EDR Event Schema Reference
File Activity
class_name = "File Activity" | class_uid = 1001
File Activity events are generated whenever a process performs a file system operation — creating, writing, deleting, or renaming a file.
Activity ID Mappings
| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 6 | Create | 100101 | A new file was created on the file system |
| 8 | Update | 100103 | Data was written to an existing file |
| 9 | Delete | 100104 | A file was deleted |
| 10 | Rename | 100105 | A file was renamed |
| 20 | Directory Create | — | A new file directory was created |
Target File (file.*)
| Field | Type | Description |
|---|---|---|
| file.name | String | Filename including extension (e.g., malware.exe) |
| file.path | String | Full filesystem path |
| file.ext | String | File extension without leading dot |
| file.type_id | Long | File type (1=Regular, 2=Folder, 7=Symlink, 8=Executable) |
Resulting File (file_result.*)
Present after rename or copy operations — describes the file after the operation.
| Field | Type | Description |
|---|---|---|
| file_result.name | String | New filename after the operation |
| file_result.path | String | New full path after the operation |
| file_result.ext | String | Extension of the resulting file |
| file_result.type_id | Long | File type of the resulting file |
Actor — Initiating Process (actor.process.*)
| Field | Type | Description |
|---|---|---|
| actor.process.name | String | Name of the process performing the file operation |
| actor.process.pid | Long | PID of the acting process |
| actor.process.uid | String | Unique ID of the acting process instance |
| actor.process.cmd_line | String | Full command line of the acting process |
| actor.process.created_time | DateTime | Timestamp when the acting process was created |
| actor.process.file.name | String | Executable filename of the acting process |
| actor.process.file.path | String | Executable path of the acting process |
| actor.process.file.sha256 | String | SHA-256 of the acting process executable |
| actor.process.file.ext | String | File extension of the acting process executable |
| actor.process.file.type_id | Long | File type ID of the acting process executable |
| actor.process.file.hashes.algorithm | String | Hash algorithm |
| actor.process.file.hashes.value | String | Hash value |
| actor.process.file.company_name | String | Company name of the acting process executable |
| actor.process.file.version | String | Version of the acting process executable |
| actor.process.file.size | Long | Size of the acting process executable in bytes |
| actor.process.file.accessed_time | DateTime | Last access time of the acting process executable |
| actor.process.file.modified_time | DateTime | Last modified time of the acting process executable |
| actor.process.file.created_time | DateTime | Creation time of the acting process executable |
| actor.process.user.name | String | Username running the acting process |
| actor.process.user.type_id | Long | Account type (1=User, 2=Admin, 3=System) |
observables.name Values
| observables.name | Description |
|---|---|
| File Create Event | A file was created |
| File Write Event | A file was written to |
| File Delete Event | A file was deleted |
| File Rename Event | A file was renamed |
| Directory Create Event | A directory was created |
Use this field as a fast filter shorthand:
observables.name = "File Write Event"
Example Queries
Executables written to Temp by any process:
class_name = "File Activity" and activity_id = 8 and file.ext = "exe" and file.path contains "Temp"
Files written by PowerShell:
class_name = "File Activity" and activity_id = 8 and actor.process.name = "powershell.exe"
Double-extension files (e.g., invoice.pdf.exe):
class_name = "File Activity" and file.name contains ".pdf.exe"
Files dropped by scripting engines in user-writable paths:
class_name = "File Activity" and activity_id = 6 and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe" and file.path contains "AppData"
Process Activity
class_name = "Process Activity" | class_uid = 1007
Process Activity events are generated when a process is launched, terminates, or is subject to an injection or module-load operation. This is the only class where the top-level process.* object (the target process) is distinct from actor.process.* (the initiating process).
Critical distinction: actor.process = the process that performed the action (e.g., winword.exe launching cmd.exe). process = the process being acted upon (e.g., cmd.exe that was just launched). This is only valid in Process Activity events — in all other classes, process.* is absent.
Activity ID Mappings
| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 1 | Launch | 100701 | A process was launched/created |
| 2 | Terminate | 100702 | A process was terminated |
Target Process (process.*) — Core Fields
| Field | Type | Description |
|---|---|---|
| process.name | String | Runtime process name (e.g., cmd.exe) |
| process.pid | Long | OS-assigned PID |
| process.uid | String | Unique cross-platform process instance ID |
| process.cmd_line | String | Full command line including arguments |
| process.created_time | DateTime | Timestamp when the process was created |
| process.user.name | String | Username running the target process |
| process.user.type_id | Long | Account type |
| process.lineage_uid | String[] | Full ancestry chain of the target process |
Target Process — File Metadata (process.file.*)
| Field | Type | Description |
|---|---|---|
| process.file.name | String | Executable filename |
| process.file.path | String | Full executable path |
| process.file.sha256 | String | SHA-256 of the executable |
| process.file.ext | String | File extension |
| process.file.type_id | Long | File type ID |
| process.file.hashes.algorithm | String | Hash algorithm |
| process.file.hashes.value | String | Hash value |
| process.file.company_name | String | Company name of the executable |
| process.file.version | String | Version of the executable |
| process.file.size | Long | Size of the executable in bytes |
| process.file.accessed_time | DateTime | Last access time of the executable |
| process.file.modified_time | DateTime | Last modified time of the executable |
| process.file.created_time | DateTime | Creation time of the executable |
Target Parent Process (process.parent_process.*)
| Field | Type | Description |
|---|---|---|
| process.parent_process.name | String | Parent process name |
| process.parent_process.pid | Long | Parent PID |
| process.parent_process.uid | String | Parent unique ID |
| process.parent_process.cmd_line | String | Parent command line |
| process.parent_process.file.name | String | Parent executable name |
| process.parent_process.file.path | String | Parent executable path |
| process.parent_process.file.sha256 | String | SHA-256 of the parent executable |
| process.parent_process.file.hashes.algorithm | String | Hash algorithm |
| process.parent_process.file.hashes.value | String | Hash value |
| process.parent_process.file.company_name | String | Company name of the parent executable |
| process.parent_process.file.version | String | Version of the parent executable |
| process.parent_process.file.size | Long | Size of the parent executable in bytes |
| process.parent_process.file.accessed_time | DateTime | Last access time of the parent executable |
| process.parent_process.file.modified_time | DateTime | Last modified time of the parent executable |
| process.parent_process.file.created_time | DateTime | Creation time of the parent executable |
| process.parent_process.user.name | String | Username running the parent |
| process.parent_process.user.type_id | Long | Parent user account type |
Actor — Initiating Process (actor.process.*)
Same structure as described in File Activity > Actor Process. Present in all event classes.
