It's possible to block custom file hash-256 in Palo alto.

Mohammed_Yasin — Mon, 14 Sep 2020 13:57:54 GMT

It's possible to block custom file hash-256 in Palo alto.

Please let me know how I can check the respective file hashes disposition at a wildfire, either it is in block or not.

Here is below the file hashes need to know for disposition.

f743c0849d69b5ea2f7eaf28831c86c1536cc27ae470f20e49223cbdba9c677c
e56d45628f0c2bda30ab235657704aac50a8433bdb4215c77a2e0f52f0f31a49
ae431797c551c20fe2f3fe1adc08a566edfabf45abbd924f0c8da06381ab6e48
4f7dd00a005caf046dd7e494fea25be2264974264d567edfc89122242b7c41bc
5ae06a8d117e876476832245039715825fbfbefc0d2463ab6c30295dd1d4afa6
36be48e4eac81ad77aeade20b28ff8b72275832e6833f5e1b692eb99f312fd13

Re: It's possible to block custom file hash-256 in Palo alto.

mivaldi — Wed, 16 Sep 2020 21:08:20 GMT

You don't block by hash, you block by file pattern using the Antivirus engine, and a signature would exist if the sample is identified by WildFire as malicious.

You can check what signatures produce coverage by querying the SHA256 hashes in ThreatVault https://threatvault.paloaltonetworks.com/

If there is a malicious file that needs coverage, submit it to WildFire at https://wildfire.paloaltonetworks.com/

topic It's possible to block custom file hash-256 in Palo alto. in Advanced Threat Prevention Discussions

It's possible to block custom file hash-256 in Palo alto.

Re: It's possible to block custom file hash-256 in Palo alto.