Every time Storage Protect scans a file, it records provenance - metadata describing where
the file came from: its location, its owner, when it was created and last modified, and whether
it carries a "Mark of the Web" download marker. Provenance is captured at the moment the file is
detected, before any clean or infected action runs, and appears in webhook notifications,
Multi-Threat scan results, Threat Analytics, and Search. It is informational only - it never
affects the scan verdict - and best-effort: any field that cannot be read is simply left blank,
and missing provenance never delays or fails a scan.

The fields

ProvenanceURL - the location of the scanned file as a file:// URI. Network share files
use file://server/share/...; local folder files use file:///C:/....
Example: file://fileserver01/finance/inbox/invoice.docx

ProvenanceUser - the file's owner, as recorded by the file system (NTFS owner), in
DOMAIN\user form. Example: CORP\jsmith

ProvenanceCreationDate - when the file was created, in UTC (ISO 8601).
Example: 2026-07-20T14:03:22.1234567Z

ProvenanceModifiedDate - when the file was last modified, in UTC (ISO 8601).
Example: 2026-07-20T14:05:01.7654321Z

ProvenanceZoneIdentifier - the raw text of the file's Mark of the Web
(Zone.Identifier) marker, when present - the marker Windows attaches to files downloaded from
the internet, including the zone number (ZoneId=3 means Internet) and, when the browser
recorded them, the source and referrer URLs. Most files have no marker; an empty value simply
means the file was not flagged as downloaded content. Truncated to 2,048 characters.
Example: [ZoneTransfer] ZoneId=3 HostUrl=https://example.com/invoice.docx