File Event

Access Control Administration Event

Access Control Event

Access Denied Event

Access Granted Event

Access Mediation Event

Add User to Group Event

Application Deletion Event

Application Disable Event

Application Enable Event

Application Event

Application Installation Event

Application Layer Event

Application Restart Event

Application Start Event

Application Stop Event

Application Update Event

Assign Privileges to Group Event

Authentication Event

Authorization Event

Compute Device Event

DHCP Ack Event

DHCP Discover Event

DHCP Event

DHCP Inform Event

DHCP Lease Expire Event

DHCP Nak Event

DHCP Offer Event

DHCP Release Event

DHCP Request Event

DNS Event

DNS Query Event

DNS Response Event

Detection Event

Digital Event

Email Event

Email Receive Event

Email Scan Event

Email Send Event

Event Log Archive Event

Event Log Clear Event

Event Log Delete Event

Event Log Disable Event

Event Log Enable Event

Event Log Event

Event Log Export Event

Event Log Restart Event

Event Log Rotate Event

Event Log Start Event

Event Log Stop Event

Eviction Event

FTP Delete Event

FTP Event

FTP Get Event

FTP List Event

FTP Poll Event

FTP Put Event

FTP Rename Event

File Access Event

File Copy Event

File Creation Event

File Decryption Event

File Deletion Event

File Encryption Event

File Event

File Get Attributes Event

File Get Permissions Event

File Mount Event

File Renaming Event

File Set Attributes Event

File Set Permissions Event

File Unmount Event

File Update Event

Group Creation Event

Group Deletion Event

Group Management Event

HTTP CONNECT Event

HTTP DELETE Event

HTTP Event

HTTP GET Event

HTTP HEAD Event

HTTP OPTIONS Event

HTTP POST Event

HTTP PUT Event

HTTP Request Event

HTTP Response Event

HTTP TRACE Event

Hardening Event

Hardware Device Bind Event

Hardware Device Connection Event

Hardware Device Disabled Event

Hardware Device Disconnection Event

Hardware Device Enabled Event

Hardware Device Event

Hardware Device Move Event

Hardware Device State Event

Hardware Device Unbind Event

Hardware Device Update Event

Input Device Event

Isolation Event

Kernel Event

Kernel Module Event

Kernel Module Load Event

Kernel Module Unload Event

Load Library Event

Logoff Event

Logon Event

Memory Allocation Event

Memory Deletion Event

Memory Device Event

Memory Event

Memory Map Event

Memory Modification Event

Memory Read Event

Memory Write Event

NTP Broadcast Event

NTP Client Synchronization Event

NTP Control Message Event

NTP Event

NTP Server Response Event

NTP Symmetric Active Exchange Event

NTP Symmetric Passive Exchange Event

Network Connection Close Event

Network Connection Event

Network Connection Fail Event

Network Connection Listen Event

Network Connection Open Event

Network Connection Refuse Event

Network Connection Reset Event

Network Device Event

Network Event

Output Device Event

Peripheral Device Event

Permission Granting Event

Permission Revoking Event

Power and Thermal Device Event

Pre-Authentication Event

Process Access Event

Process Creation Event

Process Event

Process Set User ID Event

Process Termination Event

RDP Connect Request Event

RDP Connect Response Event

RDP Event

RDP Initial Request Event

RDP Initial Response Event

RDP TLS Handshake Event

Remove User from Group Event

Restoration Event

Revoke Privileges from Group Event

SMB Event

SMB File Create Event

SMB File Open Event

SMB File Open If Event

SMB File Overwrite Event

SMB File Overwrite If Event

SMB File Supersede Event

SSH Connection Close Event

SSH Connection Fail Event

SSH Connection Open Event

SSH Connection Refuse Event

SSH Connection Reset Event

SSH Event

SSH Listen Event

Scheduled Job Creation Event

Scheduled Job Deletion Event

Scheduled Job Disable Event

Scheduled Job Enable Event

Scheduled Job Event

Scheduled Job Start Event

Scheduled Job Update Event

Security Event

Service Deletion Event

Service Disable Event

Service Enable Event

Service Event

Service Installation Event

Service Restart Event

Service Start Event

Service Stop Event

Service Update Event

Storage Device Event

System Call Event

TCP Event

Transport Layer Event

Tunnel Close Event

Tunnel Event

Tunnel Open Event

Tunnel Renew Event

UDP Event

Unload Library Event

User Account Attach Policy Event

User Account Creation Event

User Account Deletion Event

User Account Detach Policy Event

User Account Disable Event

User Account Enable Event

User Account Event

User Account Lock Event

User Account MFA Disable Event

User Account MFA Enable Event

User Account Password Change Event

User Account Password Reset Event

User Account Update Event

Windows Registry Event

Windows Registry Key Creation Event

Windows Registry Key Deletion Event

Windows Registry Key Event

Windows Registry Key Export Event

Windows Registry Key Import Event

Windows Registry Key Read Event

Windows Registry Key Renaming Event

Windows Registry Key Restore Event

Windows Registry Key Set Security Event

Windows Registry Key Update Event

Windows Registry Value Deletion Event

Windows Registry Value Event

Windows Registry Value Get Event

Windows Registry Value Set Event

Windows Registry Value Update Event

Properties

id: d3f:FileEvent

name: File Event
definition: An event involving operations performed on digital files, encompassing actions such as creation, modification, deletion, access, and attribute or permission changes.
see also: https://schema.ocsf.io/1.3.0/classes/file_activity

json

Neighbors

        graph LR;

