Collects multiple files from host endpoints based on filter criteria (such as path or filename) using system calls for file access.
This audit was formerly known as the w32multifileapi-acquisition audit.
This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported on page 1.
Supported Platforms
Windows, macOS, and Linux
Input Parameters
The following input parameters are available for this audit. Some parameters are supported only in Windows environments.
Path
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | FilePath | Valid values are a full file path and file name. |
Required? | yes | This parameter is required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the absolute path of the directory containing the files to acquire. The trailing back-slash is optional. For example:
|
Path Regex
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | String | Valid values are a string of text. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the Perl-compatible regular expression a file must match to be collected. You must use standard regex expressions, including regex escaping techniques. (Specifying
|
Depth
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the number of directory levels to include in the audit. Specifying |
Minimum Sizes
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the minimum file size, in bytes, of a file collected for this audit. |
Maximum Sizes
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the maximum file size, in bytes, of a file collected for this audit. |
Filter MD5
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Filter the results based on a specific MD5 hash. |
Filter SHA1
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Filter the results based on a specific SHA1 hash. |
Filter SHA256
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Filter the results based on a specific SHA256 hash. |
Content Regex
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | ArrayOfString | Valid values are specified in an array of string values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify a valid regex string for which to search. |
AND Operator
Details | Values | Description |
|---|---|---|
Platform | Windows, macOS, and Linux | Windows, macOS, and Linux environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether the audit should collect a file only if its content matches all regex parameters. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |