Forum Discussion
Dark_Knight666
Bronze III
Bronze IIIElastic Data Ingest: Ep.1 – Auditbeat
Hello, I'm stuck on Q11 of this lab and would greatly appreciate some help, please. I'm a little confused as to how to go about answering the question? If I use the filter for - Processhash.sha1 IS ...
You're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
Dark_Knight666Bronze III
Bronze IIIneeemu - Thank you for commenting. But I guess my question now is how did you identify the first 4 characters of the process sha1 hash? A little stuck on this part.
neeemuBronze III
Bronze IIIYou're provided the Process PID in the tasks so searching for that returns event for that process. Expanding that event will show further details, one of which is the SHA1 hash.
