Adds a rule to a custom blacklist based on the md5sum hash file.
A blacklist allows you to control which messages that contain an attachment must be considered malicious based on the matched known rule entries. The appliance immediately marks the attachment within an email message for quarantine if it includes the md5sum hash file.
You can add up to 10,000 blacklist entries to the appliance database.
Syntax
[no] analysis custom blacklist md5sum <md5sum> [signature <md5sumSignature>]
Parameters
no
Use the no form of this command to delete the blacklist rule based on the md5sum hash file.
<sha256>
The specific md5sum hash file that is added as a blacklist rule.
signature
(Optional) The md5sum signature that is associated with the specific SHA-256 hash file.
<md5sumsignature>
(Optional) The specific md5sum signature.
Example
The following example adds the md5sum hash file "874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1" and the associated md5sum signature "Custom.Blacklist" to a custom blacklist:
hostname (config) # analysis custom blacklist smd5sum874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1 signature Custom.Blacklist
The following example deletes the md5sum hash file "874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1" and the associated md5sum signature from a custom blacklist:
hostname (config) # no analysis custom blacklist md5sum 874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1
User role
Admin or Operator
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Malware Analysis: Release 11.0.0
File Protect: Release 11.0.0
Network Security: Release 11.0.0