This workflow template streamlines the process of blacklisting SHA1 file hashes across SentinelOne sites. It employs a systematic approach of ensuring that each Site ID is valid and active, checks if the file hash provided is SHA1 (as only SHA1 hashes are supported in the Blacklist), and subsequently adds the hash to the Blacklist. If no list of sites is specified, the hash is added to all active sites. This workflow is essential for bolstering cybersecurity by automating the blacklisting of identified malicious SHA1 hashes to prevent potential threats.
Optional Triggers
"This workflow is intended to be used as a nested function."
Use Cases
Example
Workflow Breakdown
Verifies each Site ID to be from valid and active Site.
Checks that file hash is SHA1. Only SHA1 hash is supported in the Blacklist.
Add the Hash to the Blacklist if it is not already blacklisted.
Vendors
Utils, SentinelOne
Workflow Output
Valid SHA1 hashes are blacklisted in active valid sites. Errors are collected when Hash and Sites IDs are not valid, or when there is already a blacklisted entry.
Tips
Automate Blacklisting of External IoCs