File System Activity Event Properties
You can use the following event properties with file system events in uAQL queries (event type
File.*). In addition to the properties listed here, the common properties are applicable, too.
| Property name | uAQL Data Type | Description | Platform |
|---|---|---|---|
File.CreationDate |
String | The file creation date (format: Unix epoch timestamp in ms). | all |
File.HasExecPermissions |
Boolean | Determined by checking the file's executable bits. Available for all event types. | macOS |
File.IsExecutable |
Boolean | Indicates whether the file is an executable. Windows: determined by inspecting the file's first two bytes. Available for the following event types: File.Create, File.Delete, File.ChangeCreationTime.macOS: determined by inspecting the file's first four bytes. Available for the following event types: File.ChangeCreationTime, File.Create, File.Rename, File.Write. |
all |
File.Name |
String | The file name only, without the path. | all |
File.Path |
String | The full path including the file name. | all |
File.PreviousCreationDate |
String | In case of File.ChangeCreationTime events: the original creation date. |
Windows |
File.PreviousName |
String | In case of File.Rename events: the original file name. |
all |
File.PreviousPath |
String | In case of File.Rename events: the original file path including the file name. |
all |