# Trying to get a simple detection on certificate hashes to fire **URL:** \ **Category:** Zeek\ **Created:** [March 1, 2018, 11:08am UTC](https://community.zeek.org/t/trying-to-get-a-simple-detection-on-certificate-hashes-to-fire/5204 "2018-03-01T11:08:17Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [March 1, 2018, 11:08am UTC](https://community.zeek.org/t/trying-to-get-a-simple-detection-on-certificate-hashes-to-fire/5204/1 "2018-03-01T11:08:17Z")
Hi all, I’m trying to create, what I assume should be, a simple detection and notification based on certificate hashes. Sadly I seem to have gotten something very wrong - since it doesn’t fire at all. What I’ve done is that I’ve created a file named certstream.bro with the following content: ← Cut → @load base/frameworks/intel @load frameworks/intel/seen @load frameworks/intel/do\_notice redef Intel::read\_files += { “/usr/local/bro/share/site/certstream/intel.dat” }; ← Cut → I load this file from local.bro with no errors or complaints, it shows up in loaded\_scripts.log and all that. The file I reference as my ‘Intelligence file’ looks as follows: ← Cut → #fields indicator indicator\_type meta.source meta.do\_notice 7B00009ACF21C67564F1AC3C31000000009ACF Intel::CERT\_HASH certstream Stolen hash from the x509 log T 0551B592FA53CF2052B8B70F275CC159 Intel::CERT\_HASH certstream Stolen hash from the x509 log T 2AA9E2483E8C62DF0037D183 Intel::CERT\_HASH certstream Stolen hash from the x509 log T ← Cut → The hashes I’m using are taken from my x509.log - just to make sure that I tested against something that comes up quite a lot in our environment. I’ve been using data from the field ‘serial’ - since there is no actual field called ‘hash’ in either x509.log or known\_certs. Have I been using the wrong identifier or is there some ‘hash all certs’ setting somewhere that I’ve missed? As always - grateful for any tips or pointers. Thanks in advance, Mike ---
**Author:** ![Azoff\_Justin\_S](https://avatars.discourse-cdn.com/v4/letter/a/dec6dc/32.png) [@Azoff\_Justin\_S](https://community.zeek.org/u/Azoff_Justin_S)\ **Post date:** [March 1, 2018, 1:48pm UTC](https://community.zeek.org/t/trying-to-get-a-simple-detection-on-certificate-hashes-to-fire/5204/2 "2018-03-01T13:48:11Z")
Ah.. that is where you went wrong.. The hashes for certs end up in files.log (with all other files). It could make sense for it to be in the x509 or known certs log. I know there was some talk about re-doing that log file to be more useful and less verbose. In any case, if you have a cert of interest in the x509.log, you can use the 'id' column to find the corresponding file record in the files.log The files.log has the sha1 column which is the hash you would add to the intel file. If you wanted to see how it is implemented, [https://github.com/bro/bro/blob/master/scripts/policy/frameworks/intel/seen/x509.bro](https://github.com/bro/bro/blob/master/scripts/policy/frameworks/intel/seen/x509.bro) is what produces all the intel data from certs. ---
**Author:** ![SwedishMike](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/swedishmike/32/605_2.png) [@SwedishMike](https://community.zeek.org/u/SwedishMike)\ **Post date:** [March 1, 2018, 2:02pm UTC](https://community.zeek.org/t/trying-to-get-a-simple-detection-on-certificate-hashes-to-fire/5204/3 "2018-03-01T14:02:49Z")
Justin, Many thanks for that - looking in all the wrong places for the right things as usual. 😉 Cheers, Mike ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:45pm UTC](https://community.zeek.org/t/trying-to-get-a-simple-detection-on-certificate-hashes-to-fire/5204/4 "2022-05-06T15:45:36Z")