File resource type

Applies to:

• Microsoft Defender for Endpoint Plan 1
• Microsoft Defender for Endpoint Plan 2

Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.

Note

If you are a US Government customer, please use the URIs listed in Microsoft Defender for Endpoint for US Government customers.

Tip

For better performance, you can use server closer to your geo location:

• us.api.security.microsoft.com
• eu.api.security.microsoft.com
• uk.api.security.microsoft.com
• au.api.security.microsoft.com
• swa.api.security.microsoft.com
• ina.api.security.microsoft.com

Represent a file entity in Defender for Endpoint.

Methods

Method	Return Type	Description
Get file	file	Get a single file
List file related alerts	alert collection	Get the alert entities that are associated with the file.
List file related machines	machine collection	Get the machine entities associated with the alert.
file statistics	Statistics summary	Retrieves the prevalence for the given file.

Properties

Property	Type	Description
sha1	String	Sha1 hash of the file content
sha256	String	Sha256 hash of the file content
globalPrevalence	Nullable long	File prevalence across organization
globalFirstObserved	DateTimeOffset	First time the file was observed
globalLastObserved	DateTimeOffset	Last time the file was observed
size	Nullable long	Size of the file
fileType	String	Type of the file
isPeFile	Boolean	true if the file is portable executable (for example DLL, EXE, etc.)
filePublisher	String	File publisher
fileProductName	String	Product name
signer	String	File signer
issuer	String	File issuer
signerHash	String	Hash of the signing certificate
isValidCertificate	Boolean	Was signing certificate successfully verified by Microsoft Defender for Endpoint agent
determinationType	String	The determination type of the file
determinationValue	String	Determination value

Json representation

{
    "sha1": "4388963aaa83afe2042a46a3c017ad50bdcdafb3",
    "sha256": "413c58c8267d2c8648d8f6384bacc2ae9c929b2b96578b6860b5087cd1bd6462",
    "globalPrevalence": 180022,
    "globalFirstObserved": "2017-09-19T03:51:27.6785431Z",
    "globalLastObserved": "2020-01-06T03:59:21.3229314Z",
    "size": 22139496,
    "fileType": "APP",
    "isPeFile": true,
    "filePublisher": "CHENGDU YIWO Tech Development Co., Ltd.",
    "fileProductName": "EaseUS MobiSaver for Android",
    "signer": "CHENGDU YIWO Tech Development Co., Ltd.",
    "issuer": "VeriSign Class 3 Code Signing 2010 CA",
    "signerHash": "6c3245d4a9bc0244d99dff27af259cbbae2e2d16",
    "isValidCertificate": false,
    "determinationType": "Pua",
    "determinationValue": "PUA:Win32/FusionCore"
}

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.