TLSH index

Model tlsh

Indexes the distinct digests in the tlsh field, which tlsh() needs. Run a backfill after adding it to cover logs already stored.

Part of: CelesTLSH fuzzy hash hunting
Required by: Untrusted Binary Similar to an Attack Tool, TLSH Similarity to Attack Tools

Add it

In Bifract, open Exchange, find TLSH index and click Add. Adds an analytics model to the fractal. It builds from new logs; run a backfill under Analytics for stored ones. Needs an analyst.

File

exchange/models/tlsh_index.yaml

tlsh_index.yaml

name: tlsh_index
description: >-
  The distinct TLSH digests in the tlsh field. tlsh() compares a lookup's digests against
  this index. It has no filter: tlsh() only uses an index of the whole fractal, and logs
  without a digest are skipped anyway. Run a backfill after adding it to index logs
  already stored.
model_type: tlsh
definition:
  key_fields: [tlsh]