topic Re: Block files based on hash with SandBast Agent in Endpoint

Block files based on hash with SandBast Agent

MikeB — Fri, 10 Apr 2020 01:13:16 GMT

Is there a way to block files in SBA based on hash or some IoC?

Re: Block files based on hash with SandBast Agent

PhoneBoy — Mon, 13 Apr 2020 23:07:48 GMT

At the moment, there doesn't seem to be a way to block files in SBA based on some sort of file hash/ip/URL.
You may want to engage with your local office around this requirement.

Re: Block files based on hash with SandBast Agent

Kannan_R — Mon, 28 Jun 2021 11:57:54 GMT

Hello @PhoneBoy and experts, I would like to know if this feature is still not available? If not, is it in the pipeline / can we expect it anytime sooner?

Thanks,

Kannan

Re: Block files based on hash with SandBast Agent

PhoneBoy — Mon, 28 Jun 2021 19:48:50 GMT

@Kobie_Bendalak can you comment on this?

Re: Block files based on hash with SandBast Agent

Kannan_R — Mon, 05 Jul 2021 09:26:27 GMT

Hello Experts,

Would it be possible to get an update on this?

Re: Block files based on hash with SandBast Agent

MikeB — Mon, 05 Jul 2021 13:42:38 GMT

Currently, you can do a "File Remediation" Push Operation to move files to quarantine based on MD5/File Path/ Incident ID. this is totally reactive than preventive but works in most escenarios.

Re: Block files based on hash with SandBast Agent

Gabriellourenco — Tue, 05 Jul 2022 18:16:10 GMT

existe o Gerenciar IOCs:

https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Harmony-Endpoint-Admin-Guide/Topics-HEP/IOC-Management.htm