{
"id": "File",
"version": -1,
"modified": "2025-11-06T12:44:35.728115215Z",
"sortValues": [
"3961"
],
"shouldCommit": false,
"regex": "\\b[a-fA-F\\d]{32}\\b|\\b[a-fA-F\\d]{40}\\b|\\b[a-fA-F\\d]{64}\\b|\\b[a-fA-F\\d]{128}\\b",
"details": "File",
"prevDetails": "File",
"reputationCommand": "file",
"enhancementScriptNames": [
"FileReputation"
],
"system": false,
"locked": false,
"disabled": false,
"file": false,
"updateAfter": 0,
"mergeContext": false,
"contextPath": "File(val.SHA256 \u0026\u0026 val.SHA256 === obj.SHA256 || val.SHA1 \u0026\u0026 val.SHA1 === obj.SHA1 || val.MD5 \u0026\u0026 val.MD5 === obj.MD5 || val.SHA512 \u0026\u0026 val.SHA512 === obj.SHA512 || val.SSDeep \u0026\u0026 val.SSDeep === obj.SSDeep)",
"defaultMapping": {
"actor": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Actor",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"associatedfilenames": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Name",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"associations": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Associations",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"behavior": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Behavior",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"blocked": {
"simple": "File.Blocked"
},
"communitynotes": {
"complex": {
"root": "File",
"filters": [],
"accessor": "CommunityNotes",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"detectionengines": {
"complex": {
"root": "File",
"filters": [],
"accessor": "DetectionEngines",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"entryid": {
"complex": {
"root": "File",
"filters": [],
"accessor": "EntryID",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"feedrelatedindicators": {
"complex": {
"root": "File",
"filters": [],
"accessor": "FeedRelatedIndicators",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"fileextension": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Extension",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"filetype": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Type",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"firstseenbysource": {
"simple": "File.FirstSeenBySource"
},
"globalprevalence": {
"simple": "File.GlobalPrevalence"
},
"lastseenbysource": {
"simple": "File.LastSeenBySource"
},
"malwarefamily": {
"complex": {
"root": "File",
"filters": [],
"accessor": "MalwareFamily",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"md5": {
"complex": {
"root": "File",
"filters": [],
"accessor": "MD5",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"organizationfirstseen": {
"simple": "File.OrganizationFirstSeen"
},
"organizationlastseen": {
"simple": "File.OrganizationLastSeen"
},
"organizationprevalence": {
"simple": "File.OrganizationPrevalence"
},
"path": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Path",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"positivedetections": {
"complex": {
"root": "File",
"filters": [],
"accessor": "PositiveDetections",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"publications": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Publications",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"quarantined": {
"simple": "File.Quarantined"
},
"reportedby": {
"complex": {
"root": "File",
"filters": [],
"accessor": "ReportedBy",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"sha1": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA1",
"transformers": [
{
"operator": "toUpperCase"
}
]
}
},
"sha256": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA256",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"sha512": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA512",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"signatureauthentihash": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Authentihash",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturecopyright": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Copyright",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturedescription": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Description",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturefileversion": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.FileVersion",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signatureinternalname": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.InternalName",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signatureoriginalname": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.OriginalName",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signed": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signed",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"size": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Size",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"ssdeep": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SSDeep",
"transformers": [
{
"operator": "toUpperCase"
}
]
}
},
"tags": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Tags",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"threattypes": {
"complex": {
"root": "File",
"filters": [],
"accessor": "ThreatTypes",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"trafficlightprotocol": {
"complex": {
"root": "File",
"filters": [],
"accessor": "TrafficLightProtocol",
"transformers": [
{
"operator": "uniq"
}
]
}
}
},
"manualMapping": {
"actor": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Actor",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"associatedfilenames": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Name",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"associations": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Associations",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"behavior": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Behavior",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"blocked": {
"simple": "File.Blocked"
},
"communitynotes": {
"complex": {
"root": "File",
"filters": [],
"accessor": "CommunityNotes",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"detectionengines": {
"complex": {
"root": "File",
"filters": [],
"accessor": "DetectionEngines",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"entryid": {
"complex": {
"root": "File",
"filters": [],
"accessor": "EntryID",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"feedrelatedindicators": {
"complex": {
"root": "File",
"filters": [],
"accessor": "FeedRelatedIndicators",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"fileextension": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Extension",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"filetype": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Type",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"firstseenbysource": {
"simple": "File.FirstSeenBySource"
},
"globalprevalence": {
"simple": "File.GlobalPrevalence"
},
"lastseenbysource": {
"simple": "File.LastSeenBySource"
},
"malwarefamily": {
"complex": {
"root": "File",
"filters": [],
"accessor": "MalwareFamily",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"md5": {
"complex": {
"root": "File",
"filters": [],
"accessor": "MD5",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"organizationfirstseen": {
"simple": "File.OrganizationFirstSeen"
},
"organizationlastseen": {
"simple": "File.OrganizationLastSeen"
},
"organizationprevalence": {
"simple": "File.OrganizationPrevalence"
},
"orionenginedetectionnames": {
"complex": {
"root": "File.Orion",
"filters": [],
"accessor": "EngineDetectionNames",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"orionenginedetections": {
"complex": {
"root": "File.Orion",
"filters": [],
"accessor": "EngineDetections",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"orionenginevendors": {
"complex": {
"root": "File.Orion",
"filters": [],
"accessor": "EngineVendors",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"path": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Path",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"positivedetections": {
"complex": {
"root": "File",
"filters": [],
"accessor": "PositiveDetections",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"publications": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Publications",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"quarantined": {
"simple": "File.Quarantined"
},
"reportedby": {
"complex": {
"root": "File",
"filters": [],
"accessor": "ReportedBy",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"sha1": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA1",
"transformers": [
{
"operator": "toUpperCase"
}
]
}
},
"sha256": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA256",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"sha512": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SHA512",
"transformers": [
{
"operator": "toUpperCase"
},
{
"operator": "uniq"
}
]
}
},
"signatureauthentihash": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Authentihash",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturecopyright": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Copyright",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturedescription": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.Description",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signaturefileversion": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.FileVersion",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signatureinternalname": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.InternalName",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signatureoriginalname": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signature.OriginalName",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"signed": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Signed",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"size": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Size",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"ssdeep": {
"complex": {
"root": "File",
"filters": [],
"accessor": "SSDeep",
"transformers": [
{
"operator": "toUpperCase"
}
]
}
},
"tags": {
"complex": {
"root": "File",
"filters": [],
"accessor": "Tags",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"threattypes": {
"complex": {
"root": "File",
"filters": [],
"accessor": "ThreatTypes",
"transformers": [
{
"operator": "uniq"
}
]
}
},
"trafficlightprotocol": {
"complex": {
"root": "File",
"filters": [],
"accessor": "TrafficLightProtocol",
"transformers": [
{
"operator": "uniq"
}
]
}
}
},
"fileHashesPriority": [
"ssdeep",
"sha512",
"md5",
"sha1",
"sha256"
],
"expiration": 0,
"layout": "unifiedFileRep1",
"fromVersion": "6.10.0"
}