addToBlocklist

Use this method to set up one or more rules that you can use to add items to blocklists.

Important

This method has been updated to version 1.2. For information applicable to version 1.0, refer to this section.

Version 1.0 is only compatible with hash type blocklist rules.

Parameters

Parameter	Description	Included in request	Type	Values
`type`	Indicates the type of rules you want to create.	Mandatory	String	Possible values: `hash` `path` `connection` Example "type": "hash"
`rules`	Contains the list of rules you want to create and their assigned settings.	Mandatory	Array of objects	You can only add rules that match the type specified in the `type` parameter. Refer to `rules`. Example Rules of type `hash`: "rules": [ { "note": "test", "details": { "algorithm": "sha256", "hash": "1e0905327f443c54aa617e2ff323067c985428e5566886f2aa8296cddfe6ddf9" } }, { "details": { "algorithm": "md5", "hash": "13f6331c638b68d4e7eab6ea60da5473" } } ]

Parameter

Description

Included in request

Type

Values

type

Indicates the type of rules you want to create.

Mandatory

String

Possible values:

hash
path
connection

rules

Contains the list of rules you want to create and their assigned settings.

Mandatory

Array of objects

You can only add rules that match the type specified in the type parameter.

Refer to rules.

General parameters

These are common parameters, available across all public API methods:

Parameter	Description	Included in request	Type	Value requirements
`id`	This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking.	Mandatory	String	No additional requirements. Example "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
`method`	The name of the method you are using to send the request.	Mandatory	String	Must be a valid method name. Example "method": "methodName"
`jsonrpc`	The version of JSON-RPC used by the request and the response.	Mandatory	String	The only possible value is `2.0`. Example "jsonrpc": "2.0"
`params`	An object containing the configuration of the request.	Mandatory	Object	No additional requirements. Example "params": {...}

Objects

`rules`

Parameter	Description	Included in request	Type	Values
`note`	Describes this specific rule.	Optional	String	No additional requirements.
`details`	Identifies a specific rule and its settings.	Mandatory	Object	Refer to `details`.

`details`

Parameters available when type is hash:

Parameter	Description	Included in request	Type	Values
`algorithm`	The algorithm used to obtain the hash.	Mandatory	String	Possible values: `sha256` `md5`
`hash`	The hash associated with the file you want to block.	Mandatory	String	The hash value must conform to the format specified in the `algorithm` parameter.

Parameters available when type is connection:

Parameter	Description	Included in request	Type	Values
`ruleName`	The name under which the rule will be listed in the rules table (for example, the name of the application the rule applies to).	Mandatory	String	No additional requirements.
`commandLine`	If included, the rule applies only when an application is opened by using the command line interface with the specified command.	Optional when `path` is provided Not available otherwise	String	No additional requirements.
`protocol`	If included, the rule applies only if a specific IP protocol is used by the connection.	Mandatory	String	Possible values: `any` `TCP` `UDP` A protocol from the list here (the Keyword column)
`direction`	The rule applies only to connections of a specific direction.	Mandatory	String	Possible values: `inbound` `outbound` `both`
`ipVersion`	The rule applies only to connections to or from a specific IP type.	Mandatory	String	Possible values: `any` `IPV4` `IPV6`
`localAddress`	If included, the rule applies only to connections to or from specific local network addresses.	Optional	Object	Refer to `localAddress`.
`remoteAddress`	If included, the rule applies only to connections to or from specific remote addresses.	Optional	Object	Refer to `remoteAddress`.
`directlyConnected`	If enabled, the rule applies only to connections to or from specific Mac addresses.	Optional	Object	Refer to `directlyConnected`.
`operatingSystems`	If included, the rule applies only to connections to or from endpoints using the specified operating systems.	Optional	Array of strings	Possible values for each element of the array: `windows` `mac` Default value: `["windows"]`.
`path`	Determines which application the rule applies to.	Optional	String	No additional requirements.
`hash`	The MD5 of the application.	Optional when `path` is provided Not available otherwise	String	No additional requirements.

