File Modification schema
Use this reference to identify the fields available in the filemod schema and the parser fields used to populate them.
For a field to be populated in Sophos XDR, the corresponding parser field must be present in the source data.
Schema summary
| Property | Value |
|---|---|
| Schema name | FileMod |
| Parser field prefix | FileMod |
| Supports custom parsers | Yes |
| Schema components | None defined |
Schema fields
| Normalized Field | Type | ParserField | Description |
|---|---|---|---|
| resource_id | string | resourceId$ | Full resource string identifying the record. |
| tenant_id | string | tenantId$ | ID of the tenant. |
| sensor_type | string | sensorType$ | Type of device that generated this event. |
| sensor_event_id | string | sensorEventId$ | Event ID of original_data assigned by the sensor. |
| sensor_tenant | string | sensorTenant$ | A customer ID supplied by the application that originated the data. |
| sensor_id | string | sensorId$ | An ID for the data supplied by the application that originated it. |
| sensor_cpe | string | sensorCpe$ | CPE of the platform producing the alert. |
| original_data | string | originalData$ | Original, unadulterated data prior to any transformation. |
| event_time_usec | uint64 | eventTimeUsec$ | Event time in microseconds (µs). |
| ingest_time_usec | uint64 | ingestTimeUsec$ | Ingest time in microseconds (µs). |
| event_time_fidelity | TimeFidelity | eventTimeFidelity$ | Specifies the original precision of the time used to populate event_time_usec. |
| host_id | string | hostId$ | The host ID that uniquely identifies the host where the event originated, such as IPv(4/6) address or device MAC address. |
| was_modification_allowed | bool | wasModificationAllowed$ | |
| process_id | string | processId$ | Identifier provided by the OS for the running process that modified the file. |
| process_create_time_usec | uint64 | processCreateTimeUsec$ | Create time of the process that modified the file in µs. |
| process_correlation_id | string | processCorrelationId$ | Process correlation ID to protect against rolling IDs. |
| file_name | string | fileName$ | Name of the file modified. |
| file_hash | FileHash | fileHash$ | Hash of the file modified. |
| action | string | action$ | Action taken on the file, such as created, deleted, or updated. |
| commandline | string | commandline$ | Full command line of the process that made the file modification. |
| parent_commandline | string | parentCommandline$ | Full command line of the parent process of the process that made the file modification. |
| parent_path | string | parentPath$ | Path to binary of the parent process of the process that made the file modification. |
| parent_process_file_hash | FileHash | parentProcessFileHash$ | File hashes of the binary file of the parent process of the process that made the file modification. |
| parent_process_id | string | parentProcessId$ | Process ID of the parent process of the process that made the file modification. |
| process_username | string | processUsername$ | Username of the user that ran the process that made the file modification. |
| process_file_hash | FileHash | processFileHash$ | File hashes of the binary file of the process that made the file modification. |
| process_image_path | string | processImagePath$ | The process path. |
| sensor_version | string | sensorVersion$ | The agent version as string. |