Where can I find User Instructions for searching for a block of hashes on a regular basis, and emailing an alert if any one of them are detected?
Add your hashes into a csv and create a lookup from it.
Then your query would be something like:
index=(your index) .... [|inputlookup md5s.csv ...] ...
with the "..." being your refining criteria for your search.
