Forum Discussion
Dark_Knight666
Silver I
Silver IElastic Data Ingest: Ep.1 – Auditbeat
Hello, I'm stuck on Q11 of this lab and would greatly appreciate some help, please. I'm a little confused as to how to go about answering the question? If I use the filter for - Processhash.sha1 IS ...
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
Dark_Knight666Silver I
Silver Ineeemu - Thank you for commenting. But I guess my question now is how did you identify the first 4 characters of the process sha1 hash? A little stuck on this part.
neeemu
Bronze III
Bronze IIIYou're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
