nerdexam
CrowdStrike

CCFH-202B · Question #37

Which field should you reference in order to find the system time of a *FileWritten event?

The correct answer is A. ContextTimeStamp_decimal. ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file…

Event Data Analysis

Question

Which field should you reference in order to find the system time of a *FileWritten event?

Options

  • AContextTimeStamp_decimal
  • BFileTimeStamp_decimal
  • CProcessStartTime_decimal
  • Dtimestamp

How the community answered

(27 responses)
  • A
    89% (24)
  • B
    7% (2)
  • C
    4% (1)

Explanation

ContextTimeStamp_decimal is the field that shows the system time of the event that triggered the sensor to send data to the cloud. In this case, it would be the time when the file was written. FileTimeStamp_decimal is the field that shows the last modified time of the file, which may not be the same as the time when the file was written. ProcessStartTime_decimal is the field that shows the start time of the process that performed the file write operation, which may not be the same as the time when the file was written. Timestamp is the field that shows the time when the sensor data was received by the cloud, which may not be the same as the time when the file was written.

Topics

#FileWritten events#ContextTimeStamp_decimal#event field mapping#timestamp fields

Community Discussion

No community discussion yet for this question.

Full CCFH-202B Practice