When you want to search for Indicators of compromise (IOCs) hashes (MD5, SHA1, and SHA256) in your environment, you can import IOCs file and run a search to find matches of the imported IOCs hashes in your environment. This capability improves your efficiency as you can hunt for a number of specific threat hashes in a single search using the Historical Search capability to mitigate an organization's risk.
Log on to Trellix EDR.
Go to Menu → Historical Search.
In the search box, click Import IOCs to import IOCs file to search for hashes in your environment.
The Import IOCs page is displayed.
Click Choose File to import IOCs file.
Note
Only the .csv files are supported with the maximum limit of 20,000 IOCs or 1.3 million characters.
The imported .csv file needs to be filled with hash details in the first 2 columns — Indicator Value and Type. The below examples show the file format with details.
Indicator Value
Type
04738CA02F59A5CD394998A99FCD9613
MD5
2aae6c35c94fcfb415dbe95f408b9ce91ee846ed
SHA1
112e476505aab51b05aeb2246c02a11df03e1187e886f7c55d4e9935c290ade
SHA256
The imported hash values from IOCs file are displayed in Preview. The displayed hash values (in the order of SHA-256, SHA-1, and MD5) in Preview are case insensitive and duplicates are removed automatically.
Click Import. The query is formed with the "OR" condition in the order of SHA256, SHA1, and MD5 hashes.
Click on the search icon to start collecting data from endpoints.
The searched results are displayed on the grid.
For details about using and customizing the searched results on the grid, see Search historical device data using the Historical Search dashboard.