SPLK-2003 · Question #89
Which of the following queries would return all artifacts that contain a SHA1 file hash?
The correct answer is B. https://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains="". To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only those that contain a value in the SHA1 field within the Common Event Format (CEF
Question
Which of the following queries would return all artifacts that contain a SHA1 file hash?
Options
- Ahttps://<PHANTOM_URL>/rest/artifact?_filter_cef_md5_insull=false
- Bhttps://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains=""
- Chttps://<PHANTOM_URL>/rest/artifact?_filter_cef_shal_insull=False
- Dhttps://<PHANTOM_URL>/rest/artifact?_filter_shal__insull=False
How the community answered
(36 responses)- A3% (1)
- B81% (29)
- C11% (4)
- D6% (2)
Explanation
To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only those that contain a value in the SHA1 field within the Common Event Format (CEF) data structure. The contains operator is used to match any artifacts that have a SHA1 hash present.
Topics
Community Discussion
No community discussion yet for this question.