genian-edr-add-malware-hash-batch
Registers a custom Malware Hash IOC for every input row, a hundred per console call. This command changes the console, so profile is required.
genian-edr-add-malware-hash-batch profile=VALUE [field=VALUE] [file-name=VALUE] [severity=VALUE] [verdict=VALUE] [response=VALUE] [msg=VALUE] [tag=VALUE] [description=VALUE]
- profile=VALUE
- Required. Genian EDR connect profile name. Required: a change is made on exactly one console.
- field=VALUE
- Optional. Input field holding the hash of each row. Defaults to hash.
- file-name=VALUE
- Optional. File name of the hash Used when an input row has no field of the same name.
- severity=VALUE
- Optional. Severity code. Use a value existing entries (the list command) carry; the codes are defined on the console. Used when an input row has no field of the same name.
- verdict=VALUE
- Optional. Malware classification code. Use a value existing entries (the list command) carry; the codes are defined on the console. Used when an input row has no field of the same name.
- response=VALUE
- Optional. Response code. Use a value existing entries (the list command) carry; the codes are defined on the console. Used when an input row has no field of the same name.
- msg=VALUE
- Optional. Detection message Used when an input row has no field of the same name.
- tag=VALUE
- Optional. Comma separated tags Used when an input row has no field of the same name.
- description=VALUE
- Optional. Description Used when an input row has no field of the same name.
Output Fields
| Field | Type | Name | Description |
|---|---|---|---|
| _result | String | Result | e.g. success. success, fail or skip (empty or repeated value). |
| _error | String | Error | e.g. invalid hash: xyz. Why the row failed or was skipped. |