Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
LostBoY
Advisor

Custom IOC Indicators

Hello,

 

I am trying to block certain hashes and domains by creating a csv indicator file.. it is fine for most of the fields.. however, for some rows i am getting the following error message " 

"value in observ23 is not a valid md5" .. is this because the value i am entering might be a SHA value instead of MD5 ?

Also, IOC only recognizes MD5 value.. how do i block SHA hashes then ? 

 

Thanks

0 Kudos
Reply
1 Reply
Kim_Moberg
Advisor

Hi

Question: do you use R81 or R80.40?

In the csv file do you conbine md5 and sha hashes and domains?

AFAIK you need to separate each one in it’s own csv file and importing it seperatly.

in R81 it is easy to map but in R80.40 you need to query with IOCfeeder command.

Best Regards
Kim
0 Kudos
Reply