  FileEvent["File Event"] -->
      | has-participant | NTFSLink["NTFS Link"];
      class FileEvent EventNode;
      class NTFSLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click NTFSLink href "/dao/artifact/d3f:NTFSLink";FileEvent["File Event"] -->
      | has-participant | SymbolicLink["Symbolic Link"];
      class FileEvent EventNode;
      class SymbolicLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SymbolicLink href "/dao/artifact/d3f:SymbolicLink";FileEvent["File Event"] -->
      | has-participant | File["File"];
      class FileEvent EventNode;
      class File ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click File href "/dao/artifact/d3f:File";FileEvent["File Event"] -->
      | has-participant | ArchiveFile["Archive File"];
      class FileEvent EventNode;
      class ArchiveFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ArchiveFile href "/dao/artifact/d3f:ArchiveFile";FileEvent["File Event"] -->
      | has-participant | CertificateFile["Certificate File"];
      class FileEvent EventNode;
      class CertificateFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click CertificateFile href "/dao/artifact/d3f:CertificateFile";FileEvent["File Event"] -->
      | has-participant | ConfigurationFile["Configuration File"];
      class FileEvent EventNode;
      class ConfigurationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ConfigurationFile href "/dao/artifact/d3f:ConfigurationFile";FileEvent["File Event"] -->
      | has-participant | DocumentFile["Document File"];
      class FileEvent EventNode;
      class DocumentFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click DocumentFile href "/dao/artifact/d3f:DocumentFile";FileEvent["File Event"] -->
      | has-participant | ExecutableFile["Executable File"];
      class FileEvent EventNode;
      class ExecutableFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ExecutableFile href "/dao/artifact/d3f:ExecutableFile";FileEvent["File Event"] -->
      | has-participant | LogFile["Log File"];
      class FileEvent EventNode;
      class LogFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click LogFile href "/dao/artifact/d3f:LogFile";FileEvent["File Event"] -->
      | has-participant | NTFSHardLink["NTFS Hard Link"];
      class FileEvent EventNode;
      class NTFSHardLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click NTFSHardLink href "/dao/artifact/d3f:NTFSHardLink";FileEvent["File Event"] -->
      | has-participant | ObjectFile["Object File"];
      class FileEvent EventNode;
      class ObjectFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ObjectFile href "/dao/artifact/d3f:ObjectFile";FileEvent["File Event"] -->
      | has-participant | OperatingSystemFile["Operating System File"];
      class FileEvent EventNode;
      class OperatingSystemFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OperatingSystemFile href "/dao/artifact/d3f:OperatingSystemFile";FileEvent["File Event"] -->
      | has-participant | PasswordFile["Password File"];
      class FileEvent EventNode;
      class PasswordFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click PasswordFile href "/dao/artifact/d3f:PasswordFile";FileEvent["File Event"] -->
      | has-participant | ShortcutFile["Shortcut File"];
      class FileEvent EventNode;
      class ShortcutFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ShortcutFile href "/dao/artifact/d3f:ShortcutFile";FileEvent["File Event"] -->
      | has-participant | DatabaseFile["Database File"];
      class FileEvent EventNode;
      class DatabaseFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click DatabaseFile href "/dao/artifact/d3f:DatabaseFile";FileEvent["File Event"] -->
      | has-participant | JavaArchive["Java Archive"];
      class FileEvent EventNode;
      class JavaArchive ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click JavaArchive href "/dao/artifact/d3f:JavaArchive";FileEvent["File Event"] -->
