Add file hash to access list to remediate false positives

[mikeyland1981]

We are currently using our MWG as an ICAP server running version 9.2.8. We have seen an up tick in false positives and trying to submit each one and waiting to have it added to the DAT file doesn't work for some of our customers. We are looking to see if there is a solution that we can take the file hash from the false positive file and add it to an allow list so that we can get rid of our false positives more quickly

[tarunmann · Accepted solution]

Hi Mike,

If I understand you correctly, do you just want to allow the file through if the hash of the file being scanned matches in a list? That should be possible. You can create an event that stores the MD5 or SHA1 hash of the file being scanned into a User Defined Property and then take that result and match it to the list. If there is a match you can stop the ruleset, else continue scanning.