- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Data Stream Fields
- Destination Fields
- Device Fields
- DLL Fields
- DNS Fields
- ECS Fields
- ELF Header Fields
- Email Fields
- Error Fields
- Event Fields
- FaaS Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Mach-O Header Fields
- Network Fields
- Observer Fields
- Orchestrator Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Risk information Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Volume Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
- Release Notes
Package Fields
editPackage Fields
editThese fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.
Package Field Details
editField | Description | Level |
---|---|---|
Package architecture. type: keyword example: |
extended |
|
Additional information about the build version of the installed package. For example use the commit SHA of a non-released package. type: keyword example: |
extended |
|
Checksum of the installed package for verification. type: keyword example: |
extended |
|
Description of the package. type: keyword example: |
extended |
|
Indicating how the package was installed, e.g. user-local, global. type: keyword example: |
extended |
|
Time when package was installed. type: date |
extended |
|
License under which the package was released. Use a short name, e.g. the license identifier from SPDX License List where possible (https://spdx.org/licenses/). type: keyword example: |
extended |
|
Package name type: keyword example: |
extended |
|
Path where the package is installed. type: keyword example: |
extended |
|
Home page or reference URL of the software in this package, if available. type: keyword example: |
extended |
|
Package size in bytes. type: long example: |
extended |
|
Type of package. This should contain the package file type, rather than the package manager name. Examples: rpm, dpkg, brew, npm, gem, nupkg, jar. type: keyword example: |
extended |
|
Package version type: keyword example: |
extended |
On this page