      | has-participant | SoftwareLibraryFile["Software Library File"];
      class FileEvent EventNode;
      class SoftwareLibraryFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SoftwareLibraryFile href "/dao/artifact/d3f:SoftwareLibraryFile";FileEvent["File Event"] -->
      | has-participant | StorageImage["Storage Image"];
      class FileEvent EventNode;
      class StorageImage ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click StorageImage href "/dao/artifact/d3f:StorageImage";FileEvent["File Event"] -->
      | has-participant | FastSymbolicLink["Fast Symbolic Link"];
      class FileEvent EventNode;
      class FastSymbolicLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click FastSymbolicLink href "/dao/artifact/d3f:FastSymbolicLink";FileEvent["File Event"] -->
      | has-participant | NTFSJunctionPoint["NTFS Junction Point"];
      class FileEvent EventNode;
      class NTFSJunctionPoint ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click NTFSJunctionPoint href "/dao/artifact/d3f:NTFSJunctionPoint";FileEvent["File Event"] -->
      | has-participant | NTFSSymbolicLink["NTFS Symbolic Link"];
      class FileEvent EventNode;
      class NTFSSymbolicLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click NTFSSymbolicLink href "/dao/artifact/d3f:NTFSSymbolicLink";FileEvent["File Event"] -->
      | has-participant | POSIXSymbolicLink["POSIX Symbolic Link"];
      class FileEvent EventNode;
      class POSIXSymbolicLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click POSIXSymbolicLink href "/dao/artifact/d3f:POSIXSymbolicLink";FileEvent["File Event"] -->
      | has-participant | SlowSymbolicLink["Slow Symbolic Link"];
      class FileEvent EventNode;
      class SlowSymbolicLink ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SlowSymbolicLink href "/dao/artifact/d3f:SlowSymbolicLink";FileEvent["File Event"] -->
      | has-participant | Alias["Alias"];
      class FileEvent EventNode;
      class Alias ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click Alias href "/dao/artifact/d3f:Alias";FileEvent["File Event"] -->
      | has-participant | ApplicationConfigurationFile["Application Configuration File"];
      class FileEvent EventNode;
      class ApplicationConfigurationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ApplicationConfigurationFile href "/dao/artifact/d3f:ApplicationConfigurationFile";FileEvent["File Event"] -->
      | has-participant | CACertificateFile["CA Certificate File"];
      class FileEvent EventNode;
      class CACertificateFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click CACertificateFile href "/dao/artifact/d3f:CACertificateFile";FileEvent["File Event"] -->
      | has-participant | CommandHistoryLogFile["Command History Log File"];
      class FileEvent EventNode;
      class CommandHistoryLogFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click CommandHistoryLogFile href "/dao/artifact/d3f:CommandHistoryLogFile";FileEvent["File Event"] -->
      | has-participant | CustomArchiveFile["Custom Archive File"];
      class FileEvent EventNode;
      class CustomArchiveFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click CustomArchiveFile href "/dao/artifact/d3f:CustomArchiveFile";FileEvent["File Event"] -->
      | has-participant | Email["Email"];
      class FileEvent EventNode;
      class Email ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click Email href "/dao/artifact/d3f:Email";FileEvent["File Event"] -->
      | has-participant | EmailAttachment["Email Attachment"];
      class FileEvent EventNode;
      class EmailAttachment ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click EmailAttachment href "/dao/artifact/d3f:EmailAttachment";FileEvent["File Event"] -->
      | has-participant | ExecutableBinary["Executable Binary"];
      class FileEvent EventNode;
