From Deep Visibility results, add a SHA1 hash to the Blocklist. Set the scope of the Blocklist: Global, Account, Site, or Group. The SHA1 and the agent ID are required (see Deep Visibility > Get Events). Your role must have permissions to change the Blocklist - Admin, IR Team, SOC - and your user scope access must include the scope of the agent.

​
Parameters

ParameterDescription
Agent IDAgent that reported the DV event.
HashHash to add to restrictions.
Target ScopeScope to be used for restrictions.

​
Example Output

{
	"errors": [
		{
			"type": "object"
		}
	],
	"data": {
		"affected": "integer"
	}
}

​
Workflow Library Example

Add to Blocklist Deep Visibility with Sentinelone and Send Results Via Email
Workflow LibraryPreview this Workflow on desktop