Forum Discussion
Bronze IIIElastic Data Ingest: Ep.1 – Auditbeat
Hello,
I'm stuck on Q11 of this lab and would greatly appreciate some help, please. I'm a little confused as to how to go about answering the question? If I use the filter for - Processhash.sha1 IS 4, I get 0 which is incorrect.
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
3 Replies
neeemuWhen you identify the process from the Process Events [Auditbeat System] ECS dashboard at the bottom, expanding by clicking the 2 way arrow symbol will allow you to search for the SHA1 value for that process.
- Dark_Knight666
neeemu - Thank you for commenting. But I guess my question now is how did you identify the first 4 characters of the process sha1 hash? A little stuck on this part.
- neeemu
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
