

How to create an Approval or a Ban for a bulk list hashes in the Console.

Resolution

1. Login to the Console and navigate to Rules > Software Rules > Files.
2. Click Import and specify the Rule Name, Description, Rule Type, and applicable Policies.
3. Click Choose File to specify the file containing the list of hashes.
4. Click Upload to begin creating a File Rule for each hash in the file.

Additional Notes

• The file must contain a list of MD5, SHA-1, or SHA-256 hashes, with only one hash per line.
• It is recommended that only one hash type (MD5, SHA-1, SHA-256) be used per file. Mixing types in one file may cause unpredictable results.
• All hashes in the file will have the same Rule Type (Approval or Ban).
• Over-reliance on hash Bans and or Approvals can cause performance issues with both the Agent and the Server.

Related Content

How Many Global Approvals Is Too Many?
App Control Server: How to automatically ban a hash when detected as Malicious by CDC