Suspicious Extensions List Maintenance

Introduction

This page covers how the Suspicious Extensions list is maintained, and the Eyeglass CLI commands used to control how and when it updates.

How the list is maintained

The extension list is a community-sourced list: extensions observed across Ransomware Defender deployments worldwide are merged into a master list curated by Superna. If your Eyeglass instance has phone-home enabled, custom extensions you add locally are submitted as candidates for the master list.

The Eyeglass VM requires outbound firewall access to https://storage.googleapis.com/rwdefender.superna.net/ to receive list updates.

Update modes

Two update modes are available, checked and set via the Eyeglass CLI:

• Latest — the list automatically updates to the newest published version.
• Fixed — the list stays on a specific version you choose, until you manually update it.

# View current mode and available versions
igls rsw filefiltersettings

# Compare what changed between two versions before updating (recommended —
# adding extensions can trigger new alerts and user lockouts)
igls rsw filefiltersettings --diff=<version1>,<version2>

# Pin to a specific version
igls rsw filefiltersettings set --mode=Fixed --version=<version>

# Switch to automatic updates
igls rsw filefiltersettings set --mode=Latest

# Roll back to a specific version
igls rsw filefiltersettings --version=<version>

New extensions added by a list update appear in the Suspicious Extensions tab; any extensions you added manually are not affected by list updates. Review the diff before updating even in Latest mode, since a new version can introduce lockout risk for legitimate file types in your environment.

Per-extension state control

Since release 2.5.7, each extension in the list can be set independently to Enabled (actively contributes to Signal Strength), Disabled (present in the list but not evaluated), or Monitor Only (contributes to audit visibility and alerting without triggering lockout) — this is the recommended way to manage individual extensions rather than relying solely on the master list's default state. See Detection Controls — Managing extensions for the UI steps.

See also

• Detection Controls and False Positive Management — Suspicious Extensions — Managing individual extension state in the UI.
• Threat Detection and Severity Settings — How the Suspicious Extension detector contributes to Signal Strength.