App Control: How to Ban Or Approve Bulk Hashes

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

How to create an Approval or a Ban for a bulk list hashes in the Console.

Environment

• App Control Console: All Supported Versions

Resolution

1. Login to the Console and navigate to Rules > Software Rules > Files.
2. Click Import and specify the Rule Name, Description, Rule Type, and applicable Policies.
3. Click Choose File to specify the file containing the list of hashes.
4. Click Upload to begin creating a File Rule for each hash in the file.

Additional Information

• The file must contain a list of MD5, SHA-1, or SHA-256 hashes, with only one hash per line.
• It is recommended that only one hash type (MD5, SHA-1, SHA-256) be used per file. Mixing types in one file may cause unpredictable results.
• All hashes in the file will have the same Rule Type (Approval or Ban).
• Over-reliance on hash Bans and or Approvals can cause performance issues with both the Agent and the Server.