# Endpoint events dont contain process or file hash

**URL:** <https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583>\
**Category:** Elastic Security\
**Created:** [February 2, 2023, 10:54pm UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583 "2023-02-02T22:54:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![yak990](https://avatars.discourse-cdn.com/v4/letter/y/c68b51/32.png) [@yak990](https://discuss.elastic.co/u/yak990)\
**Post date:** [February 2, 2023, 10:54pm UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583/1 "2023-02-02T22:54:19Z")

</div>

I'm looking through a series of endpoint events, and do not see the hash of the process or file. The events are in endpoint.events.registry in this case. The hash is important, because its easy to cut and paste that into virustotal to see if its a known problem. Is there a reason the hash is excluded from the event collection process?

---

<div class="post-metadata">

**Author:** ![NathanLau](https://avatars.discourse-cdn.com/v4/letter/n/e9a140/32.png) [@NathanLau](https://discuss.elastic.co/u/NathanLau)\
**Post date:** [February 16, 2023, 2:30am UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583/2 "2023-02-16T02:30:47Z")

</div>

Could you paste your endpoint policy to discuss?

---

<div class="post-metadata">

**Author:** ![wsouza](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wsouza/32/92547_2.png) [@wsouza](https://discuss.elastic.co/u/wsouza)\
**Post date:** [February 25, 2023, 1:51am UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583/3 "2023-02-25T01:51:28Z")

</div>

What integrations are you using in your policy? Could you please describe better what is happening?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 25, 2023, 1:52am UTC](https://discuss.elastic.co/t/endpoint-events-dont-contain-process-or-file-hash/324583/4 "2023-03-25T01:52:04Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.