Elastic defend file hases

[GyciakasGh0st]

Maybe some one find the way that elastic defend will collect file hashes md5 or sha1 ? I tried these
settings i didn't helped:
windows.advanced.alerts.hash.md5 set to true
windows.advanced.alerts.hash.sha1 set to true
windows.advanced.events.hash.md5 set to true
windows.advanced.events.hash.sha1 set to true

[defensivedepth]

For what specific types of logs?

[GyciakasGh0st]

We thought logs of file creation/modification has any type of hash md5 or sha1 to identifie known bad hashes