Integrations on HashWatch Docs

CLI & CI/CD

Mon, 01 Jan 0001 00:00:00 +0000

`hashwatch` verify CLI#

Verify files against HashWatch’s known-good corpus from a terminal or a pipeline.

hashwatch verify <file>... # hash local file(s) and verify
hashwatch verify --url <url> # stream-download, hash, and verify
hashwatch verify --sha256 <hex> # verify a precomputed digest
cat file | hashwatch verify - # hash stdin

Flags: --api-key (or $HASHWATCH_API_KEY) widens the check from the public feed to the full known-good corpus · --json · --quiet · --allow-unknown.

Exit codes (so CI fails on an unverified artifact):

Pull feeds

Mon, 01 Jan 0001 00:00:00 +0000

Public pull feeds#

All feeds are public, read-only, and cover the current verified hash set. Poll politely (hourly is plenty — responses are cache-friendly).

Format	URL
JSON	`https://api.hashwatch.us/public/feed.json`
RSS	`https://api.hashwatch.us/public/feed.rss`
STIX 2.1	`https://api.hashwatch.us/public/feed/stix`
TAXII 2.1 (discovery)	`https://api.hashwatch.us/taxii2/`

JSON#

{
 "feed": "hashwatch-verified",
 "date": "2026-06-28",
 "count": 420,
 "transparency": "https://api.hashwatch.us/public/transparency/2026-06-28",
 "records": [
 { "executable_name": "...", "vendor": "...", "version": "...",
 "platform": "windows", "arch": "amd64",
 "sha256": "…", "sha1": "…", "md5": "…", "signer": "…",
 "source_url": "…", "valid_from": "2026-06-28T10:00:00Z" }
 ]
}

Each JSON feed links the matching transparency root.

STIX / TAXII#

Records are emitted as STIX 2.1 indicator objects with indicator_types: ["benign"] and a [file:hashes.'SHA-256' = '…'] pattern — an allowlist of known-good software for suppressing false positives in EDR/SIEM. Object IDs are deterministic, so re-pulls are idempotent.

SIEM & EDR

Mon, 01 Jan 0001 00:00:00 +0000

SIEM / EDR pull connectors#

HashWatch is pull-based: your platform polls a feed on a schedule and uses the known-good hashes as an allowlist to suppress false positives or to enrich file events.

Platform	How
Microsoft Sentinel	Threat Intelligence → Add TAXII server. API root `https://api.hashwatch.us/taxii2/api/`, collection `5f8a1c3e-0b2d-4e6f-8a1b-2c3d4e5f6a7b`, no credentials.
Splunk	REST/scripted input polling `https://api.hashwatch.us/public/feed.json` into a lookup.
Elastic	Filebeat `httpjson` on the JSON feed, or the Threat Intel TAXII input on the TAXII root.
QRadar / OpenCTI / MISP	Subscribe to the TAXII 2.1 `hashwatch-verified` collection.
Anything	`curl` the JSON feed on a cron and write a SHA-256 allowlist.

These are known-good (benign) indicators, not threat IOCs — configure your platform to treat them as allow/suppress, not alert.

Integrations on HashWatch Docs

CLI & CI/CD

hashwatch verify CLI#

Pull feeds

Public pull feeds#

JSON#

STIX / TAXII#

SIEM & EDR

SIEM / EDR pull connectors#

`hashwatch` verify CLI#