File System Activity Event Properties
You can use the following event properties with file system events in uAQL queries (event type File.*
). In addition to the properties listed here, the common properties are applicable, too.
Property name | uAQL Data Type | Description | Platform |
---|---|---|---|
File.CreationDate |
String | The file creation date (format: Unix epoch timestamp in ms). | all |
File.HasExecPermissions |
Boolean | Determined by checking the file’s executable bits. Available for all event types. | macOS |
File.IsExecutable |
Boolean | Indicates whether the file is an executable.
|
all |
File.Name |
String | The file name only, without the path. | all |
File.Path |
String | The full path including the file name. | all |
File.PreviousCreationDate |
String | In case of File.ChangeCreationTime events: the original creation date. |
Windows |
File.PreviousName |
String | In case of File.Rename events: the original file name. |
all |
File.PreviousPath |
String | In case of File.Rename events: the original file path including the file name. |
all |