Cori Smith

Results 6 comments of Cori Smith

Since EDRs use different hashes, proposing that three new keys are created: `md5`, `sha1`, and `sha256` That way, unsupported hashes won't be queried needlessly

Removed from system-utils.json in PR #66

update: Carbon Black Response already has some existing fields for hashes: - md5 (hash of executing process) - sha256 (hash of executing process) - filewrite_md5 (hash of file written to...

Thanks for keeping me honest! I remember now we _did_ decide to lump all hash types into a single key so we have the foundation for if/when EDR capabilities expand...