Need help in building OS Query for Finding SHA1 andSHA256

Hi Jenil,

I suggest checking the following request we've received previously, as this should give you a good starting place to create this query. 
- Live Discover and Response Query Forum > Threat Hunting

I used the exact Query that RaviSoni had provided. Somehow I got the error saying column does not exist. The name of the column is sfj.pathname.

Can you please help?

Regards,

Jenil

I used the exact Query that RaviSoni had provided. Somehow I got the error saying column does not exist. The name of the column is sfj.pathname.

Can you please help?

Regards,

Jenil

Checking the following documentation, it looks like the "pathname" column has been depreciated. You can instead use "path"
- docs.sophos.com/.../index.html

Thakyou. That resolved the error. But now it shows no column named SophosPID.

Can you please help.