hash_exceptions_blocklist
Add SHA256 hashes to a block list to stop malicious files from executing. Use it when a file is not on an existing allow or block list.
Instructions
Block List Files
Add files which do not exist in the allow or block lists to a block list. You can view the block list in the UI at Incident Response > Action Center > Block List.
Required license: Cortex XSIAM Premium or Cortex XSIAM Enterprise or Cortex XSIAM Enterprise Plus
[POST /public_api/v1/hash_exceptions/blocklist] · Response Action
Example request body:
{
"request_data": {
"hash_list": [
"032196FB1A---DFCF69E5D553F0",
"365296EB1B---FCF69E7D553E4",
"365296EB1B---FCF69E5D523E4",
"365296EB1B---FCF69E5D553D4",
"365296EB1B---FCF63E5D553D4"
],
"comment": "test",
"incident_id": 5
}
}Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| request_data | Yes | A dictionary containing the API request fields. |