A CSV file is used for importing file hashes into the Deny List module. The file hashes supported are MD5 and SHA-256. There are 39 default file extensions to be scanned which can also be increased. For performance reasons, Deny List does not scan files which are more than 100MB in size for the configured file paths.
The CSV file used for importing hashes has four primary fields.
All the headers of the columns are required.
file_hash value (required) - File hash of a file
type value (required) - Type of the file hash.
Supported file hash types: MD5 and SHA256
action value (optional) – The action to be taken on detected file
Alert - An alert is generated when the file is attempted to be accessed.
Block - A block action is performed when the file is attempted to be accessed.
Quarantine - A quarantine action is performed when the file is attempted to be accessed.
comments value (optional) - The comment description is used in the alert name
The CSV file used for importing file paths to in the Deny List module has three primary fields.
file_path value (required) - File path of a file
action value (optional) – The action on detected file
Alert - An alert is generated when the file is attempted to be accessed.
Block - A block action is performed when the file is attempted to be accessed.
Quarantine - A quarantine action is performed when the file is attempted to be accessed.
comments value (optional) - The comment description is used in the alert name
Note
If an entry for a file exists in both the hash and file path list, the action associated with the file path will always take precedence over the hash list.
Important
The Deny List module does not support file paths that include wildcard characters.