Thanks for the link -I’ll give that a whirl later. Except it seems to generate the hash fine from what I can tell. When I manually query the cymru database from the sha1/md5 values in files.log, in some cases it matches but the detect-bro script doesn’t detect the match. There is also a large percentage of hash values that are not detected by cmyru.
Dave