# EDR Event Schema Reference

Last Updated On: 13 Aug 2026

## File Activity

`class_name = "File Activity" | class_uid = 1001`

File Activity events are generated whenever a process performs a file system operation — creating, writing, deleting, or renaming a file.

### Activity ID Mappings

| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 6 | Create | 100101 | A new file was created on the file system |
| 8 | Update | 100103 | Data was written to an existing file |
| 9 | Delete | 100104 | A file was deleted |
| 10 | Rename | 100105 | A file was renamed |
| 20 | Directory Create | — | A new file directory was created |

### Target File (file.*)

| Field | Type | Description |
|---|---|---|
| file.name | String | Filename including extension (e.g., malware.exe) |
| file.path | String | Full filesystem path |
| file.ext | String | File extension without leading dot |
| file.type_id | Long | File type (1=Regular, 2=Folder, 7=Symlink, 8=Executable) |

### Resulting File (file_result.*)

Present after rename or copy operations — describes the file **after** the operation.

| Field | Type | Description |
|---|---|---|
| file_result.name | String | New filename after the operation |
| file_result.path | String | New full path after the operation |
| file_result.ext | String | Extension of the resulting file |
| file_result.type_id | Long | File type of the resulting file |

### Actor — Initiating Process (actor.process.*)

| Field | Type | Description |
|---|---|---|
| actor.process.name | String | Name of the process performing the file operation |
| actor.process.pid | Long | PID of the acting process |
| actor.process.uid | String | Unique ID of the acting process instance |
| actor.process.cmd_line | String | Full command line of the acting process |
| actor.process.created_time | DateTime | Timestamp when the acting process was created |
| actor.process.file.name | String | Executable filename of the acting process |
| actor.process.file.path | String | Executable path of the acting process |
| actor.process.file.sha256 | String | SHA-256 of the acting process executable |
| actor.process.file.ext | String | File extension of the acting process executable |
| actor.process.file.type_id | Long | File type ID of the acting process executable |
| actor.process.file.hashes.algorithm | String | Hash algorithm |
| actor.process.file.hashes.value | String | Hash value |
| actor.process.file.company_name | String | Company name of the acting process executable |
| actor.process.file.version | String | Version of the acting process executable |
| actor.process.file.size | Long | Size of the acting process executable in bytes |
| actor.process.file.accessed_time | DateTime | Last access time of the acting process executable |
| actor.process.file.modified_time | DateTime | Last modified time of the acting process executable |
| actor.process.file.created_time | DateTime | Creation time of the acting process executable |
| actor.process.user.name | String | Username running the acting process |
| actor.process.user.type_id | Long | Account type (1=User, 2=Admin, 3=System) |

### observables.name Values

| observables.name | Description |
|---|---|
| File Create Event | A file was created |
| File Write Event | A file was written to |
| File Delete Event | A file was deleted |
| File Rename Event | A file was renamed |
| Directory Create Event | A directory was created |

Use this field as a fast filter shorthand:

```text
observables.name = "File Write Event"
```

### Example Queries

**Executables written to Temp by any process:**

```text
class_name = "File Activity" and activity_id = 8 and file.ext = "exe" and file.path contains "Temp"
```

**Files written by PowerShell:**

```text
class_name = "File Activity" and activity_id = 8 and actor.process.name = "powershell.exe"
```

**Double-extension files (e.g., invoice.pdf.exe):**

```text
class_name = "File Activity" and file.name contains ".pdf.exe"
```

**Files dropped by scripting engines in user-writable paths:**

```text
class_name = "File Activity" and activity_id = 6 and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe" and file.path contains "AppData"
```

## Process Activity

`class_name = "Process Activity" | class_uid = 1007`

Process Activity events are generated when a process is launched, terminates, or is subject to an injection or module-load operation. This is the only class where the top-level process.* object (the target process) is distinct from actor.process.* (the initiating process).

**Critical distinction:** actor.process = the process that performed the action (e.g., winword.exe launching cmd.exe). process = the process being acted upon (e.g., cmd.exe that was just launched). This is **only valid in Process Activity** events — in all other classes, process.* is absent.

### Activity ID Mappings

| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 1 | Launch | 100701 | A process was launched/created |
| 2 | Terminate | 100702 | A process was terminated |

### Target Process (process.*) — Core Fields

| Field | Type | Description |
|---|---|---|
| process.name | String | Runtime process name (e.g., cmd.exe) |
| process.pid | Long | OS-assigned PID |
| process.uid | String | Unique cross-platform process instance ID |
| process.cmd_line | String | Full command line including arguments |
| process.created_time | DateTime | Timestamp when the process was created |
| process.user.name | String | Username running the target process |
| process.user.type_id | Long | Account type |
| process.lineage_uid | String[] | Full ancestry chain of the target process |

### Target Process — File Metadata (process.file.*)

| Field | Type | Description |
|---|---|---|
| process.file.name | String | Executable filename |
| process.file.path | String | Full executable path |
| process.file.sha256 | String | SHA-256 of the executable |
| process.file.ext | String | File extension |
| process.file.type_id | Long | File type ID |
| process.file.hashes.algorithm | String | Hash algorithm |
| process.file.hashes.value | String | Hash value |
| process.file.company_name | String | Company name of the executable |
| process.file.version | String | Version of the executable |
| process.file.size | Long | Size of the executable in bytes |
| process.file.accessed_time | DateTime | Last access time of the executable |
| process.file.modified_time | DateTime | Last modified time of the executable |
| process.file.created_time | DateTime | Creation time of the executable |

