## Description:

This Processor compares a an attribute containing a Fuzzy Hash (TLSH or SSDeep) value and compares it against a list of hashes of the same family (i.e. TLSH is compared with a list of TLSH hashes), routing them to match or non-match depending on a user configured threshold for similarity.

It is important to note that:

- TLSH similarity increases as product of its comparison function decreases (i.e. 0 indicates nearly identical files)
- SSDeep similarity directly relates to the product of its comparison function (e.g. 99 indicates nearly identical files

Based on the above, this processor when referring to "exceed the score" may be referring to:

- a value equal or lower than the configured threshold (in case of TLSH)
- a value equal or higher than the configured threshold (in case of SSDeep)