Use the following commands to manage the Trellix Intelligent Sandbox blacklist.
Syntax:
To add an MD5 to the blacklist, use
blacklist add <md5> <score> <file_name> <malware_name> <Eng-ID> <OS-ID>Parameter
Description
<md5>
The MD5 hash value of a malware that you want to add to the blacklist.
<score>
The malware severity score. A valid value is from 3 to 5.
<file_name>
The file name for the MD5.
<malware_name>
The malware name for the MD5.
<Eng-ID>
The numerical ID for the engine that detected the malware. Following is the numerical coding. Sandbox — 0, GTI — 1, GAM — 2, Anti-Malware — 4.
<OS-ID>
The numerical ID of the operating system that was used to dynamically analyze the malware.
Example:
blacklist add 254A40A56A6E28636E1465AF7C42B71F 3 ExampleFileName ExampleMalwareName 4 2To delete an MD5 from the blacklist, use
blacklist delete <md5>Parameter
Description
<md5>
The MD5 hash value of a malware that you want to delete from the blacklist.
Example:
blacklist delete 254A40A56A6E28636E1465AF7C42B71FTo check if an MD5 is present in the blacklist, use
blacklist query <md5>Parameter
Description
<md5>
The MD5 hash value of a malware that you want to query if it is present in the blacklist.
Example:
blacklist query 254A40A56A6E28636E1465AF7C42B71FIf the MD5 is present, the details such as the engine ID, malware severity score, and so on, are displayed.
To update the details for an entry in the blacklist, use
blacklist update <md5> <score> <file_name> <malware_name> <Eng-ID> <OS-ID>Parameter
Description
<md5>
The MD5 hash value of a malware that you want to update. This value must exist in the blacklist for you to update the record.
<score>
The new malware severity score that you want to change to. A valid value is from 3 to 5.
<file_name>
The new file name for the MD5.
<malware_name>
The new malware name for the MD5.
<Eng-ID>
The new engine ID that you want to change to.
<OS-ID>
The new value for the operating system that was used to dynamically analyze the malware.
Example:
blacklist update 254A40A56A6E28636E1465AF7C42B71F 4 ExampleFileName ExampleMalwareName 2 4