Add PE field set under file and process

CHANGELOG.next.md

@@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->
 
 #### Added
 
+* Fieldset for PE metadata. #731
+
 #### Improvements
 
 * Temporary workaround for Beats templates' `default_field` growing too big. #687

docs/field-details.asciidoc

@@ -1725,6 +1725,12 @@ example: `1001`
 // ===============================================================
 
 
+| <<ecs-pe,file.pe.*>>
+| These fields contain Windows PE (Portable Executable) metadata.
+
+// ===============================================================
+
+
 |=====
 
 [[ecs-geo]]
@@ -3075,6 +3081,85 @@ example: `1.12.9`
 
 |=====
 
+[[ecs-pe]]
+=== PE Header Fields
+
+These fields contain Windows PE (Portable Executable) metadata.
+
+==== PE Header Field Details
+
+[options="header"]
+|=====
+| Field  | Description | Level
+
+// ===============================================================
+
+| pe.company
+| Internal company name of the file, provided at compile-time.
+
+type: keyword
+
+example: `Microsoft Corporation`
+
+| extended
+
+// ===============================================================
+
+| pe.description
+| Internal description of the file, provided at compile-time.
+
+type: keyword
+
+example: `Paint`
+
+| extended
+
+// ===============================================================
+
+| pe.file_version
+| Internal version of the file, provided at compile-time.
+
+type: keyword
+
+example: `6.3.9600.17415`
+
+| extended
+
+// ===============================================================
+
+| pe.original_file_name
+| Internal name of the file, provided at compile-time.
+
+type: keyword
+
+example: `MSPAINT.EXE`
+
+| extended
+
+// ===============================================================
+
+| pe.product
+| Internal product name of the file, provided at compile-time.
+
+type: keyword
+
+example: `Microsoft® Windows® Operating System`
+
+| extended
+
+// ===============================================================
+
+|=====
+
+==== Field Reuse
+
+The `pe` fields are expected to be nested at: `file.pe`, `process.pe`.
+
+Note also that the `pe` fields are not expected to be used directly at the top level.
+
+
+
+
 [[ecs-process]]
 === Process Fields
 
@@ -3527,6 +3612,12 @@ example: `/home/alice`
 // ===============================================================
 
 
+| <<ecs-pe,process.pe.*>>
+| These fields contain Windows PE (Portable Executable) metadata.
+
+// ===============================================================
+
+
 |=====
 
 [[ecs-registry]]

docs/fields.asciidoc

@@ -64,6 +64,8 @@ all fields are defined.
 
 | <<ecs-package,Package>> | These fields contain information about an installed software package.
 
+| <<ecs-pe,PE Header>> | These fields contain Windows PE (Portable Executable) metadata.
+
 | <<ecs-process,Process>> | These fields contain information about a process.
 
 | <<ecs-registry,Registry>> | Fields related to Windows Registry operations.

generated/beats/fields.ecs.yml

@@ -1310,6 +1310,45 @@
       description: Full path to the file, including the file name. It should include
         the drive letter, when appropriate.
       example: /home/alice/example.png
+    - name: pe.company
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal company name of the file, provided at compile-time.
+      example: Microsoft Corporation
+      default_field: false
+    - name: pe.description
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal description of the file, provided at compile-time.
+      example: Paint
+      default_field: false
+    - name: pe.file_version
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Internal version of the file, provided at compile-time.
+      example: 6.3.9600.17415
+      default_field: false
+    - name: pe.original_file_name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal name of the file, provided at compile-time.
+      example: MSPAINT.EXE
+      default_field: false
+    - name: pe.product
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal product name of the file, provided at compile-time.
+      example: "Microsoft\xAE Windows\xAE Operating System"
+      default_field: false
     - name: size
       level: extended
       type: long
@@ -2348,6 +2387,51 @@
       ignore_above: 1024
       description: Package version
       example: 1.12.9
+  - name: pe
+    title: PE Header
+    group: 2
+    description: These fields contain Windows PE (Portable Executable) metadata.
+    type: group
+    fields:
+    - name: company
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal company name of the file, provided at compile-time.
+      example: Microsoft Corporation
+      default_field: false
+    - name: description
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal description of the file, provided at compile-time.
+      example: Paint
+      default_field: false
+    - name: file_version
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Internal version of the file, provided at compile-time.
+      example: 6.3.9600.17415
+      default_field: false
+    - name: original_file_name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal name of the file, provided at compile-time.
+      example: MSPAINT.EXE
+      default_field: false
+    - name: product
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal product name of the file, provided at compile-time.
+      example: "Microsoft\xAE Windows\xAE Operating System"
+      default_field: false
   - name: process
     title: Process
     group: 2
@@ -2588,6 +2672,45 @@
       description: The working directory of the process.
       example: /home/alice
       default_field: false
+    - name: pe.company
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal company name of the file, provided at compile-time.
+      example: Microsoft Corporation
+      default_field: false
+    - name: pe.description
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal description of the file, provided at compile-time.
+      example: Paint
+      default_field: false
+    - name: pe.file_version
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      description: Internal version of the file, provided at compile-time.
+      example: 6.3.9600.17415
+      default_field: false
+    - name: pe.original_file_name
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal name of the file, provided at compile-time.
+      example: MSPAINT.EXE
+      default_field: false
+    - name: pe.product
+      level: extended
+      type: keyword
+      ignore_above: 1024
+      format: string
+      description: Internal product name of the file, provided at compile-time.
+      example: "Microsoft\xAE Windows\xAE Operating System"
+      default_field: false
     - name: pgid
       level: extended
       type: long

