Loading table information…

Structured examples

Contribute a synthetic example using PowerShell or an export from the hunting portal. Contributions are reviewed before publication.

These examples use synthetic values and cover only some possible event variants. Use them as a reference, never as ground truth or a complete schema. Fields can vary between events; a field shown here is not necessarily required.

Action

`AdditionalFields`

Submit an example

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_5.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_6.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreatedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt",
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileRenamed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_3",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_3",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_3",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileRenamedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt",
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_3",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_3",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_3",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileRenamed

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_5.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_6.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_5.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_6.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_3",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_3",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_3",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_2",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_5.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileModified

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileModifiedAggregatedReport

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt",
  "uniqueEventsAggregated": 1
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string
`$.uniqueEventsAggregated`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_3.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_4.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_3.txt",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_4.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_3.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_4.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FileType": "SAMPLEFILE_1.txt"
}

Payload fields and types

Path	Type
`$`	object
`$.FileType`	string

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixRealUser": {
    "LogonId": 1
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileCreated

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FilePosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "FileType": "SAMPLEFILE_5.txt",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_6.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_3",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_2",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_3",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_3",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixGroupOwner`	object
`$.FilePosixGroupOwner.Name`	string
`$.FilePosixGroupOwner.PosixGroupId`	integer
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FilePosixUserOwner`	object
`$.FilePosixUserOwner.DomainName`	string
`$.FilePosixUserOwner.LogonId`	integer
`$.FilePosixUserOwner.Name`	string
`$.FilePosixUserOwner.PosixUserId`	integer
`$.FilePosixUserOwner.PrimaryPosixGroup`	object
`$.FilePosixUserOwner.PrimaryPosixGroup.Name`	string
`$.FilePosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer
`$.FileType`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

Action: FileDeleted

All values in this example are synthetic. Format: JSON; column encoding: json-string.

{
  "FilePosixPermissions": [
    "SAMPLEFILE_1.txt"
  ],
  "FileType": "SAMPLEFILE_2.txt",
  "InitiatingProcessCurrentWorkingDirectory": "VALUE_1",
  "InitiatingProcessPosixEffectiveGroup": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixEffectiveUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixFilePermissions": [
    "SAMPLEFILE_3.txt"
  ],
  "InitiatingProcessPosixGroupOwner": {
    "Name": "USERNAME_1",
    "PosixGroupId": 1
  },
  "InitiatingProcessPosixProcessGroupId": 1,
  "InitiatingProcessPosixRealUser": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  },
  "InitiatingProcessPosixSessionId": 1,
  "InitiatingProcessPosixUserOwner": {
    "DomainName": "COMPUTERNAME_1",
    "LogonId": 1,
    "Name": "USERNAME_1",
    "PosixUserId": 1,
    "PrimaryPosixGroup": {
      "Name": "USERNAME_1",
      "PosixGroupId": 1
    }
  }
}

Payload fields and types

Path	Type
`$`	object
`$.FilePosixPermissions`	array
`$.FilePosixPermissions[]`	string
`$.FileType`	string
`$.InitiatingProcessCurrentWorkingDirectory`	string
`$.InitiatingProcessPosixEffectiveGroup`	object
`$.InitiatingProcessPosixEffectiveGroup.Name`	string
`$.InitiatingProcessPosixEffectiveGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixEffectiveUser`	object
`$.InitiatingProcessPosixEffectiveUser.DomainName`	string
`$.InitiatingProcessPosixEffectiveUser.LogonId`	integer
`$.InitiatingProcessPosixEffectiveUser.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PosixUserId`	integer
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixEffectiveUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixFilePermissions`	array
`$.InitiatingProcessPosixFilePermissions[]`	string
`$.InitiatingProcessPosixGroupOwner`	object
`$.InitiatingProcessPosixGroupOwner.Name`	string
`$.InitiatingProcessPosixGroupOwner.PosixGroupId`	integer
`$.InitiatingProcessPosixProcessGroupId`	integer
`$.InitiatingProcessPosixRealUser`	object
`$.InitiatingProcessPosixRealUser.DomainName`	string
`$.InitiatingProcessPosixRealUser.LogonId`	integer
`$.InitiatingProcessPosixRealUser.Name`	string
`$.InitiatingProcessPosixRealUser.PosixUserId`	integer
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixRealUser.PrimaryPosixGroup.PosixGroupId`	integer
`$.InitiatingProcessPosixSessionId`	integer
`$.InitiatingProcessPosixUserOwner`	object
`$.InitiatingProcessPosixUserOwner.DomainName`	string
`$.InitiatingProcessPosixUserOwner.LogonId`	integer
`$.InitiatingProcessPosixUserOwner.Name`	string
`$.InitiatingProcessPosixUserOwner.PosixUserId`	integer
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup`	object
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.Name`	string
`$.InitiatingProcessPosixUserOwner.PrimaryPosixGroup.PosixGroupId`	integer

