add pe.original_file_name

elastic · Oct 2, 2020 · 7a4a3e9 · 7a4a3e9
1 parent df4f974
commit 7a4a3e9
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/rfcs/text/0001-wildcard-data-type.md b/rfcs/text/0001-wildcard-data-type.md
@@ -32,6 +32,7 @@ For a field to use wildcard, it will require changing the the field's defined sc
 | [`http`](0001/http.yml) | `http.request.referrer`<br> `http.request.body.content`<br> `http.response.body.content` |
 | [`log`](0001/log.yml) | `log.file.path`<br> `log.logger` |
 | [`os`](0001/os.yml) | `os.name`<br> `os.full` |
+| [`pe`](0001/pe.yml) | `pe.original_file_name` |
 | [`process`](0001/process.yml) | `process.command_line`<br> `process.executable`<br> `process.name`<br> `process.title`<br> `process.working_directory`<br> |
 | [`registry`](0001/registry.yml) | `registry.key`<br> `registry.path`<br> `registry.data.strings` |
 | [`server`](0001/server.yml) | `server.domain`<br> `server.registered_domain` |

diff --git a/rfcs/text/0001/pe.yml b/rfcs/text/0001/pe.yml
@@ -0,0 +1,5 @@
+---
+  - name: process
+    fields:
+      - name: original_final_name
+        type: wildcard