Press CTRL+K to open search

Conventions for uploaded lists of conditions

  • Published on Sep 10, 2026
  • 2 minute(s) read
Prev Next

Here are the general conventions for uploading lists of conditions.

  • Create one file for each indicator.

  • Each file can contain one list of conditions.

  • Files should be either Unix or Windows text (*.txt) files (formatted using either UTF-8 or ASCII).

  • Each file can contain no more than 10,000 conditions.

  • Each file can contain only one value per line, and each line must end with a hard return.

  • A file can contain a mix of MD5 hashes, domain names, and IP addresses. A domain name is a sequence of alphanumeric characters and the following three special characters:

    _ (low line or underscore)

    - (high line or hyphen)

    . (dot or period used to separate other characters in the sequence)

    Note

    If you mistakenly enter only part of an MD5 hash or IP address, the Endpoint Security (HX) appliance may accept the entry as a domain name (the entry appears as a hostname in a condition).

  • Use shell-style commenting to hide comments or conditions. Insert a pound character (#) at the beginning of each line that you want the Endpoint Security (HX) appliance to ignore.

  • Leading and trailing spaces and blank lines are ignored.

  • The Endpoint Security (HX) appliance replaces, but does not add, duplicate entries in a list.

:
Related articles
  • Conventions for uploaded lists of conditions
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat detection using IOC rules > Threat detection using IOC rules in the Forensics workspace > Maintain custom indicator rules > Create a custom indicator rule using uploaded lists of conditions in the Web UI
  • Create a custom indicator rule using uploaded lists of conditions in the Web UI
    Endpoint Security (HX) > Endpoint Security (HX) Server 10.x User Guide > Configuration > Manage IOC rules > Maintain custom indicator rules > Create custom indicator rules by uploading lists of conditions
  • Create a custom indicator rule using uploaded lists of conditions in the Web UI
    Endpoint Detection and Response with Forensics (EDRF) > Detect and handle potential threats with EDRF > Configure EDRF to detect potential threats > Threat detection using IOC rules > Threat detection using IOC rules in the Forensics workspace > Maintain custom indicator rules > Create a custom indicator rule using uploaded lists of conditions in the Web UI