Add To Blocklist Deep Visibility

From Deep Visibility results, add a SHA1 hash to the Blocklist. Set the scope of the Blocklist: Global, Account, Site, or Group. The SHA1 and the agent ID are required (see Deep Visibility > Get Events). Your role must have permissions to change the Blocklist - Admin, IR Team, SOC - and your user scope access must include the scope of the agent.

Parameters

Parameter	Description
Agent ID	Agent that reported the DV event.
Hash	Hash to add to restrictions.
Target Scope	Scope to be used for restrictions.

Example Output

{
    "errors": [
        {
            "type": "object"
        }
    ],
    "data": {
        "affected": "integer"
    }
}

Workflow Library Example

Add to Blocklist Deep Visibility with Sentinelone and Send Results Via Email

Preview this Workflow on desktop