File Write Event

Event Buffer Attribute	Helix Field Destination	Notes
`closed`	`event_values.closed`	True if a file close was observed during the write.
`dataAtLowestOffset`	`event_values. dataAtLowestOffset`	Up to 64 bytes of data written at the lowest offset.
`dataOffset`	`event_values.dataOffset`
`devicePath`	`event_values.devicePath`	The raw device path of the file being written
`drive`	`event_values.drive`	The drive of the file being written
`eventReason`	`reason`
`fileExtension`	`extension`	The file extension being written
`filename`	`filename`	The filename being written
`filePath`	`event_values.filePath`	The relative path of the file being written
`fullPath`	`filePath`	The full path of the file being written
`lowestFileOffsetSeen`	`event_values. lowestFileOffsetSeen`	The lowest offset in the file that was observed during the write
`md5`	`md5`	The md5 of the file
`numBytesSeenWritten`	`seenbytes`	The number of bytes written during this write event
`openDuration`	`duration`	The file open duration
`openTime`	`event_values.openTime`	The file open time
`openTimeRaw`	`event_values.openTimeRaw`
`parentPid`	`ppid`	The ID of the parent of the process writing the file
`parentProcessPath`	`parentprocesspath`	The path for the PE of the parent process
`pid`	`pid`	The process ID writing the file
`ppath`	`event_values.ppath`	The path for the PE of the process writing the file
`process`	`process`	The name of the process writing the file
`processPath`	`processPath`	The path for the PE of the process writing the file
`size`	`size`	The size of the file being written
`textAtLowestOffset`	`event_values.`	Raw text representation of `dataAtLowestOffset`
`username`	`username`	The owner of the process writing the file
`writes`	`event_values.writes`	The number of file write operations that were observed during the write.