Investigation

Security teams should investigate flagged hashes by examining security_ai.hash_string.input_messages.strings and security_ai.hash_string.output_messages.strings. Analysis should include reviewing the full conversation context for references to usernames, credentials, or structured exfiltration payloads, and verifying if the hash corresponds to known-bad IOCs.

False Positives

Legitimate workflows such as security/forensics tools conducting threat intelligence lookups or CI/CD pipelines utilizing git commit SHAs, Docker image digests, or package checksums may trigger this rule. Contextual review is required to verify the nature of the hash.