Adding malicious hash values in TIE File overrides.

[Satish_Talatam]

Hi Team, I would like to know the best practices in adding malicious hash values to TIE reputation through file overrides. We receive malicious hash values through open source intelligence alerts.

Please suggest if it is recommended to add them in TIE reputation.

Thanks in advance.

[bbarnes]

Hello Satish_Talatam, 

Bulk adding malicious hashes to the TIE DB often just results in excessive information being available in the TIE database. As GTI often contains the same list of malicious hashes, the manual import efforts are duplicated. Any manual import also exists in the database forever...even if your environment never shows any evidence of those hashes. Over time this can inflate thee database with local override information that would have been available in GTI anyway. For that reason we typically recommend customizing a workflow with OpenDXL that first queries TIE for the hashes in your data source, and then only imports the ones that it finds are NOT AVAILABLE. More information about Open DXL can be found at www.openDXL.com.

Thanks

Brian Barnes