Observed fields are not a complete vendor contract. Parse JSON strings before expanding arrays; encoded JSON paths are marked ::<json>.

Sources and context: Microsoft table reference.

DeviceFileEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		File creation, modification, and other file system events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileOriginIP	IP address where the file was downloaded from	String
FileOriginReferrerUrl	URL of the web page that links to the downloaded file	String
FileOriginUrl	URL where the file was downloaded from	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsAzureInfoProtectionApplied	Indicates whether the file is encrypted by Azure Information Protection	Boolean
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
PreviousFileName	Original name of the file that was renamed as a result of the action	String
PreviousFolderPath	Original folder containing the file before the recorded action was applied	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
RequestAccountDomain	Domain of the account used to remotely initiate the activity	String
RequestAccountName	User name of account used to remotely initiate the activity	String
RequestAccountSid	Security Identifier (SID) of the account used to remotely initiate the activity	String
RequestProtocol	Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS	String
RequestSourceIP	IPv4 or IPv6 address of the remote device that initiated the activity	String
RequestSourcePort	Source port on the remote device that initiated the activity	Int32
SensitivityLabel	Label applied to an email, file, or other content to classify it for information protection	String
SensitivitySubLabel	Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
ShareName	Name of shared folder containing the file	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
FileCreated	A file was created on the device.
FileDeleted	A file was deleted.
FileModified	A file on the device was modified.
FileRenamed	A file on the device was renamed.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking

DeviceFileEvents Schema

Table description

TableSection	TableType	TableSectionName	Description	Source
Devices	Regular		File creation, modification, and other file system events	Defender

