After Advanced Threat Protection: Network returns a negative reputation for a file, whitelisting the SHA256 hash of the file does not work

Products

• Advanced Threat Protection Platform

Issue/Introduction

When downloading a file and receiving a negative reputation verdict, the file is blocked. When the SHA256 hash is added to the whitelist and the download is attempted again, it is still blocked.

Cause

When the ATP: Network function blocks a file due to poor reputation, the URL where that file was accessed is added to the ATP's internal blacklist for 24 hours. After 24 hours the entry is removed.

Resolution

In order to manually override the negative reputation the entire URL for that file needs to be added to the whitelist.