File Hash-Specific Atomic Runbooks

File hashes (MD5, SHA1, SHA256) are critical indicators for identifying known malware or suspicious files. The runbooks in this section provide procedures for querying threat intelligence sources, searching for hash occurrences in endpoint and SIEM logs, and understanding the context of file executions within your environment.

File Hash Runbooks:

• Atomic Runbook: Get File Hash Reputation from GTI
• Atomic Runbook: Get File Hash Threat Intel via SecOps MCP
• Atomic Runbook: Lookup File Hash Entity Activity in Chronicle
• Atomic Runbook: Search File Hash Process Events in Chronicle