PE Header Fieldsedit
These fields contain Windows Portable Executable (PE) metadata.
PE Header Field Detailsedit
| Field | Description | Level |
|---|---|---|
pe.company |
Internal company name of the file, provided at compile-time. type: keyword example: |
extended |
pe.description |
Internal description of the file, provided at compile-time. type: keyword example: |
extended |
pe.file_version |
Internal version of the file, provided at compile-time. type: keyword example: |
extended |
pe.original_file_name |
Internal name of the file, provided at compile-time. type: keyword example: |
extended |
pe.product |
Internal product name of the file, provided at compile-time. type: keyword example: |
extended |
Field Reuseedit
The pe fields are expected to be nested at: dll.pe, file.pe, process.pe.
Note also that the pe fields are not expected to be used directly at the top level.