This workflow template enables users to efficiently manage their cybersecurity by whitelisting SHA1 file hashes across multiple SentinelOne sites. It ensures only valid, active sites receive updates and strictly checks for SHA1 hash format to maintain compatibility with the exclusion lists. If a hash already exists on the whitelist, the system bypasses it to prevent duplicates, enhancing the security infrastructure without manual overhead.
Optional Triggers
"This workflow is intended to be used as a nested function."
Use Cases
Example
Workflow Breakdown
Verifies each Site ID to be from valid and active Site.
Checks that file hash is SHA1. Only SHA1 hash is supported in the Exclusion list.
Creates an exclusion with type white_hash if it is not already excluded.
Vendors
Utils, SentinelOne
Workflow Output
Valid SHA1 hashes are whitelisted in active valid sites. Errors are collected when Hash and Sites IDs are not valid, or when there is already an exclusion entry.
Tips
Automate Whitelisting of know local applications components or false positives