Add IOC SHA-256

[JeromeCA]

Hello,

Our security teams provide us a list of IOC with only SHA-256 informations.

How I can add this IOC list ? My environnement is based on ePO 5.10 and ENS10.7

BR

[Pravas]

Hi @JeromeCA ,

MD5 values can be used with Access Protection to block any processes. SHA-256 values are not supported at this time.

You may open a ticket with Support with the following details.

1) Hash list 

2) Any Blog/URL/Advisory referencing the hashes as malicious.

Thanks

[JeromeCA]

I have only sha-256 value, no other information....☹️

BR

[Pravas]

Hi @JeromeCA ,

No problem, We can verify the coverage status for you.

Please create a ticket by logging into the support site.

https://support.mcafee.com/

Thanks

[JeromeCA]

If I provide you only the sha-256 , you Can check if it's covered by default ?

BR

[KevRas]

I reported a SHA-256 and URL to McAfee Threat Labs and they were unable to find the file on the website. I was unable to block the SHA-256 has as the file was deleted and no MD5 Hash was produced. I need to block a SHA-256 using ENS modules across my entire network.

How can we get a PER going to add a SHA 256 Hash column to any of the ENS modules to block?