Module file

Expand description

A file is defined as a set of information that has been created on, or has existed on a filesystem. File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.

Constants§

FILE_ACCESSED: Last time the file was accessed. Note that not all filesystems keep track of access time.
FILE_ATTRIBUTES: Array of file attributes. Attributes names will vary by platform. Here’s a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.
FILE_CODE_SIGNATURE_DIGEST_ALGORITHM: The hashing algorithm used to sign the process. This value can distinguish signatures when a file is signed multiple times by the same signer but with a different digest algorithm.
FILE_CODE_SIGNATURE_EXISTS: Boolean to capture if a signature is present.
FILE_CODE_SIGNATURE_SIGNING_ID: The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.
FILE_CODE_SIGNATURE_STATUS: Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.
FILE_CODE_SIGNATURE_SUBJECT_NAME: Subject name of the code signer
FILE_CODE_SIGNATURE_TEAM_ID: The team identifier used to sign the process. This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.
FILE_CODE_SIGNATURE_TIMESTAMP: Date and time when the code signature was generated and signed.
FILE_CODE_SIGNATURE_TRUSTED: Stores the trust status of the certificate chain. Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.
FILE_CODE_SIGNATURE_VALID: Boolean to capture if the digital signature is verified against the binary content. Leave unpopulated if a certificate was unchecked.
FILE_CREATED: File creation time. Note that not all filesystems store the creation time.
FILE_CTIME: Last time the file attributes or metadata changed. Note that changes to the file content will update mtime. This implies ctime will be adjusted at the same time, since mtime is an attribute of the file.
FILE_DEVICE: Device that is the source of the file.
FILE_DIRECTORY: Directory where the file is located. It should include the drive letter, when appropriate.
FILE_DRIVE_LETTER: Drive letter where the file is located. This field is only relevant on Windows. The value should be uppercase, and not include the colon.
FILE_ELF_ARCHITECTURE: Machine architecture of the ELF file.
FILE_ELF_BYTE_ORDER: Byte sequence of ELF file.
FILE_ELF_CPU_TYPE: CPU type of the ELF file.
FILE_ELF_CREATION_DATE: Extracted when possible from the file’s metadata. Indicates when it was built or compiled. It can also be faked by malware creators.
FILE_ELF_EXPORTS: List of exported element names and types.
FILE_ELF_GO_IMPORTS: List of imported Go language element names and types.
FILE_ELF_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
FILE_ELF_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
FILE_ELF_GO_IMPORT_HASH: A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
FILE_ELF_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
FILE_ELF_HEADER_ABI_VERSION: Version of the ELF Application Binary Interface (ABI).
FILE_ELF_HEADER_CLASS: Header class of the ELF file.
FILE_ELF_HEADER_DATA: Data table of the ELF header.
FILE_ELF_HEADER_ENTRYPOINT: Header entrypoint of the ELF file.
FILE_ELF_HEADER_OBJECT_VERSION: “0x1” for original ELF files.
FILE_ELF_HEADER_OS_ABI: Application Binary Interface (ABI) of the Linux OS.
FILE_ELF_HEADER_TYPE: Header type of the ELF file.
FILE_ELF_HEADER_VERSION: Version of the ELF header.
FILE_ELF_IMPORTS: List of imported element names and types.
FILE_ELF_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
FILE_ELF_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
FILE_ELF_IMPORT_HASH: A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is an ELF implementation of the Windows PE imphash.
FILE_ELF_SECTIONS: An array containing an object for each section of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.sections.*.
FILE_ELF_SECTIONS_CHI2: Chi-square probability distribution of the section.
FILE_ELF_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
FILE_ELF_SECTIONS_FLAGS: ELF Section List flags.
