Code Signature fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
These fields contain information about binary code signatures.
| Field | Description | Level |
|---|---|---|
| code_signature.digest_algorithm | The hashing algorithm used to sign the process. This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm. type: keyword example: sha256 |
extended |
| code_signature.exists | Boolean to capture if a signature is present. type: boolean example: true |
core |
| code_signature.flags | This field is beta and subject to change. The flags used to sign the process. type: keyword example: 570522385 |
extended |
| code_signature.signing_id | The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. type: keyword example: com.apple.xpc.proxy |
extended |
| code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. type: keyword example: ERROR_UNTRUSTED_ROOT |
extended |
| code_signature.subject_name | Subject name of the code signer type: keyword example: Microsoft Corporation |
core |
| code_signature.team_id | The team identifier used to sign the process. This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. type: keyword example: EQHXZ8M8AV |
extended |
| code_signature.thumbprint_sha256 | This field is beta and subject to change. Certificate SHA256 hash that uniquely identifies the code signer. type: keyword example: c0f23a8eb1cba0ccaa88483b5a234c96e4bdfec719bf458024e68c2a8183476b |
extended |
| code_signature.timestamp | Date and time when the code signature was generated and signed. type: date example: 2021-01-01T12:10:30Z |
extended |
| code_signature.trusted | Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. type: boolean example: true |
extended |
| code_signature.valid | Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked. type: boolean example: true |
extended |
The code_signature fields are expected to be nested at:
dll.code_signaturefile.code_signatureprocess.code_signature
Note also that the code_signature fields are not expected to be used directly at the root of the events.