topic Re: Does FMC support SHA256 hash blocking via external dynamic list in Endpoint Security

Does FMC support SHA256 hash blocking via external dynamic list

Syed Vali Uddin — Mon, 17 Jul 2023 06:59:59 GMT

Is there an option in Cisco FMC to block Hash via EDL method, similar to the option available for blocking IP, Domain, and URL via EDL in FEEDs in security intelligence section?

Currently, it only allows manual creation and upload of a file list containing hashes to be blocked.

Re: Does FMC support SHA256 hash blocking via external dynamic list

Jonatan Jonasson — Sun, 23 Jul 2023 23:29:42 GMT

In Integration->Intelligence->Sources, when you create a new source using delivery type URL and type Flat File, you have the option of selecting the content as "sha-256"

(See attached screenshot for reference.)
Is this not what you are asking for?

Re: Does FMC support SHA256 hash blocking via external dynamic list

Marvin Rhoads — Mon, 24 Jul 2023 18:27:21 GMT

That looks promising and I believe it should do what the OP is asking.

Re: Does FMC support SHA256 hash blocking via external dynamic list

Syed Vali Uddin — Wed, 23 Aug 2023 06:12:17 GMT

Thanks for the solution. I also wanted to confirm if there is a specific path, when I log in via the console, where I can find the list of SHA256 hashes that have been synchronized with FMC?
As off now I am unable to see any sort of status on the web UI.