# ECS fields and ML jobs for modules loaded by process

**URL:** <https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188>\
**Category:** Elastic Security\
**Tags:** elastic-stack-machine-learning\
**Created:** [April 25, 2021, 12:40pm UTC](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188 "2021-04-25T12:40:55Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![hukel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hukel/32/78624_2.png) [@hukel](https://discuss.elastic.co/u/hukel)\
**Post date:** [April 25, 2021, 12:40pm UTC](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188/1 "2021-04-25T12:40:55Z")

</div>

We want to run ML jobs for rare module loads in processes. From what I have seen, this is not in the ECS today, though I think it would be similar to process.args.

Before we start creating custom fields and ML jobs, is this in the roadmap for ECS and SIEM?

At least in Windows processes, I would want to differentiate between modules:

- Linked to the EXE (from DLL file)
- Imported at runtime via reflection (from memory)

Possible example below:

```auto
    "command_line": "C:\\Windows\\system32\\cmd.exe /c C:\\PROGRA~1\\INFORM~1\\apps\\Common_Integration_Components\\12.0.2.1\\.lcm\\status-wrapper.bat",
    "parent": {
      "name": "java.exe"
    },
    "modules": {
      "linked": [
        [
          "\\Windows\\System32\\ntdll.dll"
        ],
        [
          "\\Windows\\System32\\KernelBase.dll"
        ],
        [
          "\\Windows\\System32\\kernel32.dll"
        ],
        [
          "\\PROGRA~1\\INFORM~1\\apps\\jdk\\1.8.0_275_SA\\jre\\bin\\java.dll"
        ],
        [
          "HEAP:4482:RWX-:UNKNOWN::0x267e000"
        ]
      ]
    },

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 23, 2021, 12:41pm UTC](https://discuss.elastic.co/t/ecs-fields-and-ml-jobs-for-modules-loaded-by-process/271188/2 "2021-05-23T12:41:19Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.