### Target Parent Process (process.parent_process.*)

| Field | Type | Description |
|---|---|---|
| process.parent_process.name | String | Parent process name |
| process.parent_process.pid | Long | Parent PID |
| process.parent_process.uid | String | Parent unique ID |
| process.parent_process.cmd_line | String | Parent command line |
| process.parent_process.file.name | String | Parent executable name |
| process.parent_process.file.path | String | Parent executable path |
| process.parent_process.file.sha256 | String | SHA-256 of the parent executable |
| process.parent_process.file.hashes.algorithm | String | Hash algorithm |
| process.parent_process.file.hashes.value | String | Hash value |
| process.parent_process.file.company_name | String | Company name of the parent executable |
| process.parent_process.file.version | String | Version of the parent executable |
| process.parent_process.file.size | Long | Size of the parent executable in bytes |
| process.parent_process.file.accessed_time | DateTime | Last access time of the parent executable |
| process.parent_process.file.modified_time | DateTime | Last modified time of the parent executable |
| process.parent_process.file.created_time | DateTime | Creation time of the parent executable |
| process.parent_process.user.name | String | Username running the parent |
| process.parent_process.user.type_id | Long | Parent user account type |

### Actor — Initiating Process (actor.process.*)

Same structure as described in [File Activity > Actor Process](https://www.manageengine.com/products/desktop-central/help/edr/telemetry-schema.html#fa-actor). Present in all event classes.

### Example Queries

**PowerShell launched running as SYSTEM:**

```text
class_name = "Process Activity" and activity_id = 1 and process.name = "powershell.exe" and process.user.type_id = 3
```

**cmd.exe spawned by Word (macro execution):**

```text
class_name = "Process Activity" and activity_id = 1 and process.name = "cmd.exe" and actor.process.name = "winword.exe"
```

**lsass.exe as parent (credential access via process injection):**

```text
class_name = "Process Activity" and activity_id = 1 and process.parent_process.name = "lsass.exe"
```

**Processes launched from Temp directories:**

```text
class_name = "Process Activity" and activity_id = 1 and process.file.path contains "Temp"
```

**Script engine spawning network tool (double-hop):**

```text
class_name = "Process Activity" and activity_id = 1 and process.name in "curl.exe","wget.exe","certutil.exe","bitsadmin.exe" and actor.process.name in "powershell.exe","wscript.exe","cscript.exe","mshta.exe"
```

## Authentication

`class_name = "Authentication" | class_uid = 3002`

Authentication events capture logon activity on the endpoint — both interactive and network logons. These events are essential for detecting brute-force attacks, credential abuse, lateral movement, and privilege escalation via account context.

### Activity ID Mappings

| activity_id | activity_name | type_uid | Description |
|---|---|---|---|
| 501 | Logon | 300201 | A user logon attempt was made |

### Logon Status

| Field | Type | Known Values | Description |
|---|---|---|---|
| status | String | Success, Failure | Human-readable outcome |
| status_id | Long | 0=Unknown, 1=Success, 2=Failure, 99=Other | Outcome ID |
| status_detail | String | Logon successful | Vendor-specific status detail |

### Actor User — Who Initiated the Logon (actor.user.*)

| Field | Type | Description |
|---|---|---|
| actor.user.name | String | Username attempting or performing the logon |
| actor.user.domain | String | Domain of the user (e.g., WORKGROUP) |

### Target User — Who Was Authenticated (user.*)

| Field | Type | Description |
|---|---|---|
| user.name | String | Name of the authenticated user |
| user.type | String | Account type label (e.g., User, System) |
| user.type_id | Long | Account type ID (1=User, 2=Admin, 3=System) |
| user.domain | String | Domain of the authenticated user (e.g., NT AUTHORITY) |

### Logon Type

| Field | Type | Description |
|---|---|---|
| logon_type | String | Logon type label (e.g., Service, Interactive) |
| logon_type_id | Long | Logon type ID (see reference below) |

### Logon Type ID Reference

| logon_type_id | Logon Type |
|---|---|
| 0 | Unknown |
| 1 | System |
| 2 | Interactive |
| 3 | Network |
| 4 | Batch |
| 5 | Service |
| 7 | Unlock |
| 8 | Network Cleartext |
| 9 | New Credentials |
| 10 | Remote Interactive |
| 11 | Cached Interactive |
| 12 | Cached Remote Interactive |
| 13 | Cached Unlock |
| 99 | Other |

### Authentication Protocol

| Field | Type | Description |
|---|---|---|
| auth_protocol | String | Authentication protocol label (e.g., Negotiate, Kerberos) |
| auth_protocol_id | Long | Authentication protocol ID (see reference below) |

### Auth Protocol ID Reference

| auth_protocol_id | Protocol |
|---|---|
| 0 | Unknown |
| 1 | NTLM |
| 2 | Kerberos |
| 3 | Digest |
| 12 | LDAP |

### Session & Source

| Field | Type | Description |
|---|---|---|
| session.uid | String | Unique session identifier (e.g., 0x3E7) |
| is_remote | Boolean | Whether the authentication was remote |
| src_endpoint.ip | String | Source IP of the logon request |

### Example Queries

**Failed logons by a specific user:**

```text
class_name = "Authentication" and status_id = 2 and actor.user.name = "administrator"
```

**All failed logons (brute force hunting):**

```text
class_name = "Authentication" and status_id = 2
```

**Successful logons from an unexpected source IP:**

```text
class_name = "Authentication" and status_id = 1 and src_endpoint.ip != "10.0.0.0"
```

**System account logons:**

```text
class_name = "Authentication" and status_id = 1 and user.type_id = 3
```

**Remote logon sessions:**

```text
class_name = "Authentication" and is_remote = true
```

**Service-type logons:**

```text
class_name = "Authentication" and logon_type_id = 5
```

**Logons using Kerberos authentication:**

```text
class_name = "Authentication" and auth_protocol_id = 2
```