search cancel

After Advanced Threat Protection: Network returns a negative reputation for a file, whitelisting the SHA256 hash of the file does not work


Article ID: 163936


Updated On:


Advanced Threat Protection Platform


When downloading a file and receiving a negative reputation verdict, the file is blocked. When the SHA256 hash is added to the whitelist and the download is attempted again, it is still blocked.


When the ATP: Network function blocks a file due to poor reputation, the URL where that file was accessed is added to the ATP's internal blacklist for 24 hours. After 24 hours the entry is removed.


In order to manually override the negative reputation the entire URL for that file needs to be added to the whitelist.