Adding or deleting a custom blacklist rule using the CLI

Use the CLI commands in this topic to add a rule to a custom blacklist or to delete a rule from a custom blacklist. You can add up to 10,000 blacklist entries to the appliance database.

Note
If you add a file extension to both a blacklist and a riskware rule, the blacklist takes precedence.

To add rules to a custom blacklist:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify the type of rule to add to a custom blacklist.
- To add a blacklist rule based on the SHA-256 hash file and the associated SHA-256 signature:
```
hostname (config) # analysis custom blacklist sha256 <sha256> signature <sha256_signature>
```
- To add a blacklist rule based on the URL:
```
hostname (config) # analysis custom blacklist url <URL>
```
- To add a blacklist rule based on a file extension:
```
hostname (config) # analysis custom blacklist file-extension <extension>
```
Verify that the specified SHA-256 hash file and the associated SHA-256 signature are added to the custom blacklist.
```
hostname (config) # show analysis custom blacklist
```
Verify that the specified URLs are added to the custom blacklist.
```
hostname (config) # show analysis custom blacklist urls
```
Verify that the specified extensions are added to the custom blacklist.
```
hostname (config) # show analysis custom blacklist file-extension
```
Save your changes.
```
hostname (config) # write memory
```

Examples

This example adds the URL "http://jx60-glj-4yl7.iur.trade/index/207.php" to a custom blacklist:
hostname (config) # analysis custom blacklist url http://jx60-glj-4yl7.iur.trade/index/207.php Successfully performed add operation on url:http://jx60-glj-4yl7.iur.trade/index/207.php
hostname # show analysis custom blacklist urls Custom Blacklist URLs: URL: Signature Name http://jx60-glj4yl7.iur.trade/index/207.php?M=19217077!N=232!L=207!F=H: Block-List-Match-Url
This example confirms that the URL "http://jx60-glj-4yl7.iur.trade/index/207.php" was already added:
hostname (config) # analysis custom blacklist url http://jx60-glj-4yl7.iur.trade/index/207.php %Unable to add: url already exists.
This example adds the SHA-256 hash file "874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1" and the associated SHA-256 signature "Custom.Blocklist" to a custom blacklist:
hostname (config) # analysis custom blacklist sha256 874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1 signature Custom.Blocklist hostname (config) # show analysis custom blacklist Custom blacklists: Sha256 : Signature Name 874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad:Custom.Blocklist

This example adds the extension "exe" to a custom blacklist:

hostname (config) # analysis custom blacklist file-extension exe hostname # show analysis custom blacklist file-extension

      Policy Type: blacklist

      Id:             : 14
      UUID:           : 6b66a499-2c99-4ca9-814a-76b56c325a11
      Rule Type:      : extension
      Source:         : Custom
      Extension:      : exe
      Signature:      : Custom.Extension.Block.exe

To delete rules from a custom blacklist:

Go to CLI configuration mode.

hostname > enable
hostname # configure terminal

Specify the type of rule to delete from a custom blacklist.
- To delete a blacklist rule based on the URL:
  hostname (config) # no analysis custom blacklist url <URL>
- To delete a blacklist rule based on the SHA-256 hash file and the associated SHA-256 signature:
  hostname (config) # no analysis custom blacklist sha256<sha256>
- To delete a blacklist rule based on the file extension:
  hostname (config) # no analysis custom blacklist file-extension <rule_ID>
Verify that the specified URLs are deleted from the custom blacklist.
hostname (config) # show analysis custom blacklist urls
Verify that the specified SHA-256 hash file and the associated SHA-256 signature are deleted from the custom blacklist.
hostname (config) # show analysis custom blacklist
Verify that the specified extensions are deleted from the custom blacklist.
hostname (config) # show analysis custom blacklist file-extension

Save your changes.

hostname (config) # write memory
Saving configuration file ... Done!

Examples

This example deletes the URL "http://jx60-glj-4yl7.iur.trade/index/207.php" from a custom blacklist:
hostname (config) # no analysis custom blacklist url http://jx60-glj-4yl7.iur.trade/index/207.php Successfully performed delete operation on url:http://jx60-glj-4yl7.iur.trade/index/207.php hostname (config) # show analysis custom blacklist urls url blacklist not found
This example confirms that the URL no longer exists:
hostname (config) # no analysis custom blacklist url http://jx60-glj-4yl7.iur.trade/index/207.php % Unable to delete: url not found
This examples deletes the SHA-256 hash file "874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad1" and the associated SHA-256 signature from a custom blacklist:
hostname (config) # no analysis custom blacklist sha256 874b0f0ba2cf612a195be31816a28d16a4a52847cdd45ce8c4b2670a0a0c1ad
This example deletes the extension "exe" from a custom blacklist:
hostname (config) # no analysis custom blacklist file-extension 14 hostname (config) # show analysis custom blacklist file-extension file-extension blacklist not found