DeviceFileEvents
DeviceFileEvents contains file creation, modification, and other file system events reported by Microsoft Defender for Endpoint.
tablesCurrent
Relationships
Microsoft Defender for Endpoint
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiDeviceProcessEvents
Related tabletableDeviceEvents
Related tabletableDeviceImageLoadEvents
Related tabletable
Source productproductMicrosoft Defender for Endpoint P2
Required licenselicenseMicrosoft Graph Security API
API accessapiMicrosoft Defender for Endpoint APIs
API accessapiLegacy Microsoft Defender XDR APIs
API accessapiDeviceProcessEvents
Related tabletableDeviceEvents
Related tabletableDeviceImageLoadEvents
Related tabletable
Schema
| Field | Type | Description | Copy |
|---|---|---|---|
Timestamp | datetime | Date and time when the event was recorded. | |
DeviceId | string | Unique identifier for the device in the service. | |
DeviceName | string | Fully qualified domain name of the device. | |
ActionType | string | Type of file activity that triggered the event. | |
FileName | string | Name of the file that the recorded action was applied to. | |
FolderPath | string | Folder containing the file that the recorded action was applied to. | |
SHA1 | string | SHA-1 hash of the file that the recorded action was applied to. | |
SHA256 | string | SHA-256 hash of the file that the recorded action was applied to. | |
InitiatingProcessAccountSid | string | Security identifier of the account that ran the process responsible for the event. | |
InitiatingProcessCommandLine | string | Command line used to run the process responsible for the event. |