Feature Suggestion: Update Hash rules policy with New Hash

[VictorM700]

Hi Spynetgirl,

It would be great if you can make a feature that would allow one to update the hashes that was previously setup in a policy.

Thanks

[HotCakeX]

Hi, i could do that but to understand this better, i need to ask, why not delete the existing hash via Policy Editor and then create a new hash rule by selecting the file(s)? This way you won't need to manually hash the file, copy the hash text and paste it in the policy. In the Supplemental policy page you can select an existing policy and just add rules to it without worrying about having duplicates as they are automatically taken care of.

[VictorM700]

I have about 10 deny policies, each policy contains 10-15 file hashes. So I would be nice if I could select a policy and update the hashes.
Took me 2.5 hrs yesterday to update them all by creating new deny policies.

[HotCakeX]

Wow that's too long, I will add the same feature i added to supplemental policy page where you can select a policy and add rules to it automatically.

This feature 👇🏻

Will it help you?

Also in here in Policy Editor

Will it help you if the Hashes section was editable so you could enter any text in the fields?

[VictorM700]

I would implement it by extracting the file path and file names. And rebuilding the deny policy. Better than having me to do a Powershell get-filehash for each file.

MS should have thought of this. Why allow people to make hash rules when there is no easy way to update the hash.

[HotCakeX]

That cmdlet gets the flat file hash. App Control policies need Authenticode and header page hashes. You can get them easily in AppControl Manager but you don't have to do it one by one. With the upcoming update you can simply remove them first in Policy Editor, and then browse for your files, set the scan level to Hash, and add the new hashes to your existing policy in one go.