Manage Your Processes and Hashes
A process is a named, executable program that has been observed running in your environment. A process hash is a digital fingerprint of a specific version of a process executable file.
Flag a Process
A flag on a process tells InsightIDR to generate an alert each time the process is used. If you identify a malicious process in your environment, you can flag the process and an alert will be generated with the details of where and when the process was executed.
If you flag commonly used processes, such as
chrome.exe, you can expect to receive an influx of benign alerts. To avoid this, we recommend that you flag only the processes that you want to generate alerts for, such as a downloaded malware executable in your environment.
When you select a process, the Process Details page provides information on process variants (hashes), a timeline of discovery, and assets that contain the file.
To flag a process:
- From the top Search, enter the exact name of the process you want to flag. For example, if you want to flag the
- On the Process Details page, switch the Flag Process toggle to on.
Note: To disable a process flag, switch the toggle off.
Flag a Process Hash
Process hashes, or variants, can be used to identify potentially vulnerable versions of processes in your environment, as well as malicious programs that have the same name as common legitimate software.
For example, if you want to know if any users in your environment are using a version of
chrome.exe that has a vulnerability, you can flag a specific version (hash) of the
chrome.exe process to immediately receive alerts if anyone is running an outdated version of Chrome.
Process Hash Details
When you select a process hash, InsightIDR provides additional information about the hash, including:
- Operating System
- File Size
- Signature Verification
- File Names
- Threat Level
- First Analyzed Time
- File Reputation Report
The File Reputation Report displays additional details from Virus Total. You can learn more about Virus total at: https://www.virustotal.com/gui/home/upload
Tip: Copy and paste the MD5 or SHA1 hashes into the top Search bar to discover if any systems on your network have been running the process's hashes.
To flag a process hash:
- From the top Search, enter for the exact name of the process containing the variant (hash) you want to update. For example, if you want to flag the
- In the Process Variants section, select the variant you want to flag.
- On the Process Hash Details page, switch the Flag Hash toggle to on.
Note: To disable a process hash flag, switch the toggle off.
Reset a process or hash flag
To reset a process or hash flag, switch the respective toggle off and then turn it back on.