looking to parse out sha2 value using LPT

[JohnBabio]

Nothing quite fits parsing out the sha2 value in our malware alert we receive. I see ioc is a meta value but it looks like its based on ip's and domains from a list.

[jeffshurtliff]

Hi John,

I have moved this thread to the RSA NetWitness Suite" data-type="space so that you can get an answer to your question.

You can post future questions and discussions directly to that community by clicking on the Ask a Question or Start a Discussion button on the RSA NetWitness Suite" data-type="space page.

Thanks,
Jeff

[EricPartington]

not clear as to your question...  please provide sample log and what you are trying to parse.

Is this a syslog message from the MA service that you are trying to parse? if so please provide the syslog message.  if its from another system please provide that syslog event