--- title: "Managing File Hashes and Known File Occurrences | ThreatConnect" slug: "managing-file-hashes-and-known-file-occurrences" description: "This article describes how to manage a File Indicator’s hashes, size, and File Occurrences. It also describes how to merge two File Indicators with different hash types into a single File Indicator containing both hashes." updated: 2024-01-04T13:04:36Z published: 2024-01-04T13:04:36Z canonical: "knowledge.threatconnect.com/managing-file-hashes-and-known-file-occurrences" --- > ## Documentation Index > Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt > Use this file to discover all available pages before exploring further. # Managing File Hashes and Known File Occurrences ## Overview A File Indicator represents a unique file hash (MD5, SHA1, and SHA256) or series of hashes. On a File Indicator’s **Details**screen, you can view and manage the Indicator’s hashes, size (in bytes), and known File Occurrences. ## Before You Start | Minimum Role(s) | Organization role of Standard User | | --- | --- | | Prerequisites | A File Indicator created in one of your ThreatConnect owners | ## Managing File Hash Details ### New Details Screen 1. [Navigate to the **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen#viewing-the-details-screen) for a File Indicator. 2. Scroll down to view the **File Hash Details**card on the left side of the screen (Figure 1). The **File Hash Information**section of this card displays the File Indicator’s hashes and size. ![Figure%201_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.3.3](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%201_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.3.3.png) NoteIf file hash information exists in CAL™ for the Indicator, a **CAL™ File Hash Information**section will be displayed on the **File Hash Details**card. See the [“Viewing CAL Data for an Indicator” section of *ThreatAssess and CAL*](https://knowledge.threatconnect.com/docs/threatassess-and-cal#viewing-cal-data-for-an-indicator)**for more information on the **CAL™ File Hash Information**section. 3. Click **Edit**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)at the top right of the **File Hash Details**card, or click on any of the fields in the **File Hash Information** section. The **File Hash Information**section will now be editable (Figure 2). ![Figure%202_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.3.3](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%202_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.3.3.png) - **MD5**, **SHA1**, and **SHA256**: - If the File Indicator *does not contain*the respective hash, a text box in which you can enter the hash will be displayed. After entering a valid file hash, click **Save![Confirm icon_Details screen](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)**to the right of the text box. - If the File Indicator *contains*the respective hash, a **Delete![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Delete%20button_Details%20screen.png)**button will be displayed to the right of the hash. Click this button to delete the hash. Note that if a File Indicator contains only one hash, you will not be able to delete the hash. - **Size (bytes)**: - If the File Indicator *does not* contain a file size, a text box in which you can enter the file size, in bytes, will be displayed. After entering the File Indicator’s size, click **Save![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Confirm%20icon_Details%20screen.png)**to the right of the text box. - If the File Indicator *contains*a file size, a **Delete![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Delete%20button_Details%20screen.png)**button will be displayed to the right of the file size. Click this button to delete the file size. 4. After all desired changes are made, click **Exit Edit Mode**at the top right of the **File Hash Details**card. If you add a new hash to an existing File Indicator and a File Indicator containing that hash exists in the same owner, the **Merge File Indicators**window will be displayed. Click the **Merge**button to merge the two File Indicators into a single File Indicator that contains both hashes and each Indicator’s Attributes, Security Labels, and Tags. ImportantYou can merge only File Indicators containing different file hash types. For example, you can merge a File Indicator containing an MD5 hash with a File Indicator containing a SHA1 hash, but you cannot merge two File Indicators containing MD5 hashes. ### Legacy Details Screen 1. [Navigate to the legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for a File Indicator. 2. Scroll down to view the **Hashes**card on the left side of the screen (Figure 3). This card displays the File Indicator’s hashes and size. ![Figure%203_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%203_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) - **MD5**, **SHA-1**, and **SHA-256**: - If the File Indicator *does not contain*the respective hash, a **Click here to add one.**link will be displayed. Click this link to display the **Add Hash**window, which is where you can enter the hash. - If the File Indicator *contains*the respective hash, a **Delete![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Trash%20icon_Black.png)**icon will be displayed to the right of the hash. Click this button to delete the hash. Note that a File Indicator must contain at least two hashes for the **Delete![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Trash%20icon_Black.png)**icon to be displayed. - **Size (bytes)**: Click **Edit**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Light%20gray.png)to display a text box where you can enter the File Indicator’s size, in bytes. After entering the size in the text box, click **Save**![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Save%20icon.png). If you add a new hash to an existing File Indicator and a File Indicator containing that hash exists in the same owner, the **Add Hash**window will display a **Merge Hashes**checkbox (Figure 4). ![Figure%204_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%204_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) Select this checkbox and then click the **SAVE**button to merge the two File Indicators into a single File Indicator that contains both hashes and each Indicator’s Attributes, Security Labels, and Tags. ImportantYou can merge only File Indicators containing different file hash types. For example, you can merge a File Indicator containing an MD5 hash with a File Indicator containing a SHA1 hash, but you cannot merge two File Indicators containing MD5 hashes. ## Known File Occurrences Known File Occurrences provide a record of the various file names being used for the File Indicator you are investigating. ### New Details Screen #### Creating File Occurrences 1. [Navigate to the **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for a File Indicator. 2. Scroll down to view the **Known File Occurrences**card on the right side of the screen (Figure 5). ![Figure%205_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%205_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) 3. Click **Add**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Add%20button_Details%20screen.png)at the upper-right corner of the **Known File Occurrences**card. The **Add File Occurrence**window will be displayed (Figure 6). ![Figure%206_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%206_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) - **File Name**: Enter the file name of the File Occurrence. - **Date**: Select the date of the File Occurrence. - **Run Path**: Enter the run path of the File Occurrence. - Click the **Save**button. #### Managing File Occurrences Click **Edit**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Edit%20button_Details%20card_Details%20screen.png)or **Delete![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Delete%20button_Details%20screen.png)**in the rightmost column for a File Occurrence to edit or delete it, respectively. ### Legacy Details Screen #### Creating File Occurrences 1. [Navigate to the legacy **Details**screen](https://knowledge.threatconnect.com/docs/the-details-screen-legacy#viewing-the-legacy-details-screen) for a File Indicator. 2. Scroll down to view the **Known File Occurrences**card on the left side of the screen (Figure 7). ![Figure%207_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%207_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) 3. Click **Add New Occurrence**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Plus%20icon_Blue.png)at the upper-right corner of the **Known File Occurrences**card. Fields for entering the File Occurrence’s details will be displayed (Figure 8). ![Figure%208_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Figure%208_Managing%20File%20Hashes%20and%20Known%20File%20Occurrences_7.0.0.png) - **File Name**: Enter the file name of the File Occurrence. - **Run Path**: Enter the run path of the File Occurrence. - **Date**: Select the date of the File Occurrence. - Click the **SAVE**button. #### Managing File Occurrences Click **Edit![](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Pencil%20icon_Black.png)**or **Delete**![Icon Description automatically generated](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Trash%20icon_Black.png)to the right of a File Occurrence to edit or delete it, respectively. --- *ThreatConnect® is a registered trademark, and CAL™ is a trademark, of ThreatConnect, Inc.* 20148-01 v.02.A ## Related - [Modeling File Behavior](/modeling-file-behavior.md) - [The Details Screen](/the-details-screen.md) - [The Details Screen (Legacy)](/the-details-screen-legacy.md)