Proposal: New malware hashes fields for harmonization

[navtej]

I see currently harmonization provides

malware.hash.sha256
malware.hash.sha1
malware.hash.md5

Can it be kept generic by providing two fields

malware.hash.type
malware.hash.value

where malware.hash.type can be one of md5, sha1, sha256, ssdeep, imphash and malware.hash.value is a string

[aaronkaplan]

But if you get a sha256 and a sha-1 of something, which one will you keep?

[dmth]

Thanks for your suggestion. I agree on Aarons doubt from two days ago. In addition I'd like to remind of the discussion we had on the mailing list which provided different possibilities to keep track of the type.

[ghost]

Please see here: https://lists.cert.at/pipermail/intelmq-dev/2016-December/000143.html and https://lists.cert.at/pipermail/intelmq-dev/2017-January/000144.html