Skip to content

Create Server.Enrichment.Hashlookup.yaml#569

Open
jCrossM wants to merge 1 commit into
Velocidex:masterfrom
jCrossM:patch-1
Open

Create Server.Enrichment.Hashlookup.yaml#569
jCrossM wants to merge 1 commit into
Velocidex:masterfrom
jCrossM:patch-1

Conversation

@jCrossM

@jCrossM jCrossM commented Apr 15, 2023

Copy link
Copy Markdown

Hi,

If you have some VQL tips to optimize this artifact I'm interested.

Thx!

@CLAassistant

CLAassistant commented Apr 15, 2023

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

@scudette

Copy link
Copy Markdown
Collaborator

It's probably not going to be useful in practice because it sends an API call for each file.

You probably need to limit the hashes to check and maybe combine many hashes in the same API call. Do you know if this is a feature of the API?

Another possibility is to look up hashes in multiple threads so they are done in parallel.

@jCrossM

jCrossM commented Apr 16, 2023

Copy link
Copy Markdown
Author

Yes, wee can send bulk hashes to the API. I will look this way.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants