File Integrity fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
These are the fields generated by the file_integrity module.
File attributes.
These fields contain Linux Executable Linkable Format (ELF) metadata.
file.elf.go_imports-
List of imported Go language element names and types.
type: flattened
file.elf.go_imports_names_entropy-
Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.elf.go_imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.elf.go_import_hash-
A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
type: keyword
example: 10bddcb4cee42080f76c88d9ff964491
file.elf.go_stripped-
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
type: boolean
file.elf.imports_names_entropy-
Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.elf.imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.elf.import_hash-
A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is an ELF implementation of the Windows PE imphash.
type: keyword
example: d41d8cd98f00b204e9800998ecf8427e
file.elf.sections.var_entropy-
Variance for Shannon entropy calculation from the section.
type: long
format: number
These fields contain Mach object file Format (Mach-O) metadata.
file.macho.go_imports-
List of imported Go language element names and types.
type: flattened
file.macho.go_imports_names_entropy-
Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.macho.go_imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.macho.go_import_hash-
A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
type: keyword
example: 10bddcb4cee42080f76c88d9ff964491
file.macho.go_stripped-
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
type: boolean
file.macho.imports-
List of imported element names and types.
type: flattened
file.macho.imports_names_entropy-
Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.macho.imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.macho.import_hash-
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash.
type: keyword
example: d3ccf195b62a9279c3c19af1080497ec
file.macho.sections-
An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath
macho.sections.*.type: nested
file.macho.sections.entropy-
Shannon entropy calculation from the section.
type: long
format: number
file.macho.sections.var_entropy-
Variance for Shannon entropy calculation from the section.
type: long
format: number
file.macho.sections.name-
Mach-O Section List name.
type: keyword
file.macho.sections.physical_size-
Mach-O Section List physical size.
type: long
format: string
file.macho.sections.virtual_size-
Mach-O Section List virtual size.
type: long
format: string
file.macho.symhash-
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
type: keyword
example: d3ccf195b62a9279c3c19af1080497ec
These fields contain Windows Portable Executable (PE) metadata.
file.pe.go_imports-
List of imported Go language element names and types.
type: flattened
file.pe.go_imports_names_entropy-
Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.pe.go_imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of Go imports.
type: long
format: number
file.pe.go_import_hash-
A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
type: keyword
example: 10bddcb4cee42080f76c88d9ff964491
file.pe.go_stripped-
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
type: boolean
file.pe.imports-
List of imported element names and types.
type: flattened
file.pe.imports_names_entropy-
Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.pe.imports_names_var_entropy-
Variance for Shannon entropy calculation from the list of imported element names and types.
type: long
format: number
file.pe.import_hash-
A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for imphash.
type: keyword
file.pe.sections-
An array containing an object for each section of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath
pe.sections.*.type: nested
file.pe.sections.entropy-
Shannon entropy calculation from the section.
type: long
format: number
file.pe.sections.var_entropy-
Variance for Shannon entropy calculation from the section.
type: long
format: number
file.pe.sections.name-
PE Section List name.
type: keyword
file.pe.sections.physical_size-
PE Section List physical size.
type: long
format: string
file.pe.sections.virtual_size-
PE Section List virtual size.
type: long
format: string
Hashes of the file. The keys are algorithm names and the values are the hex encoded digest values.
hash.blake2b_256-
BLAKE2b-256 hash of the file.
type: keyword
hash.blake2b_384-
BLAKE2b-384 hash of the file.
type: keyword
hash.blake2b_512-
BLAKE2b-512 hash of the file.
type: keyword
hash.md5-
MD5 hash of the file.
type: keyword
hash.sha1-
SHA1 hash of the file.
type: keyword
hash.sha224-
SHA224 hash of the file.
type: keyword
hash.sha256-
SHA256 hash of the file.
type: keyword
hash.sha384-
SHA384 hash of the file.
type: keyword
hash.sha3_224-
SHA3_224 hash of the file.
type: keyword
hash.sha3_256-
SHA3_256 hash of the file.
type: keyword
hash.sha3_384-
SHA3_384 hash of the file.
type: keyword
hash.sha3_512-
SHA3_512 hash of the file.
type: keyword
hash.sha512-
SHA512 hash of the file.
type: keyword
hash.sha512_224-
SHA512/224 hash of the file.
type: keyword
hash.sha512_256-
SHA512/256 hash of the file.
type: keyword
hash.xxh64-
XX64 hash of the file.
type: keyword