{
    "id": "File",
    "version": -1,
    "modified": "2025-11-06T12:44:35.728115215Z",
    "sortValues": [
        "3961"
    ],
    "shouldCommit": false,
    "regex": "\\b[a-fA-F\\d]{32}\\b|\\b[a-fA-F\\d]{40}\\b|\\b[a-fA-F\\d]{64}\\b|\\b[a-fA-F\\d]{128}\\b",
    "details": "File",
    "prevDetails": "File",
    "reputationCommand": "file",
    "enhancementScriptNames": [
        "FileReputation"
    ],
    "system": false,
    "locked": false,
    "disabled": false,
    "file": false,
    "updateAfter": 0,
    "mergeContext": false,
    "contextPath": "File(val.SHA256 \u0026\u0026 val.SHA256 === obj.SHA256 || val.SHA1 \u0026\u0026 val.SHA1 === obj.SHA1 || val.MD5 \u0026\u0026 val.MD5 === obj.MD5 || val.SHA512 \u0026\u0026 val.SHA512 === obj.SHA512 || val.SSDeep \u0026\u0026 val.SSDeep === obj.SSDeep)",
    "defaultMapping": {
        "actor": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Actor",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "associatedfilenames": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Name",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "associations": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Associations",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "behavior": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Behavior",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "blocked": {
            "simple": "File.Blocked"
        },
        "communitynotes": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "CommunityNotes",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "detectionengines": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "DetectionEngines",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "entryid": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "EntryID",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "feedrelatedindicators": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "FeedRelatedIndicators",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "fileextension": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Extension",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "filetype": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Type",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "firstseenbysource": {
            "simple": "File.FirstSeenBySource"
        },
        "globalprevalence": {
            "simple": "File.GlobalPrevalence"
        },
        "lastseenbysource": {
            "simple": "File.LastSeenBySource"
        },
        "malwarefamily": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "MalwareFamily",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "md5": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "MD5",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "organizationfirstseen": {
            "simple": "File.OrganizationFirstSeen"
        },
        "organizationlastseen": {
            "simple": "File.OrganizationLastSeen"
        },
        "organizationprevalence": {
            "simple": "File.OrganizationPrevalence"
        },
        "path": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Path",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "positivedetections": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "PositiveDetections",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "publications": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Publications",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "quarantined": {
            "simple": "File.Quarantined"
        },
        "reportedby": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "ReportedBy",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "sha1": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA1",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    }
                ]
            }
        },
        "sha256": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA256",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "sha512": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA512",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureauthentihash": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Authentihash",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturecopyright": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Copyright",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturedescription": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Description",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturefileversion": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.FileVersion",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureinternalname": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.InternalName",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureoriginalname": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.OriginalName",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signed": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signed",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "size": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Size",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "ssdeep": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SSDeep",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    }
                ]
            }
        },
        "tags": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Tags",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "threattypes": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "ThreatTypes",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "trafficlightprotocol": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "TrafficLightProtocol",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        }
    },
    "manualMapping": {
        "actor": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Actor",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "associatedfilenames": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Name",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "associations": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Associations",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "behavior": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Behavior",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "blocked": {
            "simple": "File.Blocked"
        },
        "communitynotes": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "CommunityNotes",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "detectionengines": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "DetectionEngines",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "entryid": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "EntryID",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "feedrelatedindicators": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "FeedRelatedIndicators",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "fileextension": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Extension",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "filetype": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Type",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "firstseenbysource": {
            "simple": "File.FirstSeenBySource"
        },
        "globalprevalence": {
            "simple": "File.GlobalPrevalence"
        },
        "lastseenbysource": {
            "simple": "File.LastSeenBySource"
        },
        "malwarefamily": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "MalwareFamily",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "md5": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "MD5",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "organizationfirstseen": {
            "simple": "File.OrganizationFirstSeen"
        },
        "organizationlastseen": {
            "simple": "File.OrganizationLastSeen"
        },
        "organizationprevalence": {
            "simple": "File.OrganizationPrevalence"
        },
        "orionenginedetectionnames": {
            "complex": {
                "root": "File.Orion",
                "filters": [],
                "accessor": "EngineDetectionNames",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "orionenginedetections": {
            "complex": {
                "root": "File.Orion",
                "filters": [],
                "accessor": "EngineDetections",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "orionenginevendors": {
            "complex": {
                "root": "File.Orion",
                "filters": [],
                "accessor": "EngineVendors",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "path": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Path",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "positivedetections": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "PositiveDetections",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "publications": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Publications",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "quarantined": {
            "simple": "File.Quarantined"
        },
        "reportedby": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "ReportedBy",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "sha1": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA1",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    }
                ]
            }
        },
        "sha256": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA256",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "sha512": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SHA512",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    },
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureauthentihash": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Authentihash",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturecopyright": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Copyright",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturedescription": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.Description",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signaturefileversion": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.FileVersion",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureinternalname": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.InternalName",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signatureoriginalname": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signature.OriginalName",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "signed": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Signed",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "size": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Size",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "ssdeep": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "SSDeep",
                "transformers": [
                    {
                        "operator": "toUpperCase"
                    }
                ]
            }
        },
        "tags": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "Tags",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "threattypes": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "ThreatTypes",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        },
        "trafficlightprotocol": {
            "complex": {
                "root": "File",
                "filters": [],
                "accessor": "TrafficLightProtocol",
                "transformers": [
                    {
                        "operator": "uniq"
                    }
                ]
            }
        }
    },
    "fileHashesPriority": [
        "ssdeep",
        "sha512",
        "md5",
        "sha1",
        "sha256"
    ],
    "expiration": 0,
    "layout": "unifiedFileRep1",
    "fromVersion": "6.10.0"
}