SSDeepSimilarity
This script finds similar files that can be related to each other by fuzzy hash (SSDeep).
python · Common Scripts
Details
| ID | SSDeepSimilarity |
|---|---|
| Language | python |
| From Version | 5.5.0 |
| Docker Image | demisto/ssdeep:1.0.0.11009641 |
README
This script finds similar files that can be related to each other by fuzzy hash (SSDeep).
Script Data
| Name | Description |
|---|---|
| Script Type | python3 |
| Tags | |
| Cortex XSOAR Version | 5.5.0 |
Inputs
| Argument Name | Description |
|---|---|
| ssdeep_hash | The SSDeep hash to check for similarity against. |
| ssdeep_hashes_to_compare | A list of SSDeep hashes to check for similarity to the ssdeep_hash input. |
| output_key | The context key to which the list of SSDeep hashes will be outputted. In case used, the default outputs will not contain the results. In order to get results, replace the SSDeepSimilarity in default outputs with the output_key provided. |
Outputs
| Path | Description | Type |
|---|---|---|
| SSDeepSimilarity.compared_hashes.similarityValue | The difference calculation score between the ssdeep_hash and the compared hash. | number |
| SSDeepSimilarity.compared_hashes.hash | The hash compared to the ssdeep_hash. | string |
Please note the outputs are changed to use output_key instead of ‘SSDeepSimilarity’ if provided.
commonfields: id: SSDeepSimilarity version: -1 name: SSDeepSimilarity script: '' type: python tags: [] comment: This script finds similar files that can be related to each other by fuzzy hash (SSDeep). enabled: true args: - name: ssdeep_hash required: true description: The SSDeep hash to check for similarity against. - name: ssdeep_hashes_to_compare required: true description: A list of SSDeep hashes to check for similarity to the ssdeep_hash input. isArray: true - name: output_key description: |- The context key to which the list of SSDeep hashes will be outputted. In case used, the default outputs will not contain the results. In order to get results, replace the SSDeepSimilarity in default outputs with the output_key provided. defaultValue: SSDeepSimilarity outputs: - contextPath: SSDeepSimilarity.compared_hashes.similarityValue description: The difference calculation score between the ssdeep_hash and the compared hash. type: number - contextPath: SSDeepSimilarity.compared_hashes.hash description: The hash compared to the ssdeep_hash. type: string scripttarget: 0 subtype: python3 dockerimage: demisto/ssdeep:1.0.0.11009641 runas: DBotWeakRole fromversion: 5.5.0 tests: - No tests (auto formatted)