Home
  •  

File Discovery

Windows.Monitoring.FileSystem.File.Discovery (Discovery)

File Discovery.
Enables the discovery of file classes.
Discovery disabled by default.
Note: You only can discover files for the folders discovered.
The Discovery Process will discover all files in a folder NOT the Subfolders.
For complete file discovery all folders and subfolder need to overrided.
This rule uses a custom script to discover the Files in a Folder.

Knowledge Base article:

Summary

This Discovery Rule discovers all Files in a Folder that are in a File Share and in a Windows Computer that is running any version of a Microsoft Windows Client operating system.

Configuration

Requires that the Folder and File Share Discovery to be enabled

Additional

The Discovery process will only work for a Discovered Folder.

Discovery Rule is disabled by default.

Element properties:

TargetWindows.Monitoring.FileSystem.Folder
EnabledFalse
Frequency7200
RemotableFalse

Object Discovery Details:

Discovered Classes and their attribuets:

Member Modules:

ID Module Type TypeId RunAs 
DS DataSource Windows.Monitoring.FileSystem.File.Discovery.DataSource Default

Source Code:

<Discovery ID="Windows.Monitoring.FileSystem.File.Discovery" Enabled="false" Target="Windows.Monitoring.FileSystem.Folder" ConfirmDelivery="true" Remotable="true" Priority="Normal">

  <Category>Discovery</Category>

  <DiscoveryTypes>

    <DiscoveryClass TypeID="Windows.Monitoring.FileSystem.File">

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="Name"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="Path"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="Drive"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="Size"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="DateCreated"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="DateModified"/>

      <Property TypeID="Windows.Monitoring.FileSystem.File" PropertyID="DateAccessed"/>

      <Property TypeID="System!System.Entity" PropertyID="DisplayName"/>

    </DiscoveryClass>

  </DiscoveryTypes>

  <DataSource ID="DS" TypeID="Windows.Monitoring.FileSystem.File.Discovery.DataSource">

    <IntervalSeconds>7200</IntervalSeconds>

    <TimeoutSeconds>300</TimeoutSeconds>

    <TargetComputer>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</TargetComputer>

    <TargetComputerID>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/PrincipalName$</TargetComputerID>

    <FolderPath>"$Target/Property[Type="Windows.Monitoring.FileSystem.Folder"]/Path$"</FolderPath>

  </DataSource>

</Discovery>