TwinFiles collector

The TwinFiles collector returns same file names and directories with different case from folders with case-sensitivity enabled on Windows 10.

Collector output

Field	Type	Description
name	String	The file name.
dir	String	The directory path where the file is located.
full_name	String	The fully qualified file name, including its path.
size	Number	File size in bytes.
last_write	Timestamp	The last time the operating system wrote the file.
md5	String	The file's content, in MD5 format.
sha1	String	The file's content, in SHA-1 format.
sha256	String	The file's content, in SHA-256 format.
created_at	Timestamp	Time stamp when the file was created.
deleted_at	Timestamp	Time stamp when the file was deleted.
status	String	Shows `current` for files that are currently on the file system, or `deleted` for files that were removed from the file system.
create_process_pid	Number	Process ID of the process that created the file.
create_process_sha256	String	SHA-256 hash of the process that created the file.
create_process_full_path	String	Full path of the process that created the file.
modify_process_pid	Number	Process ID of the process that modified the file.
modify_process_sha256	String	SHA-256 hash of the process that modified the file.
modify_process_full_path	String	Full path of the process that modified the file.
delete_process_pid	Number	Process ID of the process that deleted the file.
delete_process_sha256	String	SHA-256 hash of the process that deleted the file.
delete_process_full_path	String	Full path of the process that deleted the file.
create_user_domain	String	Domain name of the user executing the process that created the file.
create_user_name	String	Name of the user executing the process that created the file.
create_user_id	String	ID of the user executing the process that created the file.
modify_user_domain	String	Domain name of the user executing the process that modified the file.
modify_user_name	String	Name of the user executing the process that modified the file.
modify_user_id	String	ID of the user executing the process that modified the file.
delete_user_domain	String	Domain name of the user executing the process that deleted the file.
delete_user_name	String	Name of the user executing the process that deleted the file.
delete_user_id	String	ID of the user executing the process that deleted the file.

Example: Show TwinFiles cmd.txt, Cmd.txt, and cMd.txt when searched with cmd.txt

HostInfo and TwinFiles full_name where HostInfo hostname contains "<endpoint_hostname>"

HostInfo and TwinFiles full_name where HostInfo hostname contains "<endpoint_hostname>" and TwinFiles full_name contains "<twin_file_name>"