      class ExecutableBinary ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ExecutableBinary href "/dao/artifact/d3f:ExecutableBinary";FileEvent["File Event"] -->
      | has-participant | ExecutableScript["Executable Script"];
      class FileEvent EventNode;
      class ExecutableScript ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click ExecutableScript href "/dao/artifact/d3f:ExecutableScript";FileEvent["File Event"] -->
      | has-participant | HTMLFile["HTML File"];
      class FileEvent EventNode;
      class HTMLFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click HTMLFile href "/dao/artifact/d3f:HTMLFile";FileEvent["File Event"] -->
      | has-participant | KernelModule["Kernel Module"];
      class FileEvent EventNode;
      class KernelModule ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click KernelModule href "/dao/artifact/d3f:KernelModule";FileEvent["File Event"] -->
      | has-participant | OfficeApplicationFile["Office Application File"];
      class FileEvent EventNode;
      class OfficeApplicationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OfficeApplicationFile href "/dao/artifact/d3f:OfficeApplicationFile";FileEvent["File Event"] -->
      | has-participant | OperatingSystemConfigurationFile["Operating System Configuration File"];
      class FileEvent EventNode;
      class OperatingSystemConfigurationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OperatingSystemConfigurationFile href "/dao/artifact/d3f:OperatingSystemConfigurationFile";FileEvent["File Event"] -->
      | has-participant | OperatingSystemExecutableFile["Operating System Executable File"];
      class FileEvent EventNode;
      class OperatingSystemExecutableFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OperatingSystemExecutableFile href "/dao/artifact/d3f:OperatingSystemExecutableFile";FileEvent["File Event"] -->
      | has-participant | OperatingSystemLogFile["Operating System Log File"];
      class FileEvent EventNode;
      class OperatingSystemLogFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OperatingSystemLogFile href "/dao/artifact/d3f:OperatingSystemLogFile";FileEvent["File Event"] -->
      | has-participant | OperatingSystemSharedLibraryFile["Operating System Shared Library File"];
      class FileEvent EventNode;
      class OperatingSystemSharedLibraryFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OperatingSystemSharedLibraryFile href "/dao/artifact/d3f:OperatingSystemSharedLibraryFile";FileEvent["File Event"] -->
      | has-participant | PropertyListFile["Property List File"];
      class FileEvent EventNode;
      class PropertyListFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click PropertyListFile href "/dao/artifact/d3f:PropertyListFile";FileEvent["File Event"] -->
      | has-participant | SharedLibraryFile["Shared Library File"];
      class FileEvent EventNode;
      class SharedLibraryFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SharedLibraryFile href "/dao/artifact/d3f:SharedLibraryFile";FileEvent["File Event"] -->
      | has-participant | SystemInitScript["System Init Script"];
      class FileEvent EventNode;
      class SystemInitScript ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SystemInitScript href "/dao/artifact/d3f:SystemInitScript";FileEvent["File Event"] -->
      | has-participant | UserInitConfigurationFile["User Init Configuration File"];
      class FileEvent EventNode;
      class UserInitConfigurationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click UserInitConfigurationFile href "/dao/artifact/d3f:UserInitConfigurationFile";FileEvent["File Event"] -->
      | has-participant | UserInitScript["User Init Script"];
      class FileEvent EventNode;
      class UserInitScript ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click UserInitScript href "/dao/artifact/d3f:UserInitScript";FileEvent["File Event"] -->
