Skip to main content
Version: 2.10.0

Well Known Extension List

Introduction​

The crowd-sourced extension list is built from Defender deployments worldwide. When custom extensions are added to local deployments, the system collects them and merges them into a list curated by Superna, which is then published as a version of the master list.

The versioned list will continue to function, now including extensions sourced through the crowdsourcing system. By adding custom extensions to your Defender installation and enabling the phone home feature, you can contribute your custom extensions for Superna's review and potential inclusion in the master list.

Pre-Requisites​

The Eyeglass VM needs firewall rules to allow access to the following URL: Superna Storage URL

tip

To see more information regarding Firewall, see Firewall Configurations.

How to Check the Settings​

To check your settings, run the command: igls rsw filefiltersettings

  • If the "mode" is set to "Latest," it means the auto-update is enabled, Data Security will always use the latest version available online.

  • If the "mode" is set to "Fixed," it means a static version of the list is used, and you can choose which version to switch to.

Running this command will also display the list of available versions.

Example of Return:

admin@superna:~> igls rsw filefiltersettings

{
    "currentSettings": {
        "mode": "Fixed",
        "currentVersion": "base"
    },
    "availableVersions": [
        "20201207",
        "20210405",
        "20211018",
        "20220118",
        "20220228",
        "20220413",
        "20220509",
        "20220606",
        "20220704",
        "20220808",
        "20220920",
        "20221012",
        "20221107",
        "20221212",
        "20230724",
        "20230826",
        "20240123",
        "20240527",
        "20240807"
    ]
}

How to Update the List​

Updating the List When Auto-Update Is Disabled (“Mode” = “Fixed”)​

  1. Review the List of New Extensions

    Ensure they align with your organization's needs, as adding them may trigger new alerts and result in user lockouts. Use the following command:

    • igls rsw filefiltersettings --diff=<version1,version2>
    note

    version2 should be the latest published version.


    The output shows extensions added and removed when moving from version1 to version2.

  2. Switch Eyeglass to the New Version of the List and Edit It According to Your Organization's Needs

    Use the command:

    • igls rsw filefiltersettings set --mode=Fixed --version=<version>

    Once updated, the file extensions appear in the File Filter tab in the Ransomware Defender interface. You can then manage the list. The extensions you added manually are not affected.

Updating the List When Auto-Update Is Enabled (“Mode” = “Latest”)​

  1. When auto-update is enabled, the new version replaces the previous one.

  2. Review the List of New Extensions

    Ensure they align with your organization's needs, as adding them may trigger new alerts and result in user lockouts. Use the following command:

    • igls rsw filefiltersettings --diff=<version1,version2>
    note

    version2 should be the latest published version.


    The output shows extensions added and removed when moving from version1 to version2.

  3. Once updated, the file extensions appear in the File Filter tab in the Ransomware Defender interface. You can then manage the list. The extensions you added manually are not affected.

Other Options for Managing the File Extension List​

  • Enable Auto-Update

    You can enable the auto-update option. Eyeglass Data Security checks for new versions and automatically switches to the latest one. Use the command:

    • igls rsw filefiltersettings set --mode=Latest

  • Roll Back to an Older Version

    If you prefer to revert to an older version of the list, use the command:

    • igls rsw filefiltersettings --version=<version>

List in 2.5.8 or Greater​

The versioned banned list feature allows you to switch between the current banned file list and newly published versions. You can also select the option to always use the latest file. Be cautious: if the new list includes extensions used in your environment, it could cause a lockout. This feature lets you control the switch to a new file and see which new extensions have been added.

note

This feature does not support OS Proxy with YAST.

Versioned Banned Files List​

The versioned banned files list feature lets you select and compare different versions of the banned file list. It also allows automatic selection of the latest version. This helps you migrate from one version to another using the commands below. The files appear in the File Filter tab in the Ransomware Defender GUI.

Requirements​

  • Requires version 2.5.8 or Greater.

Versioned Files and New Extensions​

This section lists the versioned files and includes links to files containing the new extensions added in each version.

File Version Commands​

  • igls rsw filefiltersettings — Lists the current version and settings.
  • igls rsw filefiltersettings --version=<version> — Selects a specific version.
  • igls rsw filefiltersettings --diff=<version1>,<version2> — Shows the changes between two versions, including new file extensions added.
  • igls rsw filefiltersettings set --mode=Latest — Uses the latest version available online.
  • igls rsw filefiltersettings set --mode=Fixed --version=<version> — Sets a fixed version as the banned list to use.

See Also​