Cortex XSOAR uses a single
File
indicator
for file objects. As a result, files appear with their SHA256 hash
and all other hashes associated with the file, (MD5, SHA1, and SSDeep)
are listed as properties of the same indicator. In addition, when
ingesting an incident through an integration, all file information
is presented as one object.