Managing Hash Groups

Interrogate comes prepopulated with known MD-5 or SHA-1 Indicators of Compromise. Groups or combinations of groups may be selected at any time for searching across your endpoints. 

Single hash value entry

Whether searching for single or multiple hash values, you must create a group in which to place your MD-5 or SHA-1. 

Adding a single hash

1. Create or edit a hash group
2. Click on the Add Hash Values button at the bottom right of the edit grid
3. Type or paste your hash value in the Add Hash dialog box.
4. Click the plus sign to automatically add the hash value to your included column
5. Repeat the process above with as many hash values as you would like, or create/import a hash list and use the instructions below for importing the list.

Multiple hash values

Interrogate supports the importing of hash value lists. This saves you a great deal of time when importing a lot of hash values. Follow the steps below to import a keyword list.

Importing a hash list

1. Create or edit a hash group
2. Click on the Add Hash Values button at the bottom right of the edit grid
3. Click on Browse in the Load Hash File area
4. Browse to the location of your .txt file
5. Click Upload
6. Click Save Group

Download and import a hash list from Heureka's IOC database

1. Identify which IOC group you would like to install on your system
2. Click the link and select the download option
3. Locate the downloaded zip file and (optionally) verify the SHA-1 Checksum provided in the download grid
4. Follow the steps above to create/import your hash list as a group