Skip to content

FileMatch

Data for a matched file.

Fields

Field Type Description
archiveRelativePath String! Path of this file relative to the root of its parent archive. Empty string when the matched file is not inside an archive.
detectedTime DateTime Time the scan detected the match.
fileMetadata FileMetadata File Metadata for the matched file.
fileName String! Name of the file that was matched.
fileSize Long! Size of the file that was matched.
filepath String! Filepath that was matched.
firstObservedSnapshotDate DateTime Date of the snapshot when the match was first observed.
firstObservedSnapshotFid UUID! FID of the first observed snapshot.
isFileVersionQuarantined Boolean! Indicates whether the workload file version is quarantined.
isFirstObservedSnapshotExpired Boolean! Specifies whether the first observed snapshot has expired.
isInsideArchive Boolean! True when the matched file is an inner entry inside a compressed archive (e.g. zip) discovered via archive expansion.
isMatchedSnapshotExpired Boolean! Specifies whether the matched snapshot has expired.
isQuarantinedInFirstObservedSnapshot Boolean! Indicates whether the file is quarantined in the first observed snapshot.
isValidated Boolean! Indicates whether the match has been validated.
isValidationRequired Boolean! Indicates whether severity evaluation is required for this match. True when the match was inserted while delayed detection was active. False for matches inserted before delayed detection was enabled.
matchId Long! ID of the matched file being returned.
matchType IndicatorOfCompromiseKind! Type of threat match.
matchedSnapshotDate DateTime Date of the snapshot when the match was found.
matchedSnapshotFid UUID! FID of the matched snapshot.
mtime DateTime Modified time of the match.
objectFid UUID! FID of the object.
objectName String! The scanned object name.
objectType HierarchyObjectTypeEnum Object type.
severity MatchSeverity! Severity of the match.

Used By

Queries