Parameters available when type is path:

Parameter	Description	Included in request	Type	Values
`path`	All applications that are launched from the specified path are blocked.	Mandatory	String	The path format must match the operating system of the target endpoint. Must be a file absolute path.

`localAddress`

This object is only available if type is connection.

Parameter	Description	Included in request	Type	Values
`any`	If `false`, only connections originating from the address specified under the `ipMask` setting are blocked. If `true`, all connections are blocked regardless of IP address.	Mandatory	Boolean	No additional requirements.
`ipMask`	If `any` is `false`, only connections to or from the address specified under this setting are blocked.	Optional when `any` is false Not available otherwise	String	The value can be in an IP or an IP/Mask format.
`portRange`	If a range is used, only connections made through ports between these two values are blocked. If specific ports are used, only connections made through ports are blocked.	Optional	String	No additional requirements. Examples "portRange": "6660-6669" "portRange": "135;137-139;445"

Parameter

Description

Included in request

Type

Values

any

If false, only connections originating from the address specified under the ipMask setting are blocked.

If true, all connections are blocked regardless of IP address.

Mandatory

Boolean

No additional requirements.

ipMask

If any is false, only connections to or from the address specified under this setting are blocked.

Optional when any is false

Not available otherwise

String

The value can be in an IP or an IP/Mask format.

portRange

If a range is used, only connections made through ports between these two values are blocked.

If specific ports are used, only connections made through ports are blocked.

Optional

String

No additional requirements.

`remoteAddress`

This object is only available if type is connection.

Parameter	Description	Included in request	Type	Values
`any`	If `false`, only connections originating from the address specified under the `ipMask` setting are blocked. If `true`, all connections are blocked, regardless of IP address.	Mandatory	Boolean	No additional requirements.
`ipMask`	If `any` is `false`, only connections to or from the address specified under this setting are blocked.	Optional when `any` is false Not available otherwise	String	The value can be in an IP or an IP/mask format.
`portRange`	If a range is used, only connections made through ports between these two values are blocked. If specific ports are used, only connections made through ports are blocked.	Optional	String	No additional requirements. Examples "portRange": "6660-6669" "portRange": "135;137-139;445"

Parameter

Description

Included in request

Type

Values

any

If false, only connections originating from the address specified under the ipMask setting are blocked.

If true, all connections are blocked, regardless of IP address.

Mandatory

Boolean

No additional requirements.

ipMask

If any is false, only connections to or from the address specified under this setting are blocked.

Optional when any is false

Not available otherwise

String

The value can be in an IP or an IP/mask format.

portRange

If a range is used, only connections made through ports between these two values are blocked.

If specific ports are used, only connections made through ports are blocked.

Optional

String

No additional requirements.

`directlyConnected`

This object is only available if type is connection.

Parameter	Description	Included in request	Type	Values
`enable`	Indicates if this option is enabled.	Mandatory for Windows, optional for macOS	Boolean	No additional requirements.
`remoteMac`	Only connections from the specified Mac addresses are allowed.	Mandatory when `enable` is `true` Not available otherwise	String	Must be in a valid Mac address format. Example "remoteMac": "00:1b:63:84:45:e6;00-1B-63-84-45-E6"

Parameter

Description

Included in request

Type

Values

enable

Indicates if this option is enabled.

Mandatory for Windows, optional for macOS

Boolean

No additional requirements.

remoteMac

Only connections from the specified Mac addresses are allowed.

Mandatory when enable is true

Not available otherwise

String

Must be in a valid Mac address format.

Return value

Attribute	Type	Description
`result`	Boolean	Indicates if the operation was successful.

