Blocked Hashes

Blocked hashes acontain a list of executables/hashes that are being blocked by all security products connected to ESET Enterprise Inspector.

Security engineers can add blocked hashes either from executables table, executables detail, or they can be entered manually from any other source.

Hashes support only SHA1. It allows companies to remediate any malicious code (prevent its execution ex-post, or even proactively, if they will, for example, get the hashes in the form of an IOC feed).

Whenever an attempt to execute a blocked executable occurs, it is reported as a security incident to ESET Security Management Center, and listed under a specific “threats” section category – blocked files.

Admin_Blocked_Hashes

The Blocked hashes tab allows you to interact with the list of hashes.

It allows blocking hashes from external tools as well.

Right-click executable name or left click anywhere else on the row, brings up a context menu with the following options:

Details—same as Executable Details when clicking the name of the executable.

Details(New Tab)—you are redirected to Executable Details, but in the new tab

Statistics—you are redirected to the Statistics tab

Detections—you are redirected to the Detections tab

Seen On—you are redirected to the Computers tab

Source—you are redirected to the Executable sources

Unblock—unblocks the hash and make it possible to work with the executable without blocking it. Available only if some blocked hashes are selected. You can select all blocked hashes by selecting the check box on the left side of the Name column header, or you can select each blocked hash individually by selecting its corresponding check box. Can use also the button Admin_Blocked_Hashes_Unblockat the bottom of the view

Clean & Quarantine—it deletes the file and put it to quarantine in the Endpoint. Available only if some blocked hashes are selected. You can select all blocked hashes by clicking the check box on the left side of the Name column header, or you can select each blocked hash individually by selecting its corresponding check box. Can use also the button Admin_Blocked_Hashes_Clearat the bottom of the view

Tags—used to tag the computer. After choosing this option, new window for tag edition opens. In the Select field, you can type new tag or select already existing one. You can use also the button at the bottom of the screen, shows the list of assigned tags.

Display Absolute/Relative Time—Absolute time will show the time in format DD/MM/YYYY HH:MM:SS. Relative time will show the time in the format minutes/hours/months in relation to present time, like "15 minutes ago" or "6 days ago"

Filter—you can find these quick filters, depending on the column:

oShow only this—Shows only records, based on this particular value

oHide this—Hides all records, based on this particular value

oShow before—Shows only records, that are before this value (for example time)

oShow after—Shows only records, that are after this value (for example time)

oShow lower—Shows only records, which value is lower then this particular one

oShow higher—Shows only records, which value is higher then this particular one

These buttons are available at the bottom of the window:

Admin_Blocked_Hashes_Add_Hashes—it redirects you to Block Hashes window

Tags

Tagging is an additional form of filtering that can connect multiple objects through multiple views (computer, executable, event filter, etc.). If available, the tag icon Tag_Panel is on the left side, next to the name of the view. In the Computers view, the tag panel can be accessed by clicking the Three_dots icon. In the opened tag panel, all created tags are listed and ready to use. If the list of tags is already too long, you can use the magnifying glass to search for a specific tag. At the top of the screen, the Tag_Top selector can be used to select the desired tags. If available, the user can use also Tags button located at the bottom of the screen among action buttons.

Additional filters

The additional filters are accessible by clicking the Add_Filter or by clicking on an empty space next to the add filter button, where the list of available filters shows and the user is able to search filter by typing its name or selecting from the list. For the definitions of the additional filters, follow here.

Some of the filters have a funnel Executables_Funnelnext to it with two or four possible predefined options:

Unknown—the value in the filtered column is not available (probably not known value at the time of occurrence)

Known—the value is available

None—value is an empty string

Any—the value is not empty. The negation of None filter

If present on the screen you, can refresh the table by clicking the refresh iconAlarms_Refresh. If available, the export icon Export_CSV can be used to export the table grid to CSV format and use it in other applications to work with the list.

If present, click the Alarms_Filter_Iconbutton to manage filter sets. These options are available:

Save filters—allows you to save the actual filter set. Select the check box Include the visible columns and sorting to save also this setting of your selection, otherwise when loading saved filter without this option selected will end up by showing you the default column setting

Reset filters—resets active filter and return to default filter setting with default column setting

Reset view—resets the active view without resetting the filter set

Manage—allows you to manage your filter sets

Save Filters as Rule—if available, allows you to save the filter as a rule. You can find it then in the list of rules under the Detection rules sub-tab of admin tab

Columns

Columns can be reorganized by using Columns_Move icon, that appears on the right side of the column name when you hover the mouse over the column name.

The width of the column can be re-sized by the Column_Resize icon, that appears on the left side of the column name when you hover the mouse over the column name.

The order of the columns can be organized by clicking the name of the column:

Default (No icon)

Ascending Column_Ascending

Descending Column_Descending

You can change which columns are displayed after clicking the gear iconDashboard_Gearwheel and selecting the Select column option, or you can reset the view to default by clicking the Reset columns option. You can use Enter quick search pattern—here you can search for the column, by typing its name or a couple of letters from it. Useful if the list of columns is long. For the definitions of the columns follow here.