What does the "action" property represent in Elastic?

[antmar904]

Hi.
When looking at events in Elastic particularly NFTS events, what do the action properties (RD, MOD, CRE, etc) mean?

[evild3ad]

You mean the ACTION column of "FS_Forensic_Timeline"?
https://github.com/ufrisk/MemProcFS/wiki/FS_Forensic_Timeline

I will ask Ulf if he may update this info in his wiki. Cheers!

RD = Read
MOD = Modification Time
CRE = Creation Time

[antmar904]

Thank you