Skip to content

Blocked items

You can block suspicious applications.

You need to have Intercept X Advanced with XDR.

Go to My Products > General Settings > Blocked Items.

You can block suspicious applications.

You can also see applications that you have blocked from running on your computers. You can see who blocked the application and why.

Blocking applications here doesn't clean them up on computers they're already on. You can block and clean up applications in one step when you investigate a threat graph. See Threat Graphs.

About blocked applications

You can block applications using their SHA-256 hash. This prevents suspicious applications from running on your Windows devices.

You can only block applications. SHA-256 hashes for other items, or for files Sophos believes to be safe, are ignored.

You can also block applications when you investigate a threat graph.

You can add up to 5,000 SHA-256 hashes to the blocked items list.

Block an application

To block and clean up an application:

  1. Click Add.
  2. Enter the application's SHA-256 hash.
  3. Enter a reason for blocking the application.
  4. Click Add.

    • Click Add Another if you want to block more than one application.
  5. When you have finished, click Save on the Blocked Items page.

This blocks the application on all computers.

Remove an application from the block list

You can remove applications from the block list if you've decided that they aren't suspicious. To do this:

  1. Select the application in the list and click Remove.