Searches for a creation time. Windows and macOS host endpoints can be searched using this token.
Valid timestamps must fall between January 1, 1970, UTC and January 19, 3:14:07, 2038, UTC. (HXEP-5936 & HXEP-6081)
Field Format | Exhaustive Search? | Exhaustive Search Details |
|---|---|---|
timestamp | Optional | Includes searching for a file on disk, a Windows event record, or an macOS syslog event record. Allows you to filter by path name and specify the following disk search options:
|