SentinelOne - Add Hashes to Blocklist
Details
This playbook task workflow can be added to an incident response playbook and allows you to add one or more SHA1 file hashes to the blocklist in SentinelOne.
Description
This playbook task workflow can be added to an incident response playbook and allows you to add one or more SHA1 file hashes to the blocklist in SentinelOne. Supported observables: SHA1.
Targets: SentinelOne - v2.1 integration target
Steps:
- Validate the workflow input (if invalid, end the workflow)
- For each selected observable:
- Add the SHA1 hash to the SentinelOne blocklist
- Check if adding the hash was successful and update the workflow results
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- SentinelOne Singularity
About
Author
Cisco
Version
v1.0
Intent
Playbook Task
Integration
Average rating
No ratings yet
Authorship
Cisco Managed
Contact and support information
External links
Related workflows
Cisco Managed
This workflow appears in the pivot menu and allows you to add a file hash to a blocklist in SentinelOne.
Cisco Managed
This playbook task workflow can be added to an incident response playbook and allows you to add one or more SHA1 file hashes to the blocklist in SentinelOne.
Cisco Managed
This workflow appears in the pivot menu and allows a user to re-connect an agent to the network in SentinelOne.
Cisco Managed
This workflow appears in the pivot menu and allows a user to disconnect an agent from the network in SentinelOne.
Cisco Managed
This incident response workflow allows you to identify and document vulnerabilities of hosts in an incident using SentinelOne from a playbook or using an automation rule.
Cisco Managed
This workflow appears in the pivot menu and allows you to remove a file hash from the blocklist in SentinelOne.