Forum Discussion
Dark_Knight666
Bronze III
Bronze IIIElastic Data Ingest: Ep.1 – Auditbeat
Hello, I'm stuck on Q11 of this lab and would greatly appreciate some help, please. I'm a little confused as to how to go about answering the question? If I use the filter for - Processhash.sha1 IS ...
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
neeemuBronze III
Bronze IIIWhen you identify the process from the Process Events [Auditbeat System] ECS dashboard at the bottom, expanding by clicking the 2 way arrow symbol will allow you to search for the SHA1 value for that process.
Dark_Knight666Bronze III
Bronze IIIneeemu - Thank you for commenting. But I guess my question now is how did you identify the first 4 characters of the process sha1 hash? A little stuck on this part.
- neeemu
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
