Which of the following queries would return all artifacts that contain a SHA1 file hash?

The correct answer is B. https://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains="". To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only those that contain a value in the SHA1 field within the Common Event Format (CEF

Working with the API

Question

Options

Ahttps://<PHANTOM_URL>/rest/artifact?_filter_cef_md5_insull=false
Bhttps://<PHANTOM_URL>/rest/artifact?_filter_cef_Shal_contains=""
Chttps://<PHANTOM_URL>/rest/artifact?_filter_cef_shal_insull=False
Dhttps://<PHANTOM_URL>/rest/artifact?_filter_shal__insull=False

How the community answered

(36 responses)

A
3% (1)
B
81% (29)
C
11% (4)
D
6% (2)

Explanation

To return all artifacts that contain a SHA1 file hash using the Splunk SOAR REST API, the correct query would use the _filter_cef_Shal_contains parameter. This parameter filters the artifacts to only those that contain a value in the SHA1 field within the Common Event Format (CEF) data structure. The contains operator is used to match any artifacts that have a SHA1 hash present.

Topics

#REST API#artifact filtering#CEF fields#SHA1

Community Discussion

No community discussion yet for this question.

Full SPLK-2003 Practice