SHA256 and MD5 hash information not sent with CEF Output

gbaruch — Fri, 23 Mar 2018 06:12:39 GMT

Hi Team,

I am seeing strange behaviour the Minemeld instance onsite is seeing Hash values that have been generated from Autofocus custom query using AF+MM instance.

Setup:

AF+MM - 1 Miner --> 1 x MD5 / 1 x SHA256 Processors --> 1 x Output MD5 / 1 x Output SHA256

On-Prem - 1 x Miner MD5 / 1 x Miner SHA256 --> 1 x Output MD5 / 1 x Output SHA256

when checking the logs through out the flow i can see the hashes but when i check the arcsight receiver in the raw logs i do not see any hash values .

any ideas why this might be ?

Re: SHA256 and MD5 hash information not sent with CEF Output

iThreatHunt — Fri, 26 Oct 2018 16:17:12 GMT

I need this feature too. Please update minemeld-cef output for supporting hash value (MD5,SHA1,SHA256).

topic Re: SHA256 and MD5 hash information not sent with CEF Output in General Topics

SHA256 and MD5 hash information not sent with CEF Output

Re: SHA256 and MD5 hash information not sent with CEF Output