Source files for file lists

Source files allow you to add multiple SHA-256 values to a file list by uploading a comma-separated value (CSV) file. The system validates the contents and populates the file list with valid SHA-256 values. Upload source files must meet the following requirements:

  • The source file must be a simple text file with a .CSV extension.

  • Any header must start with a pound sign; it is treated as a comment and will not be uploaded.

  • Each entry should contain a single SHA-256 value followed by a description, and must end with either LF or CR+LF newline character.

  • The system ignores any additional information present in the entry.

Note the following behaviors and limitations:

  • Deleting a source file from the file list also removes all associated SHA-256 hashes from the list.

  • You cannot upload multiple files to a file list if the upload would result in more than 10,000 distinct SHA-256 values in the list.

  • The system truncates descriptions exceeding 256 characters to the first 256 characters when uploading. If the description contains commas, you must use an escape character (\,). If no description is provided, the source file name is used instead.

  • All non-duplicate SHA-256 values are added to the file list. If a SHA-256 value already exists, it is not modified by subsequent uploads. Any threat name or description is derived from the individual SHA-256 value in related events.

  • Invalid SHA-256 values in a source file are not uploaded.

  • If multiple uploaded source files contain entries for the same SHA-256 value, the system uses the most recent value.

  • If a source file contains multiple entries for the same SHA-256 value, the system uses the last entry.

  • You cannot edit a source file directly within the object manager. To make changes, edit your local source file, delete the existing file from the system, then upload the revised file.

  • The number of entries associated with a source file refers to the number of distinct SHA-256 values. Deleting a source file decreases the file list's SHA-256 entries by the number of valid entries in the deleted file.