topic Re: File Hashes? in General Topics

File Hashes?

r_gine — Wed, 21 Jun 2017 18:54:17 GMT

Does anybody know where to find the associated file hashes for files from the threat or data filtering log? I know Palo is generating file hashes on files because that's how they're determing what to send to WildFire but I can't find a file lash log anywhere. I would like to see this in the data filtering log.

Re: File Hashes?

BPry — Thu, 22 Jun 2017 14:11:17 GMT

Outside of the actual wildfire reports I don't see anyway to actually look at the file hashes. It doesn't appear that the firewall stores that information.

Re: File Hashes?

TranceforLife — Thu, 22 Jun 2017 14:19:14 GMT

Use FildFire portal to check the hash:

Re: File Hashes?

r_gine — Thu, 26 Oct 2017 17:33:02 GMT

I dont even see how this is possible... why would they not store this information? This is insane -- this information is would be very useful from a security monitoring and threat intelligence aspect.

Re: File Hashes?

r_gine — Thu, 26 Oct 2017 17:34:10 GMT

Outside of WildFire... The Firewall calculates file hashes for all files so why don't they log that information? WildFire is a pretty poor sandbox appliance.

Re: File Hashes?

OtakarKlier — Thu, 26 Oct 2017 22:01:27 GMT

Hello,

If you have WIldfire logging enabled, you can see the file hashes in the details of the logs.

Is this what you are looking for?

Regards,