File Fieldsedit
A file is defined as a set of information that has been created on, or has existed on a filesystem.
File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
File Field Detailsedit
| Field | Description | Level |
|---|---|---|
file.accessed |
Last time the file was accessed. Note that not all filesystems keep track of access time. type: date |
extended |
file.created |
File creation time. Note that not all filesystems store the creation time. type: date |
extended |
file.ctime |
Last time the file attributes or metadata changed. Note that changes to the file content will update type: date |
extended |
file.device |
Device that is the source of the file. type: keyword example: |
extended |
file.directory |
Directory where the file is located. type: keyword example: |
extended |
file.extension |
File extension. type: keyword example: |
extended |
file.gid |
Primary group ID (GID) of the file. type: keyword example: |
extended |
file.group |
Primary group name of the file. type: keyword example: |
extended |
file.inode |
Inode representing the file in the filesystem. type: keyword example: |
extended |
file.mode |
Mode of the file in octal representation. type: keyword example: |
extended |
file.mtime |
Last time the file content was modified. type: date |
extended |
file.name |
Name of the file including the extension, without the directory. type: keyword example: |
extended |
file.owner |
File owner’s username. type: keyword example: |
extended |
file.path |
Full path to the file. type: keyword example: |
extended |
file.size |
File size in bytes. Only relevant when type: long example: |
extended |
file.target_path |
Target path for symlinks. type: keyword |
extended |
file.type |
File type (file, dir, or symlink). type: keyword example: |
extended |
file.uid |
The user ID (UID) or security identifier (SID) of the file owner. type: keyword example: |
extended |
Field Reuseedit
Field sets that can be nested under Fileedit
| Nested fields | Description |
|---|---|
Hashes, usually file hashes. |