-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
/
hash.table
21 lines (21 loc) · 896 Bytes
/
hash.table
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
table_name("hash")
description("Filesystem hash data.")
schema([
Column("path", TEXT, "Must provide a path or directory", index=True, required=True),
Column("directory", TEXT, "Must provide a path or directory", required=True),
Column("md5", TEXT, "MD5 hash of provided filesystem data"),
Column("sha1", TEXT, "SHA1 hash of provided filesystem data"),
Column("sha256", TEXT, "SHA256 hash of provided filesystem data"),
])
extended_schema(POSIX, [
Column("ssdeep", TEXT, "ssdeep hash of provided filesystem data"),
])
extended_schema(LINUX, [
Column("pid_with_namespace", INTEGER, "Pids that contain a namespace", additional=True, hidden=True),
Column("mount_namespace_id", TEXT, "Mount namespace id", hidden=True),
])
implementation("hash@genHash")
examples([
"select * from hash where path = '/etc/passwd'",
"select * from hash where directory = '/etc/'",
])