File Types and Md5 Hashes

[scottlsattler]

I write SIEM content (Mostly Arcsight and Q1), I have found PAN to be very effective in identifying adverse traffic. One thing that would be great, that in addition to recognizing the file type such as "file Microsoft PE File(52060)" which is useful as a poor mans DLP, with which I can track whats coming and going, it's only so effective by just having the file name. It would be much more effective if the md5 hash value of the file was written to the log file. Then I can correlate the log file md5 hash with my known bad hash database....Can this be done, is it there and I have missed it?

Thanks

[Chatri]

Unfortunately No.

The Palo Alto will not buffer through the entire file in order to get the hash of the file.

But if you are using Wildfire to forward certain file types to the wildfire portal, it will give you the SHA for the file but not MD5.

I hope this is helpful.

[mikand]

Wouldnt it still be possible to create a md5 of a stream since md5 works with 512bit blocks?

Cryptographic hash function - Wikipedia, the free encyclopedia

MD5 - Wikipedia, the free encyclopedia

[VinceM]

Hi,

Problem will be to capture all the file's stream. With the palo, you're only be able to capture stream if threat is indentify in it and only on a the "infected" part of stream.

the SHA256 hash is calculate when creating a forwarding profile for wildfire. May be possible to retrieve it through the API ?

V.