Searching for Filemod Actions

This topic describes searching for filemod actions.

You can search for file deletions, rather than just filemod_count.

On the Process page, you can search in the events table for:

filemod_action:ACTION_FILE_DELETE

Note: This is not a valid search on the Investigate page. As an alternative, you can search for:

filemod_count:[1 TO *]

to find all processes that have performed a filemod, and then research their details on the Process page.