Add individual SHA-256 values to file lists

Add unique SHA-256 values to file lists to enhance file detection and management within the system.

You must have the Malware Defense license for this procedure.

Adding SHA-256 values identifies files for detection and prevents duplicates by ensuring only unique values are included.

Before you begin

  • Right-click a file or malware event from the event view, choose Show Full Text in the context menu, and copy the full SHA-256 value for pasting into the file list.

Follow these steps to add individual SHA-256 values to file lists:

Procedure

Step 1

Choose Objects.

Step 2

Choose File List from the list of object types.

Step 3

Click Edit (edit icon) next to the clean list or custom detection list where you want to add a file.

If View (View button) appears instead, the object belongs to an ancestor domain, or you do not have permission to modify the object.

Step 4

Choose Enter SHA Value from the Add by drop-down list.

Step 5

Enter a description of the source file in the Description field.

Step 6

Enter or paste the file’s entire value in the SHA-256 field. The system does not support matching partial values.

Step 7

Click Add.

Step 8

Click Save.

What to do next

  • If an active policy references your object, deploy configuration changes.

Note

After configuration changes are deployed, the system no longer queries the AMP cloud for files on the list.