Multiple Blocklists?

BionicSecurityMgr · July 20, 2021, 5:23pm

Is there any way to use multiple block lists? I'm thinking of a situation where we can have different Block Lists for different groups of assets without the need to use multiple Endpoint servers.

We had a bad hash cause a problem, and we're trying to explore if we can group our assets by criticality to allow us to deploy future hashes in the block list using a staged approach.

caitlinbetz · July 21, 2021, 4:48pm

Hello (again) @BionicSecurityMgr

Unfortunately there isn't a way to create multiple blocklists in the Elastic Security (formerly Endgame) product. I have logged this as an enhancement request for the Elastic Endpoint integration/kibana Security application. Thank you again for your input & feedback.

Topic		Replies	Views
Elastic endpoint security blocklist process delete the binary file Endpoint Security	8	688	January 7, 2023
Blocklist not working as expected Elastic Security	3	250	September 21, 2023
Elastic Endpoint (Defend) does not seem to report file hashes for writes or modifications Endpoint Security elastic-stack-security	8	516	October 1, 2024
Elastic Endpoint Security installation in scale Endpoint Security	2	325	June 16, 2022
Endpoint Security on Elastic Stack Community Slack Endpoint Security	1	940	January 17, 2020

Multiple Blocklists?

Related topics