Netskope Help

Create a Malware Detection Profile

The default Malware Scan can be extended by creating a custom malware detection profile. The malware detection profile allows users to add a custom hash list as a blocklist and an allowlist. Known malicious hashes sourced from other intelligence sources can be included in the blocklist. Known good files (usually proprietary content specific to the enterprise) can be added to the allowlist so Netskope doesn't mark them as suspicious. The custom malware detection profiles can be used in the Real-time Protection policy creation workflow.

To create a malware detection profile:

  1. Go to Policies > Threat Protection > Malware Detection Profile, and then click New Malware Detection Profile.

  2. A malware scan is enabled by default. Click Next.

  3. Enable the checkbox next to the file hash list you want to allowlist. If you do not see it, enter the name in the text field to search for it. To add another file hash list, click + Create New.

  4. Enable the checkbox next to the file hash list you want to blocklist. If you do not see it, enter the name in the text field to search for it. To add another file hash list, click + Create New.

  5. Enter a name and click Save Malware Detection Profile.