Examples

Request

Request when type is hash

{
  "params": {
    "type": "hash",
    "rules": [
      {
        "note": "test",
        "details": {
          "algorithm": "sha256",
          "hash": "1e0905327f443c54aa617e2ff323067c985428e5566886f2aa8296cddfe6ddf9"
        }
      },
      {
        "details": {
          "algorithm": "md5",
          "hash": "13f6331c638b68d4e7eab6ea60da5473"
        }
      }
    ]
  },
  "jsonrpc": "2.0",
  "method": "addToBlocklist",
  "id": "5087eab8-b74f-4a3e-85b3-4271e85890d5"
}

Request when type is connection

{
  "params": {
    "type": "connection",
    "rules": [
      {
        "note": "test",
        "details": {
          "ruleName": "rule  1#",
          "path": "C:\\test.exe",
          "commandLine": "format  C:\\",
          "hash": "13f6331c638b68d4e7eab6ea60da5473",
          "protocol": "ICMP",
          "direction": "inbound",
          "ipVersion": "IPV4",
          "localAddress": {
            "any": false,
            "ipMask": "10.10.10.12/32",
            "portRange": "300-400"
          },
          "remoteAddress": {
            "any": false,
            "ipMask": "10.10.10.12/32",
            "portRange": "300-400"
          },
          "directlyConnected": {
            "enable": true,
            "remoteMac": "AA:AA:AA:AA:AA:AA;CC:CC:CC:CC:CC:CC;BB:BB:BB:BB:BB:BB"
          },
          "operatingSystems": [
            "windows"
          ]
        }
      }
    ]
  },
  "jsonrpc": "2.0",
  "method": "addToBlocklist",
  "id": "5087eab8-b74f-4a3e-85b3-4271e85890d5"
}

Response

{
  "id": "5087eab8-b74f-4a3e-85b3-4271e85890d5",
  "jsonrpc": "2.0",
  "result": true
}

Version 1.0

Use this method to add one or more file hashes to the Blocklist.

Parameters

Parameter	Type	Optional	Description
`hashType`	Integer	No	The algorithm used to obtain the hash. Possible values: `1` - SHA256 `2` - MD5
`hashList`	Array of strings	No	An array containing several hashes. All hashes must be of the type specified by the `hashType` parameter.
`sourceInfo`	String	No	A description for the hashes.

Parameter

Type

Optional

Description

hashType

Integer

The algorithm used to obtain the hash.

Possible values:

1 - SHA256
2 - MD5

hashList

Array of strings

An array containing several hashes.

All hashes must be of the type specified by the hashType parameter.

sourceInfo

String

A description for the hashes.

General parameters

These are common parameters, available across all public API methods:

Parameter	Description	Included in request	Type	Value requirements
`id`	This parameter adds an identifier to the request, linking it to its corresponding response. The target replies with the same value in the response, allowing easy call tracking.	Mandatory	String	No additional requirements. Example "id": "ad12cb61-52b3-4209-a87a-93a8530d91cb"
`method`	The name of the method you are using to send the request.	Mandatory	String	Must be a valid method name. Example "method": "methodName"
`jsonrpc`	The version of JSON-RPC used by the request and the response.	Mandatory	String	The only possible value is `2.0`. Example "jsonrpc": "2.0"
`params`	An object containing the configuration of the request.	Mandatory	Object	No additional requirements. Example "params": {...}

Return value

This method returns a Boolean which is true if the operation was successful.

Example

Request:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "method": "addToBlocklist",
    "params": {
        "hashType": 2,
        "hashList": [
            "5b7ac19bb1a43dfb107b23c6",
            "f696282aa4cd4f614aa995190cf442fe"
        ],
       "sourceInfo": "Added from public API"
    }
}

Response:

{
    "id": "0df7568c-59c1-48e0-a31b-18d83e6d9810",
    "jsonrpc": "2.0",
    "result": true
}

In this section:

addToBlocklist

Important

Parameters

General parameters

Objects

rules

details

localAddress

remoteAddress

directlyConnected

Return value

Examples

Version 1.0

Parameters

General parameters

Return value

Example

Search results

`rules`

`details`

`localAddress`

`remoteAddress`

`directlyConnected`