This documentation does not apply to the most recent version of uberAgent. Click here for the latest version.
File System Activity Event Properties
You can use the following event properties with file system events in uAQL queries (event type File.*
). In addition to the properties listed here, the common properties are applicable, too.
Property name | uAQL Data Type | Description | Platform |
---|---|---|---|
File.CreationDate |
String | The file creation date (format: Unix epoch timestamp in ms). | all |
File.HasExecPermissions |
Boolean | Determined by checking the file’s executable bits. Available for all event types. | macOS |
File.IsExecutable |
Boolean | Indicates whether the file is an executable.
|
all |
File.Name |
String | The file name only, without the path. | all |
File.Path |
String | The full path including the file name. | all |
File.PreviousCreationDate |
String | In case of File.ChangeCreationTime events: the original creation date. |
Windows |
File.PreviousName |
String | In case of File.Rename events: the original file name. |
all |
File.PreviousPath |
String | In case of File.Rename events: the original file path including the file name. |
all |