[[ecs-field-reference]]
== {ecs} Field Reference

This is the documentation of ECS version 8.7.0-dev.

ECS defines multiple groups of related fields. They are called "field sets".
The <<ecs-base,Base>> field set is the only one whose fields are defined
at the root of the event.

All other field sets are defined as objects in {es}, under which
all fields are defined.

For a single page representation of all fields, please see the
{ecs_github_repo_link}/generated/csv/fields.csv[generated CSV of fields].

[float]
[[ecs-fieldsets]]
=== Field Sets
[cols="<,<",options="header",]
|=====
| Field Set  | Description

| <<ecs-base,Base>> | All fields defined directly at the root of the events.

| <<ecs-agent,Agent>> | Fields about the monitoring agent.

| <<ecs-as,Autonomous System>> | Fields describing an Autonomous System (Internet routing prefix).

| <<ecs-client,Client>> | Fields about the client side of a network connection, used with server.

| <<ecs-cloud,Cloud>> | Fields about the cloud resource.

| <<ecs-code_signature,Code Signature>> | These fields contain information about binary code signatures.

| <<ecs-container,Container>> | Fields describing the container that generated this event.

| <<ecs-data_stream,Data Stream>> | The data_stream fields take part in defining the new data stream naming scheme.

| <<ecs-destination,Destination>> | Fields about the destination side of a network connection, used with source.

| <<ecs-device,Device>> | Fields characterizing a (mobile) device a process or application is running on.

| <<ecs-dll,DLL>> | These fields contain information about code libraries dynamically loaded into processes.

| <<ecs-dns,DNS>> | Fields describing DNS queries and answers.

| <<ecs-ecs,ECS>> | Meta-information specific to ECS.

| <<ecs-elf,ELF Header>> | These fields contain Linux Executable Linkable Format (ELF) metadata.

| <<ecs-email,Email>> | Describes an email transaction.

| <<ecs-error,Error>> | Fields about errors of any kind.

| <<ecs-event,Event>> | Fields breaking down the event details.

| <<ecs-faas,FaaS>> | Fields describing functions as a service.

| <<ecs-file,File>> | Fields describing files.

| <<ecs-geo,Geo>> | Fields describing a location.

| <<ecs-group,Group>> | User's group relevant to the event.

| <<ecs-hash,Hash>> | Hashes, usually file hashes.

| <<ecs-host,Host>> | Fields describing the relevant computing instance.

| <<ecs-http,HTTP>> | Fields describing an HTTP request.

| <<ecs-interface,Interface>> | Fields to describe observer interface information.

| <<ecs-log,Log>> | Details about the event's logging mechanism.

| <<ecs-macho,Mach-O Header>> | These fields contain Mac OS Mach Object file format (Mach-O) metadata.

| <<ecs-network,Network>> | Fields describing the communication path over which the event happened.

| <<ecs-observer,Observer>> | Fields describing an entity observing the event from outside the host.

| <<ecs-orchestrator,Orchestrator>> | Fields relevant to container orchestrators.

| <<ecs-organization,Organization>> | Fields describing the organization or company the event is associated with.

| <<ecs-os,Operating System>> | OS fields contain information about the operating system.

| <<ecs-package,Package>> | These fields contain information about an installed software package.

| <<ecs-pe,PE Header>> | These fields contain Windows Portable Executable (PE) metadata.

| <<ecs-process,Process>> | These fields contain information about a process.

| <<ecs-registry,Registry>> | Fields related to Windows Registry operations.

| <<ecs-related,Related>> | Fields meant to facilitate pivoting around a piece of data.

| <<ecs-risk,Risk information>> | Fields for describing risk score and level.

| <<ecs-rule,Rule>> | Fields to capture details about rules used to generate alerts or other notable events.

| <<ecs-server,Server>> | Fields about the server side of a network connection, used with client.

| <<ecs-service,Service>> | Fields describing the service for or from which the data was collected.

| <<ecs-source,Source>> | Fields about the source side of a network connection, used with destination.

| <<ecs-threat,Threat>> | Fields to classify events and alerts according to a threat taxonomy.

| <<ecs-tls,TLS>> | Fields describing a TLS connection.

| <<ecs-tracing,Tracing>> | Fields related to distributed tracing.

| <<ecs-url,URL>> | Fields that let you store URLs in various forms.

| <<ecs-user,User>> | Fields to describe the user relevant to the event.

| <<ecs-user_agent,User agent>> | Fields to describe a browser user_agent string.

| <<ecs-vlan,VLAN>> | Fields to describe observed VLAN information.

| <<ecs-vulnerability,Vulnerability>> | Fields to describe the vulnerability relevant to an event.

| <<ecs-x509,x509 Certificate>> | These fields contain x509 certificate metadata.

|=====

include::field-details.asciidoc[]