      | has-participant | UserStartupScriptFile["User Startup Script File"];
      class FileEvent EventNode;
      class UserStartupScriptFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click UserStartupScriptFile href "/dao/artifact/d3f:UserStartupScriptFile";FileEvent["File Event"] -->
      | has-participant | WindowsShortcutFile["Windows Shortcut File"];
      class FileEvent EventNode;
      class WindowsShortcutFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click WindowsShortcutFile href "/dao/artifact/d3f:WindowsShortcutFile";FileEvent["File Event"] -->
      | has-participant | MultimediaDocumentFile["Multimedia Document File"];
      class FileEvent EventNode;
      class MultimediaDocumentFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click MultimediaDocumentFile href "/dao/artifact/d3f:MultimediaDocumentFile";FileEvent["File Event"] -->
      | has-participant | DiskImage["Disk Image"];
      class FileEvent EventNode;
      class DiskImage ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click DiskImage href "/dao/artifact/d3f:DiskImage";FileEvent["File Event"] -->
      | has-participant | VMImage["Virtual Machine Image"];
      class FileEvent EventNode;
      class VMImage ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click VMImage href "/dao/artifact/d3f:VMImage";FileEvent["File Event"] -->
      | has-participant | SystemStateImage["System State Image"];
      class FileEvent EventNode;
      class SystemStateImage ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click SystemStateImage href "/dao/artifact/d3f:SystemStateImage";FileEvent["File Event"] -->
      | has-participant | CompilerConfigurationFile["Compiler Configuration File"];
      class FileEvent EventNode;
      class CompilerConfigurationFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click CompilerConfigurationFile href "/dao/artifact/d3f:CompilerConfigurationFile";FileEvent["File Event"] -->
      | has-participant | InitScript["Init Script"];
      class FileEvent EventNode;
      class InitScript ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click InitScript href "/dao/artifact/d3f:InitScript";FileEvent["File Event"] -->
      | has-participant | PowerShellProfileScript["PowerShell Profile Script"];
      class FileEvent EventNode;
      class PowerShellProfileScript ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click PowerShellProfileScript href "/dao/artifact/d3f:PowerShellProfileScript";FileEvent["File Event"] -->
      | has-participant | PythonScriptFile["Python Script File"];
      class FileEvent EventNode;
      class PythonScriptFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click PythonScriptFile href "/dao/artifact/d3f:PythonScriptFile";FileEvent["File Event"] -->
      | has-participant | WebScriptFile["Web Script File"];
      class FileEvent EventNode;
      class WebScriptFile ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click WebScriptFile href "/dao/artifact/d3f:WebScriptFile";FileEvent["File Event"] -->
      | has-participant | MicrosoftHTMLApplication["Microsoft HTML Application"];
      class FileEvent EventNode;
      class MicrosoftHTMLApplication ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click MicrosoftHTMLApplication href "/dao/artifact/d3f:MicrosoftHTMLApplication";FileEvent["File Event"] -->
      | has-participant | OpticalDiscImage["Optical Disc Image"];
      class FileEvent EventNode;
      class OpticalDiscImage ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click OpticalDiscImage href "/dao/artifact/d3f:OpticalDiscImage";FileEvent["File Event"] -->
      | has-participant | NetworkInitScriptFileResource["Network Init Script File Resource"];
      class FileEvent EventNode;
      class NetworkInitScriptFileResource ArtifactNode;
      click FileEvent href "/event/d3f:FileEvent";
      click NetworkInitScriptFileResource href "/dao/artifact/d3f:NetworkInitScriptFileResource";