From 0c6364170be1e77d98f8a00eb7c1c0b7f4543434 Mon Sep 17 00:00:00 2001 From: Tomer Alpert Date: Sun, 22 Apr 2018 14:26:32 +0000 Subject: [PATCH 1/3] Updated hunting reference to state Sha256 is usually not populated --- ...g-reference-windows-defender-advanced-threat-protection.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md index db6c9b6f35..1f122c4e75 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md @@ -64,7 +64,7 @@ Use the following table to understand what the columns represent, its data type, | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event. | | InitiatingProcessParentName | string | Name of the parent process that spawned the process responsible for the event. | | InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event. | -| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. | +| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated - please use the SHA-1 field when available. | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event. | | IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory. | | LocalIP | string | IP address assigned to the local machine used during communication. | @@ -97,7 +97,7 @@ Use the following table to understand what the columns represent, its data type, | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to. | | ReportIndex | long | Event identifier that is unique among the same event type. | | SHA1 | string | SHA-1 of the file that the recorded action was applied to. | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. +| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated - please use the SHA-1 field when available. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink) From 6447f49fbaeb83edf4848f52c37a0807c5e644e3 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Mon, 23 Apr 2018 21:48:53 +0000 Subject: [PATCH 2/3] Updated advanced-hunting-reference-windows-defender-advanced-threat-protection.md --- ...ing-reference-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md index 1f122c4e75..6e3bca670d 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md @@ -97,7 +97,7 @@ Use the following table to understand what the columns represent, its data type, | RemoteUrl | string | URL or fully qualified domain name (FQDN) that was being connected to. | | ReportIndex | long | Event identifier that is unique among the same event type. | | SHA1 | string | SHA-1 of the file that the recorded action was applied to. | -| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated - please use the SHA-1 field when available. +| SHA256 | string | SHA-256 of the file that the recorded action was applied to. This field is usually not populated—use the SHA1 column when available. >Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-advancedhuntingref-belowfoldlink) From c617a8b86631b1515a9fdf5850dfbb4d98874769 Mon Sep 17 00:00:00 2001 From: Louie Mayor Date: Mon, 23 Apr 2018 21:51:30 +0000 Subject: [PATCH 3/3] Updated advanced-hunting-reference-windows-defender-advanced-threat-protection.md --- ...ing-reference-windows-defender-advanced-threat-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md index 6e3bca670d..e0ff5a7be1 100644 --- a/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-atp/advanced-hunting-reference-windows-defender-advanced-threat-protection.md @@ -64,7 +64,7 @@ Use the following table to understand what the columns represent, its data type, | InitiatingProcessParentId | int | Process ID (PID) of the parent process that spawned the process responsible for the event. | | InitiatingProcessParentName | string | Name of the parent process that spawned the process responsible for the event. | | InitiatingProcessSha1 | string | SHA-1 of the process (image file) that initiated the event. | -| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated - please use the SHA-1 field when available. | +| InitiatingProcessSha256 | string | SHA-256 of the process (image file) that initiated the event. This field is usually not populated—use the SHA1 column when available. | | InitiatingProcessTokenElevation | string | Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event. | | IsAzureADJoined | boolean | Boolean indicator of whether machine is joined to the Azure Active Directory. | | LocalIP | string | IP address assigned to the local machine used during communication. |