Skip to content

Commit fd6ffbc

Browse files
authored
Update unsupported u64 type to unsigned_long (#337)
* Update unsupported u64 type to long * change type to unsigned_long
1 parent 72cb6e8 commit fd6ffbc

File tree

4 files changed

+4
-4
lines changed

4 files changed

+4
-4
lines changed

custom_schemas/custom_dll.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@
128128
129129
- name: Ext.size
130130
level: custom
131-
type: u64
131+
type: unsigned_long
132132
short: Size of DLL
133133
description: >
134134
Size of DLL

package/endpoint/data_stream/library/fields/fields.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@
294294
default_field: false
295295
- name: Ext.size
296296
level: custom
297-
type: u64
297+
type: unsigned_long
298298
description: Size of DLL
299299
default_field: false
300300
- name: code_signature.exists

package/endpoint/docs/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1675,7 +1675,7 @@ sent by the endpoint.
16751675
| dll.Ext.load_index | A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded. The first load index is 1. | unsigned_long |
16761676
| dll.Ext.relative_file_creation_time | Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future. | double |
16771677
| dll.Ext.relative_file_name_modify_time | Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | double |
1678-
| dll.Ext.size | Size of DLL | u64 |
1678+
| dll.Ext.size | Size of DLL | unsigned_long |
16791679
| dll.code_signature.exists | Boolean to capture if a signature is present. | boolean |
16801680
| dll.code_signature.signing_id | The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | keyword |
16811681
| dll.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword |

schemas/v1/library/library.yaml

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)