| Name | Description | |
|---|---|---|
 | ActiveOnCapture | Gets a value indicating whether [active on capture]. |
| ChangeType | Gets the type of the change that was detected. |
| ExecutingBinary | Gets the changed by. |
| ExitCode | Gets the exit code. |
| ExitTime | Gets the exit time if process had exited on capturing. |
| File | Gets the file that was changed outside of the context of the firewall. |
| IsSuspicious | Gets or sets a value indicating whether this file change is suspicious because it was not controlled via a IDiskGuard |
| MachineName | Gets the name of the machine at the time it was recorded. |
| Processes | Gets the processes. |
| ProcessId | Gets the process identifier as it was at the time of capture. |
| ProcessName | Gets the name of the process at the time it was recorded. |
| RecordedUtc | Gets the date the change was recorded in UTC. |
| StartInfo | Gets the start-up information of the process like arguments and path. |