Table retention

ColdDays	HotDays	TotalInteractiveDays
0	30	30

Schema

Name	Description	Type
ActionType	Type of activity that triggered the event	String
AdditionalFields	Additional information about the entity or event	String
AppGuardContainerId	Identifier for the virtualized container used by Application Guard to isolate browser activity	String
DeviceId	Unique identifier for the device in Microsoft Defender for Endpoint	String
DeviceName	Fully qualified domain name (FQDN) of the device	String
FileName	Name of the file that the recorded action was applied to	String
FileOriginIP	IP address where the file was downloaded from	String
FileOriginReferrerUrl	URL of the web page that links to the downloaded file	String
FileOriginUrl	URL where the file was downloaded from	String
FileSize	Size of the file in bytes	Int64
FolderPath	Folder containing the file that the recorded action was applied to	String
InitiatingProcessAccountDomain	Domain of the account that ran the process responsible for the event	String
InitiatingProcessAccountName	User name of the account that ran the process responsible for the event	String
InitiatingProcessAccountObjectId	Microsoft Entra object ID of the user account that ran the process responsible for the event	String
InitiatingProcessAccountSid	Security Identifier (SID) of the account that ran the process responsible for the event	String
InitiatingProcessAccountUpn	User principal name (UPN) of the account that ran the process responsible for the event	String
InitiatingProcessCommandLine	Command line used to run the process that initiated the event	String
InitiatingProcessCreationTime	Date and time when the process that initiated the event was started	DateTime
InitiatingProcessFileName	Name of the process file that initiated the event; if unavailable, the name of the process that initiated the event might be shown instead	String
InitiatingProcessFileSize	Size of the process (image file) that initiated the event	Int64
InitiatingProcessFolderPath	Folder containing the process (image file) that initiated the event	String
InitiatingProcessId	Process ID (PID) of the process that initiated the event	Int64
InitiatingProcessIntegrityLevel	Integrity level of the process that initiated the event. Windows assigns integrity levels to processes based on certain characteristics, such as if they were launched from an internet download. These integrity levels influence permissions to resources.	String
InitiatingProcessMD5	MD5 hash of the process (image file) that initiated the event	String
InitiatingProcessParentCreationTime	Date and time when the parent of the process responsible for the event was started	DateTime
InitiatingProcessParentFileName	Name of the parent process that spawned the process responsible for the event	String
InitiatingProcessParentId	Process ID (PID) of the parent process that spawned the process responsible for the event	Int64
InitiatingProcessRemoteSessionDeviceName	Device name of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessRemoteSessionIP	IP address of the remote device from which the initiating process’s RDP session was initiated	String
InitiatingProcessSessionId	Windows session ID of the initiating process	Int64
InitiatingProcessSHA1	SHA-1 hash of the process (image file) that initiated the event	String
InitiatingProcessSHA256	SHA-256 hash of the process (image file) that initiated the event. This field is usually not populated - use the SHA1 column when available.	String
InitiatingProcessTokenElevation	Token type indicating the presence or absence of User Access Control (UAC) privilege elevation applied to the process that initiated the event	String
InitiatingProcessUniqueId	Unique identifier of the initiating process; this is equal to the Process Start Key in Windows devices	String
InitiatingProcessVersionInfoCompanyName	Company name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoFileDescription	Description from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoInternalFileName	Internal file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoOriginalFileName	Original file name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductName	Product name from the version information of the process (image file) responsible for the event	String
InitiatingProcessVersionInfoProductVersion	Product version from the version information of the process (image file) responsible for the event	String
IsAzureInfoProtectionApplied	Indicates whether the file is encrypted by Azure Information Protection	Boolean
IsInitiatingProcessRemoteSession	Indicates whether the initiating process was run under a remote desktop protocol (RDP) session (true) or locally (false)	Boolean
MachineGroup		String
MD5	MD5 hash of the file that the recorded action was applied to	String
PreviousFileName	Original name of the file that was renamed as a result of the action	String
PreviousFolderPath	Original folder containing the file before the recorded action was applied	String
ReportId	Event identifier based on a repeating counter.To identify unique events, this column must be used in conjunction with the DeviceName and Timestamp columns.	Int64
RequestAccountDomain	Domain of the account used to remotely initiate the activity	String
RequestAccountName	User name of account used to remotely initiate the activity	String
RequestAccountSid	Security Identifier (SID) of the account used to remotely initiate the activity	String
RequestProtocol	Network protocol, if applicable, used to initiate the activity: Unknown, Local, SMB, or NFS	String
RequestSourceIP	IPv4 or IPv6 address of the remote device that initiated the activity	String
RequestSourcePort	Source port on the remote device that initiated the activity	Int32
SensitivityLabel	Label applied to an email, file, or other content to classify it for information protection	String
SensitivitySubLabel	Sublabel applied to an email, file, or other content to classify it for information protection; sensitivity sublabels are grouped under sensitivity labels but are treated independently	String
SHA1	SHA-1 hash of the file that the recorded action was applied to	String
SHA256	SHA-256 of the file that the recorded action was applied to	String
ShareName	Name of shared folder containing the file	String
SourceSystem		String
TenantId		String
TimeGenerated		DateTime
Timestamp	Date and time when the record was generated	DateTime
Type		String

Action types

Name	Description
FileCreated	A file was created on the device.
FileDeleted	A file was deleted.
FileModified	A file on the device was modified.
FileRenamed	A file on the device was renamed.

Schema changes

Date	Action
2026-10-07	Column TenantId added
2026-10-07	Column Type added
2026-10-07	Column SourceSystem added
2026-10-07	Column MachineGroup added
2026-10-07	Column TimeGenerated added
2026-02-27	Column TenantId removed
2026-02-27	Column Type removed
2026-02-27	Column SourceSystem removed
2026-02-27	Column MachineGroup removed
2026-02-27	Column TimeGenerated removed
2024-10-18	Table added to tracking