# Windows File Modification

- OS: Windows
- Data Stream: `logs-endpoint.events.file-*`
- KQL: `event.action : "modification" and event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows"`

This event is generated when a file is modified.


| Field |
|---|
| @timestamp |
| Effective_process.entity_id |
| Effective_process.executable |
| Effective_process.name |
| Effective_process.pid |
| agent.id |
| agent.type |
| agent.version |
| data_stream.dataset |
| data_stream.namespace |
| data_stream.type |
| ecs.version |
| elastic.agent.id |
| event.action |
| event.category |
| event.created |
| event.dataset |
| event.id |
| event.kind |
| event.module |
| event.outcome |
| event.sequence |
| event.type |
| file.Ext.entropy |
| file.Ext.header_bytes |
| file.Ext.monotonic_id |
| file.extension |
| file.name |
| file.path |
| file.size |
| host.architecture |
| host.hostname |
| host.id |
| host.ip |
| host.mac |
| host.name |
| host.os.Ext.variant |
| host.os.family |
| host.os.full |
| host.os.kernel |
| host.os.name |
| host.os.platform |
| host.os.type |
| host.os.version |
| message |
| process.Ext.ancestry |
| process.Ext.code_signature.exists |
| process.Ext.code_signature.status |
| process.Ext.code_signature.subject_name |
| process.Ext.code_signature.trusted |
| process.code_signature.exists |
| process.code_signature.status |
| process.code_signature.subject_name |
| process.code_signature.trusted |
| process.entity_id |
| process.executable |
| process.name |
| process.parent.pid |
| process.pid |
| process.thread.id |
| user.domain |
| user.id |
| user.name |

