# Blocklist not working as expected

**URL:** <https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465>\
**Category:** Elastic Security\
**Created:** [August 23, 2023, 10:47am UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465 "2023-08-23T10:47:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Krishna\_Teja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_teja/32/104976_2.png) [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\
**Post date:** [August 23, 2023, 10:47am UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465/1 "2023-08-23T10:47:51Z")

</div>

I added an application to blocklist. Ensured malware protections and blocklist are enabled for the policy. Even after hours of adding, I'm still able to run the application.

---

<div class="post-metadata">

**Author:** ![ferullo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ferullo/32/74240_2.png) [@ferullo](https://discuss.elastic.co/u/ferullo)\
**Post date:** [August 23, 2023, 7:24pm UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465/2 "2023-08-23T19:24:06Z")

</div>

Hi @Krishna_Teja

What version of Agent are you running? Is it possible one of these bugs is affecting you?

- [[BUG] Multiple user blocklist hash types can't be used together · Issue #164374 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/164374)
- [[BUG] Hash based user blocklist entries are not sent to Endpoint in lowercase · Issue #164373 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/164373)
- [[SecuritySolution] Windows blocklist paths should be case-insensitive · Issue #158581 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/158581)

---

<div class="post-metadata">

**Author:** ![Krishna\_Teja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/krishna_teja/32/104976_2.png) [@Krishna\_Teja](https://discuss.elastic.co/u/Krishna_Teja)\
**Post date:** [August 24, 2023, 2:10am UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465/3 "2023-08-24T02:10:47Z")

</div>

Thanks ferullo

Seems like our issue is due to the first bug - multiple user blocklist hash types can't be used together. When we tried with a single hash, it worked fine.

Thanks & Regards  
Krishna

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 21, 2023, 2:10am UTC](https://discuss.elastic.co/t/blocklist-not-working-as-expected/341465/4 "2023-09-21T02:10:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.