Skip to main content
Skip table of contents

Hash [7.2]

The hash value (for example, MD5 or SHA256) of a file, process, or object. The value is independent of the algorithm. Only the resulting hash is stored in this field.

Only three hash types are in common usage: MD5, SHA1, and SHA256.

This field is not available in LogRhythm versions earlier than 7.2.1.

Data Type

Alphanumeric string (0-512 characters, 64 average characters) 



Client Console Full Name


Client Console Short Name


Web Console Tab/Name


Elasticsearch Field Name


Rule Builder Column Name


Regex Pattern


NetMon Name

Not applicable

Field Relationships

Object, Process, and Object Name fields. This is the hash for the process identified in process.

Common Applications

  • Vulnerability scanners
  • Endpoint monitoring (for example, Cbresponse)
  • Threat Intelligence feeds
  • Antivirus

Use Case

Mapping hash value to threat feeds and known Indictators of Compromise (IOCs).

MPE/Data Masking Manipulations

Not applicable.

Usage Standards

  • Priority if there are multiple hashes is MD5 > SHA1 > SHA256, until strongly typed fields available.
  • Make it as easy as possible to match to most common threat feeds.
  • Do not include the hash type in the field (for example, remove MD5:).


  • Cylance log sample

Sample - 05 09 2016 21:40:29 <SLOG:WARN> 1 2016-05-10T02:40:19.2905167Z sysloghost CylancePROTECT - - - Event Type: AppControl, Event Name: pechange, Device Name: US-JNTJKV1, IP Address: (,,), Action: Deny, Action Type: PE File Change, File Path: C:\Users\Public\TechTools\Host65, SHA256: 8050FE3DCA43D594611492AA149AF09FC9669149602BB2945AFEA4148A24B175

Parse the hash removing the algorithm header SHA256.

  • Cb Response log sample

Sample - 05 13 2016 20:56:15 <USER:NOTE> LEEF:1.0|CB|CB|5.1|watchlist.hit.binary|cb_server=cbserver    cb_version=511    company_name=Microsoft Corporation    copied_mod_len=11616    digsig_issuer=Microsoft Windows Production PCA 2011    digsig_prog_name=Microsoft Windows    digsig_publisher=Microsoft Corporation    digsig_result=Signed    digsig_result_code=0    digsig_sign_time=2015-10-30T12:32:00Z    digsig_subject=Microsoft Windows    endpoint=[" USABLDRRECFLOW01"]    file_desc=recordflow console    file_version= (th2_release.151029-1700)    group=["Testing"]    host_count=1    internal_name=recflowcon    is_64bit=true    is_executable_image=false    last_seen=2016-05-14T03:42:10.709Z    legal_copyright=© Record Flow LLC. All rights reserved.    md5=59E0D058686BD35B0D5C02A4FD8BD0E0observed_filename=["c:\\windows\\system32\\downlevel\\api-ms-win-core-stringansi-l1-1-0.dll"]    orig_mod_len=11616    original_filename=apisetstub    os_type=Windows    product_name=Microsoft® Windows® Operating System    product_version=10.0.10586.0    server_added_timestamp=2016-05-14T03:42:10.709Z    server_name=USABLDRRECFLOW01 signed=Signed    timestamp=2016-05-14T03:42:10.709Z    type=watchlist.hit.binary    watchlist_id=4    watchlist_name=Newly Loaded Modules

Parse the hash removing the type md5=.

JavaScript errors detected

Please note, these errors can depend on your browser setup.

If this problem persists, please contact our support.