[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[[["\u003cp\u003eGoogle Security Operations allows searching for files using their MD5, SHA-1, or SHA-256 hash values.\u003c/p\u003e\n"],["\u003cp\u003eAdditional information about file hashes found in a customer's account is automatically added to associated UDM events.\u003c/p\u003e\n"],["\u003cp\u003eFile hashes can be viewed directly by entering the hash value in the search field, or by navigating to the File hash view from another view.\u003c/p\u003e\n"],["\u003cp\u003eGoogle Security Operations provides extra file information like partner detection, properties, and VirusTotal submissions.\u003c/p\u003e\n"],["\u003cp\u003eFile hash view has limitations, such as filtering only the events displayed, limited event types, and a lack of generic events in curated views.\u003c/p\u003e\n"]]],[],null,["# Investigate a file\n==================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n\nYou can use Google Security Operations to search your data for a specific file based on\nits MD5, SHA-1, or SHA-256 hash value.\n\nIf additional information is available for a file hash found within a customer's\nGoogle SecOps account, this additional information is added to the\nassociated UDM events automatically. You can search for these UDM events\nmanually using UDM Search or by using rules.\n\nView a file hash\n----------------\n\nTo view a file hash, you can:\n\n- View a file in **File hash** view directly\n\n- Navigate to **File hash** view from another view\n\nView a file in File hash view directly\n--------------------------------------\n\nTo open **File hash** view directly, enter the hash value in the\nGoogle SecOps search field and click **Search**.\n| **Note:** [UDM search](/chronicle/docs/investigation/udm-search) provides enhanced capabilities that let you conduct more thorough investigatzions of the events and alerts within your Google SecOps instance than is possible using **File hash** view alone. For more information, see [UDM search](/chronicle/docs/investigation/udm-search).\n\nGoogle SecOps provides additional information about the file, including the\nfollowing:\n\n- **Partner engines detecting**: Other security vendors who have detected the\n file.\n\n- **Properties/metadata**: Known properties of the file.\n\n- **VT submitted/ITW filenames**: Known malicious in-the-wild (ITW) malware\n submitted to VirusTotal.\n\nNavigate to File hash view from another view\n--------------------------------------------\n\nYou can also navigate to **File hash** view while investigating an asset in an\nanother view (for example, **Asset** view) by completing the following steps:\n\n1. Open an investigation view. For example, select an asset to view it within\n Asset view.\n\n2. In the **Timeline** to the left, scroll to any event tied to a process or\n file modification, such as **Network Connection**.\n\n\n **Selecting an Event in Asset view**\n3. Open the Raw Log and UDM viewer by clicking the open icon in the **Timeline**.\n\n4. You can open **File hash** view for the file by clicking the hash value (for\n example, principal.process.file.md5) within the displayed UDM event.\n\nConsiderations\n--------------\n\nHash view has the following limitations:\n\n- You can only filter events that are displayed in this view.\n- Only DNS, EDR, Webproxy, and Alert event types are populated in this view. The first seen and last seen information populated in this view is also limited to these event types.\n- Generic events don't appear in any of the curated views. They appear only in raw log and UDM searches.\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
在“资产”视图中选择事件