File create drilldown tab

The File create drilldown tab provides an overview of all Sysmon file create (Event ID 11) indicators within the specified timespan.

The File create drilldown tab displays the following tables:

• Drilldown grid listing all recorded Sysmon file create events
• Heatmap grid listing all Sysmon file creates by process
• Drilldown grid listing all file create activity by ATT&CK technique
• Drilldown grid listing top file create activity by process
• Grid listing raw sysmon file create logs within the specified timespan

A higher definition picture of the File create drilldown tab can be found here.