Brandon Mesa
11/04/2022, 2:51 PMsharvil
11/04/2022, 3:05 PMfile_events
table (and not the es_process_file_events
)…I will have to dive deeper in the code, but IIRC it’s only CREATED
and UPDATED
that populates those (I will have to double check in a bit)file
table tooms5,sha1,sha256
columns might require a join with the hash
tableBrandon Mesa
11/04/2022, 3:08 PMsharvil
11/04/2022, 4:26 PMBrandon Mesa
11/04/2022, 4:52 PMsharvil
11/04/2022, 6:10 PM