On this page
Edit this page

file

Event fields used to define metadata about files either locally or over the wire (Network Traffic). This entity and attributes can extend other entities such as source and destination.

Attributes

Name

Type

Description

Sample Value

file_accessed_time

date

When the file was last accessed . Also known as atime

2016-11-25 18:21:47

file_changed_time

date

When the file was last changed. Also known as ctime

2016-11-25 18:21:47

file_creation_time

date

When the file was created. Also known as crtime

2016-11-25 18:21:47

file_directory

string

Directory of file(s). It does not include the file name

C:\users\wardog\

file_extension

string

The file extension of a file (.txt, .exe, etc)

exe

file_hard_links

integer

Number of hard links

3

file_hash_imphash

string

IMPHASH hash of the image/binary/file

2505BD03D7BD285E50CE89CEC02B333B

file_hash_md5

string

MD5 hash of the image/binary/file

6A255BEBF3DBCD13585538ED47DBAFD7

file_hash_sha1

string

SHA1 hash of the image/binary/file

B0BF5AC2E81BBF597FAD5F349FEEB32CAC449FA2

file_hash_sha256

string

SHA256 hash of the image/binary/file

4668BB2223FFB983A5F1273B9E3D9FA2C5CE4A0F1FB18CA5C1B285762020073C

file_hash_sha512

string

SHA512 hash of the image/binary/file

1AD1D79F85D8F6A50EA282F63898D652661DAA0C1FD361C22647CABC98A70E8CBCE83200D579D10DD0A3D46BE9496DCDFDDF28B0C5E9709343B032A8796FBECB

file_inode

integer

Filesystem inode number

``````

file_link_name

string

path of the hard link

C:\Docs\My.exe

file_mime_type

string

Specifies the MIME type name specified for a file

application/msword

file_modified_time

date

When the file was last modified. Also known as mtime

2016-11-25 18:21:47

file_name

string

name of a file without its full path. This could be a local file or transmitted over the network.

a.exe

file_path

string

full path of a file including the name of the file.

C:\users\wardog\z.exe

file_previous_name

string

The file’s previous name

C:\\Windows\system32\cmd.exe

file_size

string

Specifies the size of a file, in bytes

45

file_symlink

integer

1 if the path is a symlink, otherwise 0

0

file_symlink_name

string

path of the symlink

C:\Docs\My.exe

file_system_block_size

integer

Block size of filesystem

``````

file_system_type

string

The file system type, ex: fat32, ntfs, vmfs, ext3, ext4, xfs

ntfs
logon registry