> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-file-execution.md).

# Manage file execution

You can manage file execution on your endpoints by adding file hashes to your allow and block lists. If you trust a certain file and know it to be benign, you can add the file hash to the allow list. This allows the file to be executed on all your endpoints regardless of the WildFire or local analysis verdict. Similarly, if you want to always block a file from running on your endpoints, you can add the associated hash to the block list.

Adding files to the allow and block lists takes precedence over any other policy rules that are applied to these files. In the **Action Center**, you can monitor the allow and block list actions performed in your network, and add or remove files from these lists.

Supported file types are:

<table><thead><tr><th width="198">Operating system</th><th>Supported file types</th></tr></thead><tbody><tr><td>Windows</td><td><ul><li>PE, PE64</li><li>doc, docx, xls, xlsx (only if they contain macro files)</li><li>PS1</li></ul></td></tr><tr><td>Mac</td><td>macho, DMG</td></tr><tr><td>Linux</td><td>ELF</td></tr></tbody></table>

#### **How to add a file to the allow or block list or allow list**

1. Go to **Investigation & Response → Response → Action Center →** **New Action**.
2. Select **Add to Block List** or **Add to Allow List**.
3. Enter the SHA-256 hash of the file and click ![blue-arrow.png](/files/E7nSNdEPZZU4O6mN8APu).

   You can add up to 100 file hashes at one time. If you add a comment, it is added to all the hashes you added in this action.
4. Click **Next**.
5. Review the summary and click **Done**.

   In the next heartbeat, the agent retrieves the updated lists from Cortex XSIAM.
6. You are automatically redirected to the **Block List** or **Allow List** that corresponds to the action in the **Action Center**.
7. To manage the file hashes on the **Block List** or the **Allow List**, right-click a file to see the available actions.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response/investigate-files/manage-file-execution.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.