Timestamp - Modified

Searches for a modification time. Windows and macOS host endpoints can be searched using this token. Exhaustive searches for registry and Windows event records apply only to Windows endpoints.

Valid timestamps must fall between January 1, 1970, UTC and January 19, 3:14:07, 2038, UTC. (HXEP-5936 & HXEP-6081)

Field Format	Exhaustive Search?	Exhaustive Search Details
timestamp	Optional	Includes searching for a file on disk, a registry key, or a Windows event record. Allows you to filter by path name and specify the following disk search options: folder depth minimum file size maximum file size This token also allows you to filter the search by Windows registry hive path. The default registry hive path used is `HKEY_LOCAL_MACHINE\Software` when no path is specified. Filtering by registry hive augments the default registry search, possibly returning results that were not found in a quick search using the same query. (ENDPT-7838/ENDPT-4198)

Field Format

Exhaustive Search?

Exhaustive Search Details

timestamp

Optional

Includes searching for a file on disk, a registry key, or a Windows event record.

Allows you to filter by path name and specify the following disk search options:

folder depth
minimum file size
maximum file size

This token also allows you to filter the search by Windows registry hive path. The default registry hive path used is HKEY_LOCAL_MACHINE\Software when no path is specified. Filtering by registry hive augments the default registry search, possibly returning results that were not found in a quick search using the same query. (ENDPT-7838/ENDPT-4198)

At this time, requests for browser file and cookie data returns limited fields of data due to current limits in agent data collection. (HXEP-10314, HXEP-6100, HXEP-6102)