File lists

A file list is a threat management feature that

  • allows you to manually specify files using unique SHA-256 hash values,

  • overrides AMP cloud verdicts to improve detection accuracy within your environment, and

  • supports categorization into clean or custom detection lists, enabling precise control over file treatment.

File list categories

If you use malware defense and the AMP cloud incorrectly identifies a file’s disposition, you can add the file to a file list to improve future detection. Specify these files using SHA-256 hash values. You can add up to 10,000 unique SHA-256 values in each file list.

File lists are organized into two predefined categories.

  • Clean list: If you add a file to this list, the system treats it as if the AMP cloud assigned a clean disposition.

  • Custom detection list: If you add a file to this list, the system treats it as if the AMP cloud assigned a malware disposition.

Because you manually specify the blocking behavior for the files included in these lists, the system does not query the AMP cloud for these files’ dispositions. You must configure a rule in the file policy with either the Malware Cloud Lookup or Block Malware action and a matching file type to calculate a file’s SHA value.

Caution

Do not include malware on the clean list. The clean list overrides both the AMP cloud disposition and the custom detection list.