Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion custom_schemas/custom_dll.yml
Original file line number Diff line number Diff line change
Expand Up @@ -128,7 +128,7 @@

- name: Ext.size
level: custom
type: u64
type: unsigned_long
short: Size of DLL
description: >
Size of DLL
Expand Down
2 changes: 1 addition & 1 deletion package/endpoint/data_stream/library/fields/fields.yml
Original file line number Diff line number Diff line change
Expand Up @@ -294,7 +294,7 @@
default_field: false
- name: Ext.size
level: custom
type: u64
type: unsigned_long
description: Size of DLL
default_field: false
- name: code_signature.exists
Expand Down
2 changes: 1 addition & 1 deletion package/endpoint/docs/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -1675,7 +1675,7 @@ sent by the endpoint.
| dll.Ext.load_index | A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded. The first load index is 1. | unsigned_long |
| dll.Ext.relative_file_creation_time | Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future. | double |
| dll.Ext.relative_file_name_modify_time | Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | double |
| dll.Ext.size | Size of DLL | u64 |
| dll.Ext.size | Size of DLL | unsigned_long |
| dll.code_signature.exists | Boolean to capture if a signature is present. | boolean |
| dll.code_signature.signing_id | The identifier used to sign the process. This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | keyword |
| dll.code_signature.status | Additional information about the certificate status. This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | keyword |
Expand Down
2 changes: 1 addition & 1 deletion schemas/v1/library/library.yaml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.