- Elastic Common Schema (ECS) Reference: other versions:
- Overview
- Using ECS
- ECS Field Reference
- Base Fields
- Agent Fields
- Autonomous System Fields
- Client Fields
- Cloud Fields
- Code Signature Fields
- Container Fields
- Data Stream Fields
- Destination Fields
- Device Fields
- DLL Fields
- DNS Fields
- ECS Fields
- ELF Header Fields
- Email Fields
- Error Fields
- Event Fields
- FaaS Fields
- File Fields
- Geo Fields
- Group Fields
- Hash Fields
- Host Fields
- HTTP Fields
- Interface Fields
- Log Fields
- Mach-O Header Fields
- Network Fields
- Observer Fields
- Orchestrator Fields
- Organization Fields
- Operating System Fields
- Package Fields
- PE Header Fields
- Process Fields
- Registry Fields
- Related Fields
- Risk information Fields
- Rule Fields
- Server Fields
- Service Fields
- Source Fields
- Threat Fields
- TLS Fields
- Tracing Fields
- URL Fields
- User Fields
- User agent Fields
- VLAN Fields
- Volume Fields
- Vulnerability Fields
- x509 Certificate Fields
- ECS Categorization Fields
- Migrating to ECS
- Additional Information
- Release Notes
Mach-O Header Fields
editMach-O Header Fields
editThese fields contain Mac OS Mach Object file format (Mach-O) metadata.
These fields are in beta and are subject to change.
Mach-O Header Field Details
editField | Description | Level |
---|---|---|
A hash of the Go language imports in a Mach-O file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. The algorithm used to calculate the Go symbol hash and a reference implementation are available here: https://github.com/elastic/toutoumomoma type: keyword example: |
extended |
|
List of imported Go language element names and types. type: flattened |
extended |
|
Shannon entropy calculation from the list of Go imports. type: long |
extended |
|
Variance for Shannon entropy calculation from the list of Go imports. type: long |
extended |
|
Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. type: boolean |
extended |
|
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a synonym for symhash. type: keyword example: |
extended |
|
List of imported element names and types. type: flattened Note: this field should contain an array of values. |
extended |
|
Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
|
Variance for Shannon entropy calculation from the list of imported element names and types. type: long |
extended |
|
An array containing an object for each section of the Mach-O file. The keys that should be present in these objects are defined by sub-fields underneath type: nested Note: this field should contain an array of values. |
extended |
|
Shannon entropy calculation from the section. type: long |
extended |
|
Mach-O Section List name. type: keyword |
extended |
|
Mach-O Section List physical size. type: long |
extended |
|
Variance for Shannon entropy calculation from the section. type: long |
extended |
|
Mach-O Section List virtual size. This is always the same as type: long |
extended |
|
A hash of the imports in a Mach-O file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values. This is a Mach-O implementation of the Windows PE imphash type: keyword example: |
extended |
Field Reuse
editThe macho
fields are expected to be nested at:
-
file.macho
-
process.macho
Note also that the macho
fields are not expected to be used directly at the root of the events.
On this page