Skip to main content
Use a block entry when a package is a threat to your tenant and you cannot wait for an MDM push. The block reaches every pull request check at once, and each PMG endpoint after its next policy fetch.
This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See pricing.

​
Block one package

  • The selector is a PURL. Without a version or --vers, the block selects every version.
  • --vers takes a range, as '>=1.2.0'. Quote it, because the shell reads >.
  • --reason is required. PMG shows it in the block message. The pull request check shows it on a private repository only.
  • --ticket and --requested-by are optional. Tools never receive them.
The command creates the rule and publishes a new policy revision at once. It prints the rule id, such as r_9c1x4kq7dm. Each decision of the rule cites that id.

​
Block a namespace

A block entry can use a prefix that ends with /* or .*:
A prefix has no version. Use --vers to limit it to a range. A prefix such as pkg:npm/* selects every package of an ecosystem and stops every install of it, and the command warns you.

​
Block a list of packages

Write one selector on each line of a file. A line can add a range after a space. A line that starts with # is a comment.
iocs.txt
The file holds at most 1,000 selectors. All of them go into one policy revision. Use -f - to read the list from standard input.

​
Block for one group only

By default a rule attaches to the policy base and applies to every endpoint and project. To block for the subjects of one policy override, add --override NAME:

​
Check the block

  1. List the endpoints that did not apply the new revision yet. Use the revision number that the create command printed:
  2. List the decisions of the rule:
Every Owner and Admin of the tenant gets an email about the new block. A block stops new installs. It does not remove copies that are already installed. To find the endpoints that have the package, see Find a Malicious Package.

​
How fast a block reaches PMG

PMG fetches the policy in the background after a command, at most once every 5 minutes. So the first install after a block can still use the previous policy. To fetch at once on one machine, run pmg cloud sync.

​
Remove the block

The delete loosens the policy and publishes a new revision. The rule stays in the history of the revisions.

​
Next steps

Package Rules

Selectors, prefixes and how a block beats a trust entry.

Explain a Decision

Find the rule behind a block.

Audit Policy Changes

See who added or removed a rule.

Command Reference

Every flag of safedep policy rule.