File System Activity Event Properties
You can use the following event properties with file system events in uAQL queries (event type
File.*). In addition to the properties listed here, the common properties are applicable, too.
| Property name | uAQL Data Type | Description | Platform |
|---|---|---|---|
File.CreationDate |
String | The file creation date (format: Unix epoch timestamp in ms). | Win, macOS |
File.HasExecPermissions |
Boolean | Determined by checking the file's executable bits. Available for all event types. | macOS |
File.IsExecutable |
Boolean | Indicates whether the file is an executable, determined by inspecting the file's first two bytes. Available for the following event types: File.Create, File.Delete, File.ChangeCreationTime. |
Windows |
File.Name |
String | The file name only, without the path. | Win, macOS |
File.Path |
String | The full path including the file name. | Win, macOS |
File.PreviousCreationDate |
String | In case of File.ChangeCreationTime events: the original creation date. |
Windows |
File.PreviousName |
String | In case of File.Rename events: the original file name. |
Win, macOS |
File.PreviousPath |
String | In case of File.Rename events: the original file path including the file name. |
Win, macOS |