FILE_ELF_SECTIONS_NAME: ELF Section List name.
FILE_ELF_SECTIONS_PHYSICAL_OFFSET: ELF Section List offset.
FILE_ELF_SECTIONS_PHYSICAL_SIZE: ELF Section List physical size.
FILE_ELF_SECTIONS_TYPE: ELF Section List type.
FILE_ELF_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
FILE_ELF_SECTIONS_VIRTUAL_ADDRESS: ELF Section List virtual address.
FILE_ELF_SECTIONS_VIRTUAL_SIZE: ELF Section List virtual size.
FILE_ELF_SEGMENTS: An array containing an object for each segment of the ELF file. The keys that should be present in these objects are defined by sub-fields underneath elf.segments.*.
FILE_ELF_SEGMENTS_SECTIONS: ELF object segment sections.
FILE_ELF_SEGMENTS_TYPE: ELF object segment type.
FILE_ELF_SHARED_LIBRARIES: List of shared libraries used by this ELF object.
FILE_ELF_TELFHASH: telfhash symbol hash for ELF file.
FILE_EXTENSION: File extension, excluding the leading dot. Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (“gz”, not “tar.gz”).
FILE_FORK_NAME: A fork is additional data associated with a filesystem object. On Linux, a resource fork is used to store additional data with a filesystem object. A file always has at least one fork for the data portion, and additional forks may exist. On NTFS, this is analogous to an Alternate Data Stream (ADS), and the default data stream for a file is just called $DATA. Zone.Identifier is commonly used by Windows to track contents downloaded from the Internet. An ADS is typically of the form: C:\path\to\filename.extension:some_fork_name, and some_fork_name is the value that should populate fork_name. filename.extension should populate file.name, and extension should populate file.extension. The full path, file.path, will include the fork name.
FILE_GID: Primary group ID (GID) of the file.
FILE_GROUP: Primary group name of the file.
FILE_HASH_MD5: MD5 hash.
FILE_HASH_SHA1: SHA1 hash.
FILE_HASH_SHA256: SHA256 hash.
FILE_HASH_SHA384: SHA384 hash.
FILE_HASH_SHA512: SHA512 hash.
FILE_HASH_SSDEEP: SSDEEP hash.
FILE_HASH_TLSH: TLSH hash.
FILE_INODE: Inode representing the file in the filesystem.
FILE_MACHO_GO_IMPORTS: List of imported Go language element names and types.
FILE_MACHO_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
FILE_MACHO_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
FILE_MACHO_GO_IMPORT_HASH: A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
FILE_MACHO_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
FILE_MACHO_IMPORTS: List of imported element names and types.
FILE_MACHO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
FILE_MACHO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
FILE_MACHO_IMPORT_HASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash.
FILE_MACHO_SECTIONS: An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath macho.sections.*.
FILE_MACHO_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
FILE_MACHO_SECTIONS_NAME: Mach-O Section List name.
FILE_MACHO_SECTIONS_PHYSICAL_SIZE: Mach-O Section List physical size.
FILE_MACHO_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
FILE_MACHO_SECTIONS_VIRTUAL_SIZE: Mach-O Section List virtual size. This is always the same as physical_size.
FILE_MACHO_SYMHASH: A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash
FILE_MIME_TYPE: MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.
FILE_MODE: Mode of the file in octal representation.
FILE_MTIME: Last time the file content was modified.
FILE_NAME: Name of the file including the extension, without the directory.
FILE_OWNER: File owner’s username.
FILE_PATH: Full path to the file, including the file name. It should include the drive letter, when appropriate.
FILE_PE_ARCHITECTURE: CPU architecture target for the file.
FILE_PE_COMPANY: Internal company name of the file, provided at compile-time.
FILE_PE_DESCRIPTION: Internal description of the file, provided at compile-time.
FILE_PE_FILE_VERSION: Internal version of the file, provided at compile-time.
