4.5 Interpreting Translation Information

Hl25Q94.5 Interpreting Translation Informationu,

2 (
: , 4.5 Interpreting Translation Information

ç A translated binary event consists of three layers of information: overall, frame, and field.

? The overall binary event contains one or more translated frames of information. There are several types of binary events, each identified by its class name. In addition to the frames, some other information is stored at the overall layer, such as:

(dThe class name of the binary event (passed to Event Analysis but not displayed in the web interface)
(‹The event's "match keys," a set of strings used in identifying analysis rules that may fire for this event (not shown by the web interface)

2 (
: 4.5.2 Frame

b A frame within an event consists of one or more translated fields of information. There are many types of frames, each identified by its label. Each frame type contains a defined set of fields. In addition to the fields, some other information is stored at the frame layer, such as:

(%The parent binary event of this frame
(;The frame's label, displayed at the beginning of each frame

2 (
: 4.5.3 Field

y A field within a frame consists of the following:

(The parent frame of this field
(LThe field's label, both as an identifier (not shown) and as displayable text
(ZThe field's value (of a type defined by the type of field) which is displayed in text form