About file hash calculation
File hash calculation enables post‑backup SHA‑256 hash computation for files stored in NetBackup backup images. Hashes are calculated for regular files and files contained within stream‑friendly compressed and archive formats as follows:
tar, zip, gz, bz2, xz, 7z, rar (RAR 5 is not supported), tar.gz, tgz, tar.bz2, tbz2, tar.xz, txz, jar, war, deb, rpm, cab, iso, and udeb
This feature enables hash‑based threat hunting for regular, compressed and archive files by matching computed file hashes against curated Indicators of Compromise (IOC) stores that contain known malicious hashes.
The hash calculation job computes cryptographic hashes in a streaming manner and stores the hash metadata in the NetBackup catalog. These hashes are transferred to the file hash server, where they are indexed and made available for search operations across backup images at scale.
NetBackup primary 11.2 or later is required.
Images for which hash calculation is performed must reside on NetBackup media server 11.2 or later.
Compute hosts used for hash calculation are supported only on Linux (Red Hat or SUSE) clients version 11.2 or later. The clients must have the
libarchiveOS library installed.The NetBackup file hash server must be a NetBackup media server 11.2 or later.
Standard, Windows and DNAS policy types are supported.
Hash calculation is not supported for synthetic backup images, client-side encrypted backup images or compressed images.