Example Queries
PowerShell launched running as SYSTEM:
class_name = "Process Activity" and activity_id = 1 and process.name = "powershell.exe" and process.user.type_id = 3
cmd.exe spawned by Word (macro execution):
class_name = "Process Activity" and activity_id = 1 and process.name = "cmd.exe" and actor.process.name = "winword.exe"
lsass.exe as parent (credential access via process injection):
class_name = "Process Activity" and activity_id = 1 and process.parent_process.name = "lsass.exe"
Processes launched from Temp directories:
class_name = "Process Activity" and activity_id = 1 and process.file.path contains "Temp"
Script engine spawning network tool (double-hop):
class_name = "Process Activity" and activity_id = 1 and process.name in "curl.exe","wget.exe","certutil.exe","bitsadmin.exe" and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe"
Authentication
class_name = "Authentication" | class_uid = 3002
Authentication events capture logon activity on the endpoint — both interactive and network logons. These events are essential for detecting brute-force attacks, credential abuse, lateral movement, and privilege escalation via account context.
Activity ID Mappings
| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 501 | Logon | 300201 | A user logon attempt was made |
Logon Status
| Field | Type | Known Values | Description |
|---|---|---|---|
| status | String | Success, Failure | Human-readable outcome |
| status_id | Long | 0=Unknown, 1=Success, 2=Failure, 99=Other | Outcome ID |
| status_detail | String | Logon successful | Vendor-specific status detail |
Actor User — Who Initiated the Logon (actor.user.*)
| Field | Type | Description |
|---|---|---|
| actor.user.name | String | Username attempting or performing the logon |
| actor.user.domain | String | Domain of the user (e.g., WORKGROUP) |
Target User — Who Was Authenticated (user.*)
| Field | Type | Description |
|---|---|---|
| user.name | String | Name of the authenticated user |
| user.type | String | Account type label (e.g., User, System) |
| user.type_id | Long | Account type ID (1=User, 2=Admin, 3=System) |
| user.domain | String | Domain of the authenticated user (e.g., NT AUTHORITY) |
Logon Type
| Field | Type | Description |
|---|---|---|
| logon_type | String | Logon type label (e.g., Service, Interactive) |
| logon_type_id | Long | Logon type ID (see reference below) |
Logon Type ID Reference
| logon_type_id | Logon Type |
|---|---|
| 0 | Unknown |
| 1 | System |
| 2 | Interactive |
| 3 | Network |
| 4 | Batch |
| 5 | Service |
| 7 | Unlock |
| 8 | Network Cleartext |
| 9 | New Credentials |
| 10 | Remote Interactive |
| 11 | Cached Interactive |
| 12 | Cached Remote Interactive |
| 13 | Cached Unlock |
| 99 | Other |
Authentication Protocol
| Field | Type | Description |
|---|---|---|
| auth_protocol | String | Authentication protocol label (e.g., Negotiate, Kerberos) |
| auth_protocol_id | Long | Authentication protocol ID (see reference below) |
Auth Protocol ID Reference
| auth_protocol_id | Protocol |
|---|---|
| 0 | Unknown |
| 1 | NTLM |
| 2 | Kerberos |
| 3 | Digest |
| 12 | LDAP |
Session & Source
| Field | Type | Description |
|---|---|---|
| session.uid | String | Unique session identifier (e.g., 0x3E7) |
| is_remote | Boolean | Whether the authentication was remote |
| src_endpoint.ip | String | Source IP of the logon request |
Example Queries
Failed logons by a specific user:
class_name = "Authentication" and status_id = 2 and actor.user.name = "administrator"
All failed logons (brute force hunting):
class_name = "Authentication" and status_id = 2
Successful logons from an unexpected source IP:
class_name = "Authentication" and status_id = 1 and src_endpoint.ip != "10.0.0.0"
System account logons:
class_name = "Authentication" and status_id = 1 and user.type_id = 3
Remote logon sessions:
class_name = "Authentication" and is_remote = true
Service-type logons:
class_name = "Authentication" and logon_type_id = 5
Logons using Kerberos authentication:
class_name = "Authentication" and auth_protocol_id = 2