https://community.checkpoint.com/t5/General-Topics/Custom-IOC-Indicators/m-p/106026#M20313 <P>Hello,</P><P>&nbsp;</P><P>I am trying to block certain hashes and domains by creating a csv indicator file.. it is fine for most of the fields.. however, for some rows i am getting the following error message "&nbsp;</P><P>"value in observ23 is not a valid md5" .. is this because the value i am entering might be a SHA value instead of MD5 ?</P><P>Also, IOC only recognizes MD5 value.. how do i block SHA hashes then ?&nbsp;</P><P>&nbsp;</P><P>Thanks</P> Mon, 21 Dec 2020 11:29:10 GMT LostBoY 2020-12-21T11:29:10Z https://community.checkpoint.com/t5/General-Topics/Custom-IOC-Indicators/m-p/106026#M20313 <P>Hello,</P><P>&nbsp;</P><P>I am trying to block certain hashes and domains by creating a csv indicator file.. it is fine for most of the fields.. however, for some rows i am getting the following error message "&nbsp;</P><P>"value in observ23 is not a valid md5" .. is this because the value i am entering might be a SHA value instead of MD5 ?</P><P>Also, IOC only recognizes MD5 value.. how do i block SHA hashes then ?&nbsp;</P><P>&nbsp;</P><P>Thanks</P> Mon, 21 Dec 2020 11:29:10 GMT https://community.checkpoint.com/t5/General-Topics/Custom-IOC-Indicators/m-p/106026#M20313 LostBoY 2020-12-21T11:29:10Z https://community.checkpoint.com/t5/General-Topics/Custom-IOC-Indicators/m-p/106034#M20316 <P>Hi</P><P>Question: do you use R81 or R80.40?</P><P>In the csv file do you conbine md5 and sha hashes and domains?</P><P>AFAIK you need to separate each one in it’s own csv file and importing it seperatly.</P><P>in R81 it is easy to map but in R80.40 you need to query with IOCfeeder command.</P> Mon, 21 Dec 2020 12:47:02 GMT https://community.checkpoint.com/t5/General-Topics/Custom-IOC-Indicators/m-p/106034#M20316 Kim_Moberg 2020-12-21T12:47:02Z