To generate an alert when a binary hash first appears, which approach should you implement?

• A. Enable the Applied Threat Intelligence - Curated Prioritization rule set.
• B. Use Alerts & IOCs page with a filter on hashes and first_seen_time.
• C. Write a rule to examine file-related events that join with derived context for hashes in the entity graph; compare timestamp to first_seen_time.
• D. Use statistics in search on the current day and verify first_seen_time predates the day.

Answer: (C)

Detecting the first appearance of a binary hash relies on tying each file event to the hash’s first_seen_time in the derived hash context within the entity graph, then triggering when that event occurs at the same time as the hash’s first_seen_time. By writing a rule that joins file-related events with the hash’s derived context and compares the event timestamp to first_seen_time, you capture the exact moment the hash is observed for the first time in your environment, and you can alert immediately.

The other approaches don’t directly enable that real-time first-seen alert. A threat intelligence rule set focuses on known indicators rather than discovering and alerting on new appearances. The Alerts & IOCs page with a filter is a manual, ad-hoc view rather than an automatic alert. Using day-based statistics and first_seen_time predating the day is retrospective and not tied to the specific first occurrence of the hash, so it won’t reliably trigger at the moment a hash first appears.