file‑acquisition‑api Audit

Collects the contents of files on host endpoints using system calls for file access.

This audit was formerly known as the w32apifile-acquisition audit.

This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported on page 1.

Windows, macOS, and Linux

The following input parameters are available for this audit. Some parameters are supported only in Windows environments.

Details	Values	Description
Platform	Windows, macOS, Linux	Windows, macOS, and Linux environments
Format	FilePath	Valid values are a full file path and file name.
Required?	yes	This parameter is required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the absolute path of the directory containing the file to acquire. The trailing back-slash is optional. For example: `C:\\WINDOWS\\`

Details	Values	Description
Platform	Windows, macOS, Linux	Windows, macOS, and Linux environments
Format	String	Valid values are a string of text.
Required?	yes	This parameter is required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Specify the name of the file to acquire. For example: `notepad.exe`

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether the last access times for audited files should be manually reset.

Details	Values	Description
Platform	Windows	Windows environments
Format	Bool	Valid values are Boolean values.
Required?	no	This parameter is not required.
Repeatable?	no	This parameter can be specified only once per audit request. It cannot be repeated.
Valid Values		Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed.