IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.

› ›

PE Header Fields

edit

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

PE Header Fields

edit

These fields contain Windows Portable Executable (PE) metadata.

PE Header Field Details

edit

Field	Description	Level
pe.company	Internal company name of the file, provided at compile-time. type: keyword example: `Microsoft Corporation`	extended
pe.description	Internal description of the file, provided at compile-time. type: keyword example: `Paint`	extended
pe.file_version	Internal version of the file, provided at compile-time. type: keyword example: `6.3.9600.17415`	extended
pe.original_file_name	Internal name of the file, provided at compile-time. type: keyword example: `MSPAINT.EXE`	extended
pe.product	Internal product name of the file, provided at compile-time. type: keyword example: `Microsoft® Windows® Operating System`	extended

Field Reuse

edit

The pe fields are expected to be nested at: dll.pe, file.pe, process.pe.

Note also that the pe fields are not expected to be used directly at the top level.

« Package Fields Process Fields »