# Find file hashes and network events — query reference

Review the two-stage Defender query example: find file hashes in DeviceFileEvents, then look for matching network events. The file name and hashes are captured examples.

!!!warning Source-derived reference
These notes were recovered from OneNote. Configuration, permissions and operating results have not been freshly verified. Confirm the applicable authority and environment before acting.
!!!

USE THIS KQL to get the SHA1/SHA256 of filename.

DeviceFileEvents

\| where FileName contains "infatica"

\| project Timestamp,ActionType,ProductName = InitiatingProcessVersionInfoProductName, ProcessDescription = InitiatingProcessVersionInfoFileDescription,ParentFileName = InitiatingProcessParentFileName,ParentProcessCreationTime = InitiatingProcessParentCreationTime,FileName,FolderPath,InitiatingProcessAccountUpn,InitiatingProcessSHA1

USE the following KQL to find all network related events that involved the SHA1 or SHA265 that you found in the above.

DeviceNetworkEvents

//\| where DeviceName contains "gcc"

//\| where InitiatingProcessFileName contains "infatica1140" or InitiatingProcessParentFileName contains "infatica1140"

\| where InitiatingProcessSHA256 contains "4f966328f131988979eb1401e9ef512836b35e79502877e00566a261b58409cb" or InitiatingProcessSHA256 contains "821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431"

\| sort by Timestamp

## Related guidance

- [Topic overview](Introduction.md)
- [Source review status](../../review/Review-status.md)