FILE_PE_GO_IMPORTS: List of imported Go language element names and types.
FILE_PE_GO_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of Go imports.
FILE_PE_GO_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of Go imports.
FILE_PE_GO_IMPORT_HASH: A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here.
FILE_PE_GO_STRIPPED: Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable.
FILE_PE_IMPHASH: A hash of the imports in a PE file. An imphash – or import hash – can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.
FILE_PE_IMPORTS: List of imported element names and types.
FILE_PE_IMPORTS_NAMES_ENTROPY: Shannon entropy calculation from the list of imported element names and types.
FILE_PE_IMPORTS_NAMES_VAR_ENTROPY: Variance for Shannon entropy calculation from the list of imported element names and types.
FILE_PE_IMPORT_HASH: A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for imphash.
FILE_PE_ORIGINAL_FILE_NAME: Internal name of the file, provided at compile-time.
FILE_PE_PEHASH: A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value. Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.
FILE_PE_PRODUCT: Internal product name of the file, provided at compile-time.
FILE_PE_SECTIONS: An array containing an object for each section of the PE file. The keys that should be present in these objects are defined by sub-fields underneath pe.sections.*.
FILE_PE_SECTIONS_ENTROPY: Shannon entropy calculation from the section.
FILE_PE_SECTIONS_NAME: PE Section List name.
FILE_PE_SECTIONS_PHYSICAL_SIZE: PE Section List physical size.
FILE_PE_SECTIONS_VAR_ENTROPY: Variance for Shannon entropy calculation from the section.
FILE_PE_SECTIONS_VIRTUAL_SIZE: PE Section List virtual size. This is always the same as physical_size.
FILE_SIZE: File size in bytes. Only relevant when file.type is “file”.
FILE_TARGET_PATH: Target path for symlinks.
FILE_TYPE: File type (file, dir, or symlink).
FILE_UID: The user ID (UID) or security identifier (SID) of the file owner.
FILE_X509_ALTERNATIVE_NAMES: List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.
FILE_X509_ISSUER_COMMON_NAME: List of common name (CN) of issuing certificate authority.
FILE_X509_ISSUER_COUNTRY: List of country (C) codes
FILE_X509_ISSUER_DISTINGUISHED_NAME: Distinguished name (DN) of issuing certificate authority.
FILE_X509_ISSUER_LOCALITY: List of locality names (L)
FILE_X509_ISSUER_ORGANIZATION: List of organizations (O) of issuing certificate authority.
FILE_X509_ISSUER_ORGANIZATIONAL_UNIT: List of organizational units (OU) of issuing certificate authority.
FILE_X509_ISSUER_STATE_OR_PROVINCE: List of state or province names (ST, S, or P)
FILE_X509_NOT_AFTER: Time at which the certificate is no longer considered valid.
FILE_X509_NOT_BEFORE: Time at which the certificate is first considered valid.
FILE_X509_PUBLIC_KEY_ALGORITHM: Algorithm used to generate the public key.
FILE_X509_PUBLIC_KEY_CURVE: The curve used by the elliptic curve public key algorithm. This is algorithm specific.
FILE_X509_PUBLIC_KEY_EXPONENT: Exponent used to derive the public key. This is algorithm specific.
FILE_X509_PUBLIC_KEY_SIZE: The size of the public key space in bits.
FILE_X509_SERIAL_NUMBER: Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.
FILE_X509_SIGNATURE_ALGORITHM: Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.
FILE_X509_SUBJECT_COMMON_NAME: List of common names (CN) of subject.
FILE_X509_SUBJECT_COUNTRY: List of country (C) code
FILE_X509_SUBJECT_DISTINGUISHED_NAME: Distinguished name (DN) of the certificate subject entity.
FILE_X509_SUBJECT_LOCALITY: List of locality names (L)
FILE_X509_SUBJECT_ORGANIZATION: List of organizations (O) of subject.
FILE_X509_SUBJECT_ORGANIZATIONAL_UNIT: List of organizational units (OU) of subject.
FILE_X509_SUBJECT_STATE_OR_PROVINCE: List of state or province names (ST, S, or P)
FILE_X509_VERSION_NUMBER: Version of x509 format.

Module file

Module file Copy item path

Constants§

Module file