Hello,
Given the following text that has been copied by Administration guide:
Identifying Files by SHA-256 Hash
Because filenames can easily be changed, the appliance generates an identifier for each file using a Secure
Hash Algorithm (SHA-256). If an appliance processes the same file with different names, all instances are
recognized as the same SHA-256. If multiple appliances process the same file, all instances of the file have
the same SHA-256 identifier.
In most reports, files are listed by their SHA-256 value (in an abbreviated format)
It seems that it is not possible to block a file by its hash.
I have heard that it may be possible if you configure external threat feeds, but still I am not certain what should be configured in order to protect the organization against a potential attack.
Any other ideas?
