[[ecs-elf-ussage]]
=== ELF Usage

--Description--

[discrete]
=== ELF Field Details
| Field | Description | Level |
| ---- | ---- | ----------- |
| elf.creation_date | Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. | extended |
| ... | ... | ... |
| ... | ... | ... |
| ... | ... | ... |

[discrete]
=== Field Reuse
The `elf` fields are expected to be nested at: `dll.elf`, `file.elf`, `process.elf`.

Note also that the `elf` fields are not expected to be used directly at the root of the events.
