The Files Module Export provides a comprehensive CSV record of all file-related security events detected by the Monarx agent. This export is essential for deep-dive forensic analysis, threat hunting, and maintaining a historical audit trail of server-side activity.
❗ IMPORTANT: Understanding the Log Logic & Scope
Chronological Activity: The records listed here are a chronological log of when a file was identified and the specific action Monarx took at that moment.
Operational Modes: Actions depend on the infrastructure configuration:
Insights Only (Detect-Only): Monarx identifies and logs threats for visibility but does not modify the filesystem.
Active Protection (Auto-remediation): Monarx automatically neutralizes threats (e.g., Quarantining) in real-time.
Monarx-Exclusive Reporting: This report is strictly a log of actions taken by the Monarx agent. If a file is removed or modified by a third party (such as a system administrator, manual user intervention, or another security tool), those actions will not be recorded or reflected here.
Not a Live Snapshot: This export should be utilized as an audit trail of Monarx’s interventions and should not be used as a live report of the files currently residing on the disk.
Data Column Definitions
Column Name | Description | Forensic Utility |
agentId | The unique UUID assigned to the specific server or endpoint where the activity was detected. | Used to pivot between the export and the Monarx dashboard for a specific host. |
name | The base name of the file (e.g., | Quick identification of the file involved in the event. |
path | The absolute directory path where the file is located on the filesystem. | Essential for identifying compromised CMS installations or user accounts. |
sha256 | The SHA-256 cryptographic hash of the file content. | Use this to search external databases (like VirusTotal) or for internal IOC blacklisting. |
action | The operation performed by Monarx (e.g., | Indicates the current state of the threat and the effectiveness of the protection policy. |
fileOwner | The system user (UID/Username) that owns the file on the server. | Helps pinpoint which user account or site has been compromised or misused. |
classification | The broad category of the detection (e.g., | Provides an immediate high-level risk assessment of the entry. |
malwareTypes | Specific threat tags assigned to the file (e.g., | Defines the "nature" of the attack (e.g., data exfiltration vs. persistence). |
url | The specific URL or request path that triggered the file activity (if applicable). | Links a filesystem change to a specific web-based attack vector. |
clientIP | The remote IP address that initiated the request associated with the event. | Critical for identifying the source of the attack and performing IP-based blocking at the firewall. |
auditCreated | The timestamp (UTC) indicating when the event was recorded by the Monarx system. | Used for chronological reconstruction of an incident or "blast radius" analysis. |