Files collector

The Files collector gathers data about managed devices' file systems.

Collector output

Field	Type	Description
name	String	The file name.
dir	String	The directory path where the file is located.
full_name	String	The fully qualified file name, including its path.
size	Number	File size in bytes.
last_write	Timestamp	The last time the operating system wrote the file.
md5	String	The file's content, in MD5 format.
sha1	String	The file's content, in SHA-1 format.
sha256	String	The file's content, in SHA-256 format.
created_at	Timestamp	Time stamp when the file was created.
deleted_at	Timestamp	Time stamp when the file was deleted.
status	String	Shows `current` for files that are currently on the file system, or `deleted` for files that were removed from the file system.
create_process_pid	Number	Process ID of the process that created the file.
create_process_sha256	String	SHA-256 hash of the process that created the file.
create_process_full_path	String	Full path of the process that created the file.
modify_process_pid	Number	Process ID of the process that modified the file.
modify_process_sha256	String	SHA-256 hash of the process that modified the file.
modify_process_full_path	String	Full path of the process that modified the file.
delete_process_pid	Number	Process ID of the process that deleted the file.
delete_process_sha256	String	SHA-256 hash of the process that deleted the file.
delete_process_full_path	String	Full path of the process that deleted the file.
create_user_domain	String	Domain name of the user executing the process that created the file.
create_user_name	String	Name of the user executing the process that created the file.
create_user_id	String	ID of the user executing the process that created the file.
modify_user_domain	String	Domain name of the user executing the process that modified the file.
modify_user_name	String	Name of the user executing the process that modified the file.
modify_user_id	String	ID of the user executing the process that modified the file.
delete_user_domain	String	Domain name of the user executing the process that deleted the file.
delete_user_name	String	Name of the user executing the process that deleted the file.
delete_user_id	String	ID of the user executing the process that deleted the file.

Important
These Fields don't apply to Linux:
create_process_pid, create_process_sha256, create_process_full_path, modify_process_pid, modify_process_sha256, modify_process_full_path, delete_process_pid, delete_process_sha256, delete_process_full_path, create_user_domain, create_user_name, create_user_id, modify_user_domain, modify_user_name, modify_user_id, delete_user_domain, delete_user_name, delete_user_id

Supported versions

Windows	Linux	macOS
3.0 and later	3.0 and later	3.0 and later

Example: Show files in the C:\Windows\Boot\DVD\EVE\ path.

Files where Files dir equals "c:\windows\boot\dvd\eve\"

Discover if the DLP extension is installed

Files created_at, last_write, name
     WHERE Files full_name contains "hddjhjcbioambdhjejhdlobijkdnbggp"

Hunting for Indicators Of Compromise - IoCs: hashes

Files sha256, created_at, name
    WHERE Files sha256 equals "af0555109dfa352a7aafb70c3f63e8411b6cf8efe3398f99de55365efb34688e"
        OR Files sha256 equals "fa11c41dbec328a4b75aaf7e6b349c872948203e0109aea6ba6686780b34c85f"
        OR Files sha256 equals "1d2bae6f14d7cdeaa2ee1819d352eca0978538387ae174e52ef2228034f362c3"
        OR Files sha256 equals "51d3563c7aa0c4752bc8ce9c1d6d18b5f2d61d91358c71a4de16803c5fa1f877"

Example: Show files in the C:\Windows\Boot\DVD\EVE\ path.

Files where Files dir equals "c:\windows\boot\dvd\eve\"

Discover if the DLP extension is installed

Files created_at, last_write, name
     WHERE Files full_name contains "hddjhjcbioambdhjejhdlobijkdnbggp"

Hunting for Indicators Of Compromise - IoCs: hashes

Files sha256, created_at, name
    WHERE Files sha256 equals "af0555109dfa352a7aafb70c3f63e8411b6cf8efe3398f99de55365efb34688e"
        OR Files sha256 equals "fa11c41dbec328a4b75aaf7e6b349c872948203e0109aea6ba6686780b34c85f"
        OR Files sha256 equals "1d2bae6f14d7cdeaa2ee1819d352eca0978538387ae174e52ef2228034f362c3"
        OR Files sha256 equals "51d3563c7aa0c4752bc8ce9c1d6d18b5f2d61d91358c71a4de16803c5fa1f877"

File hashing

To provide information about file systems, Trellix EDR must first complete the file hashing process to record file system metadata in its databases.

Trellix EDR hashes only non-removable file systems.

On Windows, Trellix EDR hashes only media that return DRIVE_FIXED after calling the GetDriveTypeA function.
On Linux, Trellix EDR hashing ignores all paths that return RM = 1, TYPE = part, MOUNTPOINT != "" after running the command lsblk -o RM,TYPE,MOUNTPOINT -r.
On macOS, Trellix EDR hashing ignores all paths that return the command diskutil info -all and are marked "Removable Drive".

Restrictions

Some restrictions apply to what files are returned by the collector.

Only devices where the user has System Tree permissions reply with results.
Only files that are not excluded by ignore policies appear in search results.
Depending on the database size limit set on file hashing policies, information about files deleted before the past 30 days might not appear in search results.