Hash Exceptions Commands

• addFileToAllowlist
• removeFileFromAllowlist
• addFileToBlocklist
• removeFileFromBlocklist
• checkAllowBlockLists

addFileToAllowlist

---

Adds files to the allowlist by their SHA256 hash, preventing them from being blocked or quarantined.

Arguments

Argument Name	Description	Required
hash_list	A comma-separated list of SHA256 hashes to add to the allowlist.	Required
comment	A comment to associate with the allowlist entry.	Optional
case_id	The case/incident ID to associate with the allowlist entry.	Optional
detailed_response	Whether to split the response into Added (hashes now on the allowlist) and Excluded (hashes rejected because they are already on the blocklist). Default: false (every input hash reported as Added on success). Possible values are: true, false. Default is false.	Optional

Outputs

Core.Allowlist.FileHash string

The SHA256 file hash.

Core.Allowlist.Status string

The status of the hash operation: Added, Excluded, or Removed.

removeFileFromAllowlist

---

Removes files from the allowlist by their SHA256 hash, so they are no longer trusted by default and can again be blocked or quarantined.

Arguments

Argument Name	Description	Required
hash_list	A comma-separated list of SHA256 hashes to remove from the allowlist.	Required
comment	A comment to associate with the removal.	Optional
case_id	The case/incident ID to associate with the removal.	Optional

Outputs

Core.Allowlist.FileHash string

The SHA256 file hash.

Core.Allowlist.Status string

The status of the hash operation: Added, Excluded, or Removed.

addFileToBlocklist

---

Blocks requested files that are not already on the block list or the allow list.

Arguments

Argument Name	Description	Required
case_id	The case/incident ID to associate with the blocklist entry.	Optional
hash_list	A comma-separated list of SHA256 hashes to add to the blocklist	Required
comment	A comment to associate with blocklist entry.	Optional
detailed_response	Whether to split the response into Added (hashes now on the blocklist) and Excluded (hashes rejected because they are already on the allowlist). Default: false (every input hash reported as Added on success). Possible values are: true, false. Default is false.	Optional

Outputs

Core.Blocklist.FileHash string

The SHA256 file hash.

Core.Blocklist.Status string

The status of the hash operation: Added, Excluded, or Removed.

removeFileFromBlocklist

---

Removes file hashes from the blocklist, allowing files with those hashes to run again.

Arguments

Argument Name	Description	Required
hash_list	A comma-separated list of SHA256 hashes to remove from the blocklist.	Required
comment	A comment to associate with the removal.	Optional
case_id	The case/incident ID to associate with the removal.	Optional

Outputs

Core.Blocklist.FileHash string

The SHA256 file hash.

Core.Blocklist.Status string

The status of the hash operation: Added, Excluded, or Removed.

checkAllowBlockLists

---

Arguments

Argument Name	Description	Required
sha256	The SHA256 hash to check. Must be a 64-character hexadecimal string.	Required

Outputs

Core.AllowBlockListResult.sha256 string

The SHA256 hash that was checked.

Core.AllowBlockListResult.in_block_list boolean

Whether the hash was found in the block list.

Core.AllowBlockListResult.in_allow_list boolean

Whether the hash was found in the allow list.

Core.AllowBlockListResult.block_list_entry unknown

The matching block list entry, if found.

Core.AllowBlockListResult.allow_list_entry unknown

The matching allow list entry, if found.

Checks whether a SHA256 hash is present in the blocklist or allowlist.