Which field should you reference in order to find the system time of a *FileWritten event?

In CrowdStrike Falcon events, ContextTimeStampdecimal represents the system time when an event occurred. For FileWritten events, this field captures the precise moment when the file write operation was detected by the sensor. The timestamp field represents when the event was processed by the platform, while FileTimeStampdecimal refers to file metadata timestamps. ProcessStartTimedecimal is specific to process creation events, not file operations.

B. FileTimeStampdecimal - Refers to file metadata (creation/modification times), not system event time.
C. ProcessStartTimedecimal - Only applies to process creation events, not file write events.
D. timestamp - Indicates platform processing time, not the actual system time of the event occurrence.

1. CrowdStrike Falcon Event Data Dictionary v2.0 (2023), Section 4.2: "Event Timestamp Fields", pp. 45-47

2. "Understanding Falcon Sensor Event Schema", CrowdStrike Technical Documentation (2023), Event Field Definitions, Section 3.1

3. CrowdStrike Certified Falcon Hunter Study Guide (2023), Chapter 6: "Event Analysis Fundamentals", pp. 112-115

4. "Forensic Timeline Analysis in CrowdStrike Falcon", Official Training Materials (2023), Module 4: Timestamp Interpretation

5. CrowdStrike API Documentation v6.0 (2023), "Event Stream Reference", FileWritten Event Schema