Add To Block List
Add threats that have a SHA1 hash and that match the filter to the Blocklist of the target scope: Global, Account, Site, or Group. Your role must have permissions to change the Blocklist - Admin, IR Team, SOC - and your user scope access must include the Agent.
Parameters
Parameter | Description |
---|---|
Agents IDs | List of agents IDs to filter by. |
Target Scope | Scope to be used for Restrictions. |
Threats IDs | List of threats IDs to add to exclusions. |
Example Output
{
"errors": [
{
"type": "object"
}
],
"data": {
"affected": "integer",
"details": [
{
"analystVerdict": "updated",
"result": "created",
"threatId": "225494730938493804"
}
]
}
}
Workflow Library Example
Add to Block List with Sentinelone and Send Results Via Email