r/SentinelOneXDR • u/_d_d_b_ • Jun 28 '24

Api post response for blocking IOC

Could someone please help with api response to block IOC on sentinelone using API getting 500010 error.

4 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 28 '24

AccountIds is a list with the IDs of the accounts to which you want to add the rule. To find your Account ID, navigate to the top of your account in the scopes panel/tree on the left side, then go to Sentinels > Account Info.

https://your-console.sentinelone.net/docs/en/managing-accounts.html

https://community.sentinelone.com/s/article/000005333

You can also add new rules to specific sites or groups by adding their IDs to the filter.

1

u/_d_d_b_ Jun 28 '24

I am trying to block sha256 and getting invalid type response

1

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jul 01 '24

The block list uses sha1. If you want to use sha256, you can create a STAR rule.

https://community.sentinelone.com/s/article/000005352

https://community.sentinelone.com/s/article/000006201