Mach-O Header fields
Elastic Cloud Serverless projects are autoscaled environments, fully managed by Elastic and available on Elastic Cloud. Availability This functionality is generally available and ready for production usage. Serverless interfaces and procedures might differ from classic Elastic Stack deployments. The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability This functionality is generally available and ready for production usage. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Serverless
Generally available
Stack
Generally available
These fields contain Mac OS Mach Object file format (Mach-O) metadata.
These fields are in beta and are subject to change.
| Field | Description | Level |
|---|---|---|
| macho.go_import_hash | A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here: https://github.com/elastic/toutoumomoma type: keyword example: 10bddcb4cee42080f76c88d9ff964491 |
extended |
| macho.go_imports | List of imported Go language element names and types. type: flattened |
extended |
| macho.go_imports_names_entropy | Shannon entropy calculation from the list of Go imports. type: long |
extended |
| macho.go_imports_names_var_entropy | Variance for Shannon entropy calculation from the list of Go imports. type: long |
extended |
| macho.go_stripped | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. type: boolean |
extended |
| macho.import_hash | A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash. type: keyword example: d41d8cd98f00b204e9800998ecf8427e |
extended |
| macho.imports | List of imported element names and types. type: flattened Note: This field should contain an array of values. |
extended |
| macho.imports_names_entropy | Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
| macho.imports_names_var_entropy | Variance for Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
| macho.sections | An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.type: nested Note: This field should contain an array of values. |
extended |
| macho.sections.entropy | Shannon entropy calculation from the section. type: long |
extended |
| macho.sections.name | Mach-O Section List name. type: keyword |
extended |
| macho.sections.physical_size | Mach-O Section List physical size. type: long |
extended |
| macho.sections.var_entropy | Variance for Shannon entropy calculation from the section. type: long |
extended |
| macho.sections.virtual_size | Mach-O Section List virtual size. This is always the same as physical_size.type: long |
extended |
| macho.symhash | A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash type: keyword example: d3ccf195b62a9279c3c19af1080497ec |
extended |
The macho fields are expected to be nested at:
file.machoprocess.macho
Note also that the macho fields are not expected to be used directly at the root of the events.