Endpoint Protection

Dear All, I want to extract HASH value from SEP risk logs or from sep web console for detected malware. Is their any way to collect such information from sepm web consol or from sep risk logs. Thanks,

In the Risk log, click on the risk and then on "Details". You'll find its SHA-2 hash.

In the Exception policy, under "Windows Exceptions > Applications", you can see the hashes as well.

##EDIT

If you want to grab all hashes, just export the Risk log and open it in a spreadsheet.

The Risk log itself should contain these. Just export and filter on the column as needed.

when you export risk log you can find these information in the Column U,V in the by the name "Application Hash" "Hash Algorithm"

Hi Milan_T,

This should help:

How to determine the unique hash of a file detected by Symantec Endpoint Protection
Article URL: http://www.symantec.com/docs/TECH211522

Don't forget about SONAR's detctions, as well:

Using SEPM Alerts and Reports to Combat a Malware Outbreak
https://www-secure.symantec.com/connect/articles/using-sepm-alerts-and-reports-combat-malware-outbreak

 

For the benefit of future admins with the same question, please do mark this thread "Solved" if you have received your answer!

With thanks and best regards,

Mick