generated/csv/fields.csv

@@ -158,6 +158,11 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Example,Description
 1.5.0-dev,true,file,file.owner,keyword,extended,alice,File owner's username.
 1.5.0-dev,true,file,file.path,keyword,extended,/home/alice/example.png,"Full path to the file, including the file name."
 1.5.0-dev,true,file,file.path.text,text,extended,/home/alice/example.png,"Full path to the file, including the file name."
+1.5.0-dev,true,file,file.pe.company,keyword,extended,Microsoft Corporation,"Internal company name of the file, provided at compile-time."
+1.5.0-dev,true,file,file.pe.description,keyword,extended,Paint,"Internal description of the file, provided at compile-time."
+1.5.0-dev,true,file,file.pe.file_version,keyword,extended,6.3.9600.17415,Process name.
+1.5.0-dev,true,file,file.pe.original_file_name,keyword,extended,MSPAINT.EXE,"Internal name of the file, provided at compile-time."
+1.5.0-dev,true,file,file.pe.product,keyword,extended,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time."
 1.5.0-dev,true,file,file.size,long,extended,16384,File size in bytes.
 1.5.0-dev,true,file,file.target_path,keyword,extended,,Target path for symlinks.
 1.5.0-dev,true,file,file.target_path.text,text,extended,,Target path for symlinks.
@@ -298,6 +303,11 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Example,Description
 1.5.0-dev,true,package,package.size,long,extended,62231,Package size in bytes.
 1.5.0-dev,true,package,package.type,keyword,extended,rpm,Package type
 1.5.0-dev,true,package,package.version,keyword,extended,1.12.9,Package version
+1.5.0-dev,true,pe,pe.company,keyword,extended,Microsoft Corporation,"Internal company name of the file, provided at compile-time."
+1.5.0-dev,true,pe,pe.description,keyword,extended,Paint,"Internal description of the file, provided at compile-time."
+1.5.0-dev,true,pe,pe.file_version,keyword,extended,6.3.9600.17415,Process name.
+1.5.0-dev,true,pe,pe.original_file_name,keyword,extended,MSPAINT.EXE,"Internal name of the file, provided at compile-time."
+1.5.0-dev,true,pe,pe.product,keyword,extended,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time."
 1.5.0-dev,true,process,process.args,keyword,extended,"['/usr/bin/ssh', '-l', 'user', '10.0.0.16']",Array of process arguments.
 1.5.0-dev,true,process,process.args_count,long,extended,4,Length of the process.args array.
 1.5.0-dev,true,process,process.command_line,keyword,extended,/usr/bin/ssh -l user 10.0.0.16,Full command line that started the process.
@@ -331,6 +341,11 @@ ECS_Version,Indexed,Field_Set,Field,Type,Level,Example,Description
 1.5.0-dev,true,process,process.parent.uptime,long,extended,1325,Seconds the process has been up.
 1.5.0-dev,true,process,process.parent.working_directory,keyword,extended,/home/alice,The working directory of the process.
 1.5.0-dev,true,process,process.parent.working_directory.text,text,extended,/home/alice,The working directory of the process.
+1.5.0-dev,true,process,process.pe.company,keyword,extended,Microsoft Corporation,"Internal company name of the file, provided at compile-time."
+1.5.0-dev,true,process,process.pe.description,keyword,extended,Paint,"Internal description of the file, provided at compile-time."
+1.5.0-dev,true,process,process.pe.file_version,keyword,extended,6.3.9600.17415,Process name.
+1.5.0-dev,true,process,process.pe.original_file_name,keyword,extended,MSPAINT.EXE,"Internal name of the file, provided at compile-time."
+1.5.0-dev,true,process,process.pe.product,keyword,extended,Microsoft® Windows® Operating System,"Internal product name of the file, provided at compile-time."
 1.5.0-dev,true,process,process.pgid,long,extended,,Identifier of the group of processes the process belongs to.
 1.5.0-dev,true,process,process.pid,long,core,4242,Process id.
 1.5.0-dev,true,process,process.ppid,long,extended,4241,Parent process' pid.