Feedback:

cs_hunt_file

Note: Access to this operator is provided on a limited-availability basis. Contact Anomali Customer Support for more information.

Use the cs_hunt_file operator to get a list of device AIDs on which the specified file hash was matched.

The device identifiers are returned in the AID output field. You can use this field with the cs_hunt_domain, cs_hunt_file, cs_hunt_ip, and cs_query_device operators to perform analysis and threat hunting.

Syntax

| cs_hunt_file cs_value=<hash_value> [cs_type=<hash_type> cs_limit=<max_results>]

cs_value=<hash_value>

Specify a hash value enclosed in double quotes.
cs_type=<hash_type>

Optional. Specify a hash type.

Possible values:

  • sha256

  • md5

Default value: md5
cs_limit=<max_results>

Optional. Specify the maximum number of results to return.

Default value: 100

Maximum value: 10,000

Examples

Example 1: Retrieve the list of device AIDs matched on the specified file hash.

Copy 
| cs_hunt_file cs_value="ae87a276ea911dbabbf91521bf72c943"

 

Example 2: Retrieve the list of device AIDs matched on the file hash with the specified value and type. Limit the returned results to 200.

Copy 
| cs_hunt_file cs_value="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855" cs_type="sha256" cs_limit=200

 

Example 3: Retrieve device AIDs on which the specified file hash file was matched and then get their device details.

Copy 
| cs_hunt_file cs_value="99934t09g09i09d0dfghkjhkf88893000gjs7"
| cs_get_system_info cs_id_list=AID