Global Settings / Blocked Items has an item limit of 1000 SHA-256 hashtags?

Because of the increased cyber attacks due to the tragedy currently occurring in Eastern Europe, "We" (The owner/CEO) received a pack of Email  and IP Addresses / URLs / SHA-256 to block from the Government.

1) Sophos really needs to make it easier to import blacklists.  Seriously.  Our old much less expensive solution was way better in that regards.

2) Sophos also needs to look at how input windows work in their products, click once the window resizes - click again it resizes again - hit save or add another it resizes for the third time, moving the buttons each and every time.

3) So after setting up AutoIt (which was a nightmare due to point 2) I was able to start importing  the SHA-256 list.  Setting it to stop after importing 2000 of the over 7000 in the list I received, so I could hit save.

4) So the list showed the 2000 items I added and I hit save, I received the green pop-up that it had saved successfully and the window closed. When reopening the window I saw that it only listed 1000 of the 2000 items I had just added. I added a few manually to get the number upto 1010 hit save again and when opening the window again it was back to 1000.

So here I am asking if there is a hard limit on how many hashtags someone can add to sophos, so I can pass the information on to my team-leader.  In case one of the over 6000 hashtags I wasn't able to add is the reason our network gets compromised I have a CMA.

Parents
  • Hi Shawn,

    Thanks for reaching out to us.

    I recommend sending in this request as a sample submission. Our Sophos Labs team can check the list of SHA values provided to let you know if any of them are already being detected by Sophos. 
    If some of the indicators of compromise are not yet present in our detection databank, they will be added in by our team. 
    - Submit a Sample

    Regarding the behavior you are experiencing when adding entries to the "Blocked Items" list, does scrolling to the bottom of the list to render additional items load more entries, or are you finding that this remains capped at 1000?

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Reply
  • Hi Shawn,

    Thanks for reaching out to us.

    I recommend sending in this request as a sample submission. Our Sophos Labs team can check the list of SHA values provided to let you know if any of them are already being detected by Sophos. 
    If some of the indicators of compromise are not yet present in our detection databank, they will be added in by our team. 
    - Submit a Sample

    Regarding the behavior you are experiencing when adding entries to the "Blocked Items" list, does scrolling to the bottom of the list to render additional items load more entries, or are you finding that this remains capped at 1000?

    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  Visit Sophos Techvids
Children