Investigate a file and process hash

Investigate a file or process hash and its related activity.

Drilldown on a file or process hash on the Hash View. On this view you can investigate and take actions on SHA256 hash processes and files, and see information about a specific SHA256 hash over a defined 24-hour or 7-day time frame. In addition, you can drill down on each of the process executions, file operations, cases, actions, and threat intelligence reports relating to the hash.

How to investigate a file or process hash

1. Open the Hash View.

   Identify the file or process hash that you want to investigate and select Open Hash View.
2. In the left panel, review the overview of the hash.

   1. Review the signature of the hash, if available.
   2. Identify the WildFire verdict.

      The color of the hash value is color-coded to indicate the WildFire report verdict: