Managing hashes

The Reputations section of the Client Management Overview page shows a list of hashes that are malicious or non-malicious. You can view additional context for each hash, and for certain sources you can also view additional information on the source's website. You can also search for file hashes and add, import, export, or delete reputation data hashes.

Hashes that you add to the hash list are not sent to reputation sources for analysis.

View additional hash data

  1. In the Reputations section, click the Malicious tab.
  2. To sort a column, click the column header.
  3. Click Open to expand the Hash line-item to view reputation data for a hash.

Add data hashes

  1. In the Reputations section, click the Hash List tab.
  2. To sort a column, click the column header.
  3. Click Add.
  4. To add hashes that are known to be malicious, select Malicious, enter the Hashes and any Notes to associate with each hash, and click Save.
  5. To add hashes that are known to be false detections, select Non-Malicious, enter the Hashes and any Notes to associate with each hash, and click Save.

The Hashes field is limited to 1,000 hashes. To add more than 1,000 hashes at one time, use a file import. For more information, see Import hashes.

Import hashes

Import a CSV file containing one or more MD5, SHA-1, or SHA-256 file hashes. You can include the following header fields in the CSV file:

Header field Required Description
hash Required if md5, sha1, and sha256 are not included, Optional if md5, sha1, and sha256 are included An MD5, SHA-1, or SHA-256 file hash value.
list Required Whether the file hash value is malicious or non-malicious.
md5 Required if sha1 and sha256 are included, Optional if hash is included An MD5 file hash value.
notes Optional A string describing the file hash value.
sha1 Required if md5 and sha1 are included, Optional if hash is included A SHA-1 file hash value.
sha256 Required if md5 and sha1 are included, Optional if hash is included A SHA-256 file hash value.
uploadedAt Optional The timestamp at which this file hash value is uploaded. If undefined, this defaults to the current time.
uploadedBy Optional The user that uploaded this file hash value. If undefined, this defaults to your user.
uploadedHash Optional The uploaded file hash value.

At a minimum, a CSV file requires the hash and list header fields, with one file hash per row. You can also upload a CSV file with the md5, sha1, sha256, and list header fields, with at least one file hash per row.

  1. In the Reputations section, click the Hash List tab.
  2. Click Import.
  3. Click Browse and select the file to import.
  4. Select a Method for the import:
    • To replace the current hashes, select Replace existing list.
    • To append to the current hashes, select Add to existing list.
  5. Click Save.

Client Management automatically handles consolidating duplicate records by learning from service providers when different types of hashes represent the same file.

If you want to manually consolidate hashes, you can export the existing hash list, edit the file to add hashes in the appropriate columns for a specific row, and then import the updated file using the Replace existing list option.

Export hashes

  1. In the Reputations section, click the Hash List tab.
  2. To export specific hashes, select one or more hashes and click Export .
  3. To export all malicious hashes, click the Malicious tab, and then click Download All.

Edit notes

  1. In the Reputations section, click the Hash List tab.
  2. Select a hash and click Edit Notes.
  3. Update the notes for the hash and click Save.

Remove hashes

  1. In the Reputations section, click the Hash List tab.
  2. To delete specific hashes, select one or more hashes and click Remove from Hash List .