> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/sentinelone-block-bad-hashes.md).

# SentinelOne: Block Bad Hashes

This guide helps you set up your SentinelOne device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.

*This guide is the first step of a larger process to enable auto remediations. After completing the steps on this page, you will be instructed to return to the* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) *guide to finish your setup.*

## How It Works <a href="#h_01jgydp2j2h80jh6z0z91at9ne" id="h_01jgydp2j2h80jh6z0z91at9ne"></a>

If our SOC identifies a hash that must be blocked, Workbench completes the action automatically unless it is specifically called out as a "Never block" asset (these hashes must be added as context and then configured in Workbench; see [Step 2](#h_01jgyc8wpyhctwv9qstbsatmnq)).

### Endpoints Used <a href="#h_01kcq58zyx8ybb32hecxz7qhhp" id="h_01kcq58zyx8ybb32hecxz7qhhp"></a>

**SentinelOne API**

`web/api/v2.1`, `sha1`

{% hint style="info" %}
`sha1` reflects the hash type Expel's remediation currently declares. The hash algorithm is not sent to SentinelOne (only the raw hash value is submitted), so this remediation will likely also accept a `sha256` hash. This has not been verified against SentinelOne's live API, however.
{% endhint %}

<table><thead><tr><th width="123.40625">Method</th><th>Endpoint</th><th>Purpose</th></tr></thead><tbody><tr><td>GET</td><td><code>web/api/v2.1/restrictions</code></td><td>Pre-check: find existing blocklist entries matching the hash</td></tr><tr><td>GET</td><td><code>web/api/v2.1/accounts</code></td><td>Resolve tenant scope (account IDs) for the restriction filter</td></tr><tr><td>GET</td><td><code>web/api/v2.1/sites</code></td><td>Fallback scope resolution, only if no account IDs are found</td></tr><tr><td>POST</td><td><code>web/api/v2.1/restrictions</code></td><td>Create a black_hash blocklist entry — called once per OS (Windows, macOS, Linux)</td></tr></tbody></table>

Revert (unblock): GET `web/api/v2.1/restrictions` to find the restriction ID(s), then DELETE `web/api/v2.1/restrictions` (batch delete by ID).

## Step 1: Allow Appropriate Permissions in Your EDR Console <a href="#h_01jh1s4h4756ad0yzsv8sdjd1s" id="h_01jh1s4h4756ad0yzsv8sdjd1s"></a>

1. Make sure you assign all API permissions in the [SentinelOne Setup for Workbench](/connect-your-technology/q-z-integrations/sentinelone/sentinelone-singularity-endpoint-setup-for-workbench.md) guide.
2. This includes enabling all deny list permissions for the API user.

   <div align="left"><figure><img src="https://2371323735-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F82234aPbNfd179j5U4ti%2Fuploads%2FNSQ5X7wIGXRkW0L2XW94%2FScreen%20Shot%202021-08-25%20at%204.10.05%20PM.png?alt=media&amp;token=1bea6e3e-031e-4cf0-816f-bb3279c5591d" alt="Blacklist View, Blacklist Edit, Blacklist Delete, and Blacklist Create permissions are configured to Allowed." width="563"><figcaption></figcaption></figure></div>

## Step 2: Update Your Context <a href="#h_01jgyc8wpyhctwv9qstbsatmnq" id="h_01jgyc8wpyhctwv9qstbsatmnq"></a>

**If you do not want to specify any hashes for a "do not block" list, skip to** [**Step 3**](#h_01jgycgywj4m9tc7j443dvsmf1)**.**

Working with your Customer Success Manager, add any hashes that should be on the "do not block" list as [org context](/workbench-reference/expel-terminology.md#org-context) for your environment. You will then be able to select those hashes as "Never block" assets when you enable the auto remediation in Workbench.&#x20;

{% hint style="info" %}
If our SOC identifies a hash that must be blocked, any hashes added as "Never block" assets are assigned to you as actions rather than being blocked automatically.
{% endhint %}

## Step 3: Return to the Main Setup Guide <a href="#h_01jgycgywj4m9tc7j443dvsmf1" id="h_01jgycgywj4m9tc7j443dvsmf1"></a>

Your SentinelOne device is now ready for the Block Bad Hashes auto remediation. You should now do one of the following:

* **If you do not need to set up any other devices for this auto remediation**, you can return to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process.
* **If you need to set up additional devices for this auto remediation, or wish to use this device with multiple auto remediations**, be sure to [complete those setup guides as well](/workbench-setup/auto-remediations.md) before returning to the [Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md) guide to finish Step 2 of the process. *Make sure to follow the setup guide that is specific to your auto remediation, as device setup instructions are unique to each auto remediation and device.*


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/sentinelone-block-bad-hashes.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.