API BLOCK LIST

M.GUZMANCABRAL — Mon, 14 Oct 2024 20:46:47 GMT

Hello,

By doing or achieving different automations I have managed to add hashes to the block list in the action center section via API, but as in this console I see that it is blocked with 15,000 entries, let me explain when adding 15,000 hashes I understand that it will block new entries, so I would like to achieve that when a hash lasts 3 months or more blocked it is automatically deleted through the API, but I do not see a way to delete a hash from the block list by API or get the blocked ones in the blocklist by API, is there no way where I can do this or schedule this task? or some API route for these processes? or outside the API?

Re: API BLOCK LIST

nar — Mon, 21 Oct 2024 17:23:42 GMT

Hi @M.GUZMANCABRAL

Thanks for reaching LC!

I did some research around this topic, It appears that currently only adding Hash into the allow/block list is supported via API function as described here - https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/1a1950467783e-block-list-files

Using an API to remove Hash might be a feature request to work on.

Other than that I believe the option would be manual selection and deletion.

Regards,

topic Re: API BLOCK LIST in Cortex XDR Discussions

API BLOCK LIST

Re: API BLOCK LIST