This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

« FaaS Fields Geo Fields »

› ›

File Fields

edit

File Fields

edit

A file is defined as a set of information that has been created on, or has existed on a filesystem.

File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.

File Field Details

edit

Field	Description	Level
file.accessed	Last time the file was accessed. Note that not all filesystems keep track of access time. type: date file.accessed	extended
file.attributes	Array of file attributes. Attributes names will vary by platform. Here’s a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. type: keyword Note: this field should contain an array of values. example: `["readonly", "system"]` file.attributes	extended
file.created	File creation time. Note that not all filesystems store the creation time. type: date file.created	extended
file.ctime	Last time the file attributes or metadata changed. Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. type: date file.changed	extended
file.device	Device that is the source of the file. type: keyword example: `sda`	extended
file.directory	Directory where the file is located. It should include the drive letter, when appropriate. type: keyword example: `/home/alice` file.directory	extended
file.drive_letter	Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon. type: keyword example: `C`	extended
file.extension	File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). type: keyword example: `png` file.extension	extended
file.fork_name	A fork is additional data associated with a filesystem object. On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist. On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: `C:\path\to\filename.extension:some_fork_name`, and `some_fork_name` is the value that should populate `fork_name`. `filename.extension` should populate `file.name`, and `extension` should populate `file.extension`. The full path, `file.path`, will include the fork name. type: keyword example: `Zone.Identifer` file.fork_name	extended
file.gid	Primary group ID (GID) of the file. type: keyword example: `1001` file.group.id	extended
file.group	Primary group name of the file. type: keyword example: `alice` file.group.name	extended
file.inode	Inode representing the file in the filesystem. type: keyword example: `256383` file.inode	extended
file.mime_type	MIME type should identify the format of the file or stream of bytes using IANA official types, where possible. When more than one type is applicable, the most specific type should be used. type: keyword	extended
file.mode	Mode of the file in octal representation. type: keyword example: `0640` file.mode	extended
file.mtime	Last time the file content was modified. type: date file.modified	extended
file.name	Name of the file including the extension, without the directory. type: keyword example: `example.png` file.name	extended
file.owner	File owner’s username. type: keyword example: `alice` file.owner.name	extended
file.path	Full path to the file, including the file name. It should include the drive letter, when appropriate. type: keyword Multi-fields: file.path.text (type: match_only_text) example: `/home/alice/example.png` file.path	extended
file.size	File size in bytes. Only relevant when `file.type` is "file". type: long example: `16384` file.size	extended
file.target_path	Target path for symlinks. type: keyword Multi-fields: file.target_path.text (type: match_only_text) file.symbolic_link.target_path	extended
file.type	File type (file, dir, or symlink). type: keyword example: `file`	extended
file.uid	The user ID (UID) or security identifier (SID) of the file owner. type: keyword example: `1001` file.owner.id	extended

Field Reuse

edit

The file fields are expected to be nested at:

threat.enrichments.indicator.file
threat.indicator.file

Note also that the file fields may be used directly at the root of the events.

Field sets that can be nested under File

edit

Location	Field Set	Description
`file.code_signature.*`	code_signature	These fields contain information about binary code signatures.
`file.elf.*`	elf	[beta] This field reuse is beta and subject to change. These fields contain Linux Executable Linkable Format (ELF) metadata.
`file.hash.*`	hash	Hashes, usually file hashes.
`file.macho.*`	macho	[beta] This field reuse is beta and subject to change. These fields contain Mac OS Mach Object file format (Mach-O) metadata.
`file.pe.*`	pe	These fields contain Windows Portable Executable (PE) metadata.
`file.x509.*`	x509	These fields contain x509 certificate metadata.

« FaaS Fields Geo Fields »