Skip to main content

Documentation

Version

  1. uberAgent
  2. 7.1.1
  3. ESA Features & Configuration
  4. Threat Detection Engine
  5. Event Properties
  6. File System Activity Event Properties
Previous document Next document

File System Activity Event Properties

You can use the following event properties with file system events in uAQL queries (event type File.*). In addition to the properties listed here, the common properties are applicable, too.

Property name uAQL Data Type Description Platform
File.CreationDate String The file creation date (format: Unix epoch timestamp in ms). all
File.HasExecPermissions Boolean Determined by checking the file’s executable bits. Available for all event types. macOS
File.IsExecutable Boolean Indicates whether the file is an executable.

  • Windows: determined by inspecting the file’s first two bytes. Available for the following event types: File.Create, File.Delete, File.ChangeCreationTime.
  • macOS: determined by inspecting the file’s first four bytes. Available for the following event types: File.ChangeCreationTime, File.Create, File.Rename, File.Write.
all
File.Name String The file name only, without the path. all
File.Path String The full path including the file name. all
File.PreviousCreationDate String In case of File.ChangeCreationTime events: the original creation date. Windows
File.PreviousName String In case of File.Rename events: the original file name. all
File.PreviousPath String In case of File.Rename events: the original file path including the file name. all

Comments

Your email address will not be published. Required fields are marked *