Anda dapat menggunakan Google Security Operations untuk menelusuri data Anda untuk menemukan file tertentu berdasarkan nilai hash MD5, SHA-1, atau SHA-256-nya.
Jika informasi tambahan tersedia untuk hash file yang ditemukan dalam akun Google SecOps pelanggan, informasi tambahan ini akan ditambahkan ke peristiwa UDM terkait secara otomatis. Anda dapat menelusuri peristiwa UDM ini secara manual menggunakan Penelusuran UDM atau menggunakan aturan.
Melihat hash file
Untuk melihat hash file, Anda dapat:
Melihat file langsung di tampilan Hash file
Membuka tampilan Hash file dari tampilan lain
Melihat file langsung di tampilan Hash file
Untuk membuka tampilan Hash file secara langsung, masukkan nilai hash di kolom penelusuran Google SecOps, lalu klik Search.
Google SecOps memberikan informasi tambahan tentang file, termasuk
berikut ini:
Mesin partner yang mendeteksi: Vendor keamanan lain yang telah mendeteksi file tersebut.
Properti/metadata: Properti file yang diketahui.
Nama file yang dikirimkan ke VT/ITW: Malware in-the-wild (ITW) berbahaya yang diketahui dan dikirimkan ke VirusTotal.
Membuka tampilan Hash file dari tampilan lain
Anda juga dapat membuka tampilan Hash file saat menyelidiki aset dalam
tampilan lain (misalnya, tampilan Aset) dengan menyelesaikan langkah-langkah berikut:
Membuka tampilan investigasi. Misalnya, pilih aset untuk melihatnya dalam
Tampilan aset.
Di Linimasa di sebelah kiri, scroll ke peristiwa apa pun yang terkait dengan proses atau modifikasi file, seperti Koneksi Jaringan.
Memilih Peristiwa di tampilan Aset
Buka penampil Log Mentah dan UDM dengan mengklik ikon buka di Linimasa.
Anda dapat membuka tampilan Hash file untuk file dengan mengklik nilai hash (misalnya, principal.process.file.md5) dalam peristiwa UDM yang ditampilkan.
Pertimbangan
Tampilan hash memiliki batasan berikut:
Anda hanya dapat memfilter peristiwa yang ditampilkan dalam tampilan ini.
Hanya jenis peristiwa DNS, EDR, Webproxy, dan Pemberitahuan yang diisi dalam tampilan ini.
Informasi pertama kali terlihat dan terakhir kali terlihat yang diisi dalam tampilan ini juga dibatasi
untuk jenis peristiwa ini.
Peristiwa generik tidak muncul di tampilan pilihan mana pun. Peristiwa ini hanya muncul di log mentah dan penelusuran UDM.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-21 UTC."],[[["\u003cp\u003eGoogle Security Operations allows searching for files using their MD5, SHA-1, or SHA-256 hash values.\u003c/p\u003e\n"],["\u003cp\u003eAdditional information about file hashes found in a customer's account is automatically added to associated UDM events.\u003c/p\u003e\n"],["\u003cp\u003eFile hashes can be viewed directly by entering the hash value in the search field, or by navigating to the File hash view from another view.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations provides extra file information like partner detection, properties, and VirusTotal submissions.\u003c/p\u003e\n"],["\u003cp\u003eFile hash view has limitations, such as filtering only the events displayed, limited event types, and a lack of generic events in curated views.\u003c/p\u003e\n"]]],[],null,["# Investigate a file\n==================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nYou can use Google Security Operations to search your data for a specific file based on\nits MD5, SHA-1, or SHA-256 hash value.\n\nIf additional information is available for a file hash found within a customer's\nGoogle SecOps account, this additional information is added to the\nassociated UDM events automatically. You can search for these UDM events\nmanually using UDM Search or by using rules.\n\nView a file hash\n----------------\n\nTo view a file hash, you can:\n\n- View a file in **File hash** view directly\n\n- Navigate to **File hash** view from another view\n\nView a file in File hash view directly\n--------------------------------------\n\nTo open **File hash** view directly, enter the hash value in the\nGoogle SecOps search field and click **Search**.\n| **Note:** [UDM search](/chronicle/docs/investigation/udm-search) provides enhanced capabilities that let you conduct more thorough investigatzions of the events and alerts within your Google SecOps instance than is possible using **File hash** view alone. For more information, see [UDM search](/chronicle/docs/investigation/udm-search).\n\nGoogle SecOps provides additional information about the file, including the\nfollowing:\n\n- **Partner engines detecting**: Other security vendors who have detected the\n file.\n\n- **Properties/metadata**: Known properties of the file.\n\n- **VT submitted/ITW filenames**: Known malicious in-the-wild (ITW) malware\n submitted to VirusTotal.\n\nNavigate to File hash view from another view\n--------------------------------------------\n\nYou can also navigate to **File hash** view while investigating an asset in an\nanother view (for example, **Asset** view) by completing the following steps:\n\n1. Open an investigation view. For example, select an asset to view it within\n Asset view.\n\n2. In the **Timeline** to the left, scroll to any event tied to a process or\n file modification, such as **Network Connection**.\n\n\n **Selecting an Event in Asset view**\n3. Open the Raw Log and UDM viewer by clicking the open icon in the **Timeline**.\n\n4. You can open **File hash** view for the file by clicking the hash value (for\n example, principal.process.file.md5) within the displayed UDM event.\n\nConsiderations\n--------------\n\nHash view has the following limitations:\n\n- You can only filter events that are displayed in this view.\n- Only DNS, EDR, Webproxy, and Alert event types are populated in this view. The first seen and last seen information populated in this view is also limited to these event types.\n- Generic events don't appear in any of the curated views. They appear only in raw log and UDM searches.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
Memilih Peristiwa di tampilan Aset