This workflow appears in the pivot menu and allows you to add a file hash to a blocklist in SentinelOne. Supported observables: SHA-1

Targets: SentinelOne - v2.1

Steps:
* Validate the workflow input (if invalid, end the workflow)
* Add the SHA-1 hash to the SentinelOne blocklist

SentinelOne - Add Hash to Blocklist

The operating system to block the hash for. Valid values include: linux, macos, windows, windows_legacy

Operating System

An optional description to add to the blocklist item

Description

A list of one or more account IDs to apply the blocklist item to. This can be a single account ID or a comma-separated list of IDs. If you want to apply this blocklist item to your entire tenant, leave this blank and set Tenant Level to true.

Note that one of the following inputs is required: Account IDs, Group IDs, Site IDs, or Tenant Level

Account IDs

A list of one or more site IDs to apply the blocklist item to. This can be a single site ID or a comma-separated list of IDs. If you want to apply this blocklist item to your entire tenant, leave this blank and set Tenant Level to true.

Note that one of the following inputs is required: Account IDs, Group IDs, Site IDs, or Tenant Level

Site IDs

True if you want this blocklist item to apply at the tenant level. False if you want to apply the blocklist item specifically to account(s), site(s), or group(s). If set to false, you must provide at least one of: Account IDs, Site IDs, Group IDs

Tenant Level

A list of one or more group IDs to apply the blocklist item to. This can be a single group ID or a comma-separated list of IDs. If you want to apply this blocklist item to your entire tenant, leave this blank and set Tenant Level to true.

Note that one of the following inputs is required: Account IDs, Group IDs, Site IDs, or Tenant Level

SentinelOne - Add Hash to Blocklist

Description

Integration targets