azure log analytics FileHash

Copper Contributor

FileHash in Azure log analytics just has sha256, is there a way to get Sha1 and or md5? Is this something configurable and how/where do we set that? Thanks

ex. 

SecurityEvent
| where FileHash
2 Replies

@johnadamsp,

 

The FileHash value is coming from the Security Event on that machine. Log Analytics doesn't calculate file hashes.

 

It is usually coming from here: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/ee...

 

Thanks,

Meir :>

Hi,
were you able to figure how to query and find hashes throughout the environment?