Global Settings / Blocked Items has an item limit of 1000 SHA-256 hashtags?

Because of the increased cyber attacks due to the tragedy currently occurring in Eastern Europe, "We" (The owner/CEO) received a pack of Email  and IP Addresses / URLs / SHA-256 to block from the Government.

1) Sophos really needs to make it easier to import blacklists.  Seriously.  Our old much less expensive solution was way better in that regards.

2) Sophos also needs to look at how input windows work in their products, click once the window resizes - click again it resizes again - hit save or add another it resizes for the third time, moving the buttons each and every time.

3) So after setting up AutoIt (which was a nightmare due to point 2) I was able to start importing  the SHA-256 list.  Setting it to stop after importing 2000 of the over 7000 in the list I received, so I could hit save.

4) So the list showed the 2000 items I added and I hit save, I received the green pop-up that it had saved successfully and the window closed. When reopening the window I saw that it only listed 1000 of the 2000 items I had just added. I added a few manually to get the number upto 1010 hit save again and when opening the window again it was back to 1000.

So here I am asking if there is a hard limit on how many hashtags someone can add to sophos, so I can pass the information on to my team-leader.  In case one of the over 6000 hashtags I wasn't able to add is the reason our network gets compromised I have a CMA.

Top Replies

  • I would think the API might be one way to go for a large batch job rather than automating the UI.  I assume it's this one: Endpoint API | Sophos Central APIs

    That said for simplicity, I did just do the following to see what would happen:

    Open the Dev tools of the browser and see the POST to the the following API (for my region)

    This was observed by just adding a single entry first and clicking Save in the UI. 
    From the Dev tools (Network view), you can "Copy as Powershell" to get a PowerShell command that would "replay" the post with all the correct auth headers etc.. From there in an ISE Window paste the script and just made a request for 1010 SHA256 as read from a file.

    It added the first 1000 and the pagination info at the bottom just maxes out at:

    1-25 of 1000

    So there does appear to be a 1000 hash limit.

    Jump to answer
Parents
  • Hi Shawn,

    Thanks for reaching out to us.

    I recommend sending in this request as a sample submission. Our Sophos Labs team can check the list of SHA values provided to let you know if any of them are already being detected by Sophos. 
    If some of the indicators of compromise are not yet present in our detection databank, they will be added in by our team. 
    - Submit a Sample

    Regarding the behavior you are experiencing when adding entries to the "Blocked Items" list, does scrolling to the bottom of the list to render additional items load more entries, or are you finding that this remains capped at 1000?

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply
  • Hi Shawn,

    Thanks for reaching out to us.

    I recommend sending in this request as a sample submission. Our Sophos Labs team can check the list of SHA values provided to let you know if any of them are already being detected by Sophos. 
    If some of the indicators of compromise are not yet present in our detection databank, they will be added in by our team. 
    - Submit a Sample

    Regarding the behavior you are experiencing when adding entries to the "Blocked Items" list, does scrolling to the bottom of the list to render additional items load more entries, or are you finding that this remains capped at 1000?

    Kushal Lakhan
    Global Community Support Engineer
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Children