Detections data sources

Views:

Important

This data source query method is no longer available after May 1, 2026. For more information on the currently available data sources for use in XDR Data Explorer queries, go to https://trendmicro.github.io/tm-v1-schema/pages/index.

Field Name	Type	General Field	Description	Example	Products
accessPermission	`string`	-	The access permission type	`Modify` `Read and execute` `List device content only` `Block`	TrendAI™ Apex One as a Service
act	`dynamic`	-	The actions taken to mitigate the event	`log` `isolate` `terminate` `not blocked` `Block` `No action` `Reset` `Pass` `User Decision`	Trend Cloud One - Container Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TrendAI™ Cloud App Security TippingPoint Security Management System XDR Endpoint Sensor TrendAI™ Web Security TrendAI™ Email Security TrendAI™ Deep Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access Email Sensor TrendAI Vision One™ Mobile Security TrendAI™ Mobile Network Security Trend Cloud One - Cloud Sentry
actResult	`dynamic`	-	The result of an action	`Dropped` `Successful` `Accepted`	TrendAI™ Apex One as a Service TrendAI™ Cloud App Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TXOne Stellar (on-premises) TrendAI Vision One™ Mobile Security
aggregateFunction	`int`	-	The metric aggregator	`0 - sum` `1 - avg`	Data Detection and Response
aggregateUnit	`string`	-	The metric unit	`file`	Data Detection and Response
aggregatedCount	`string`	-	The number of aggregated events	`1` `2` `3`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TippingPoint Security Management System TrendAI™ Web Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne Stellar (on-premises) Data Detection and Response Trend Cloud One - Endpoint & Workload Security
appDexSha256	`string`	FileSHA2	The app dex encoded using SHA-256	`08736EDDD3682AC26D9FD42DA2A20B0BADB5C85A5456A0AE85B52D60C564F290`	TrendAI Vision One™ Mobile Security
appGroup	`string`	-	The app category of the event	`DNS Response` `HTTP` `CIFS`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
appIsSystem	`bool`	-	Whether the app is a system app	`false`	TrendAI Vision One™ Mobile Security
appLabel	`string`	-	The app name	`Mobile Security Virus Test Application`	TrendAI Vision One™ Mobile Security
appPkgName	`string`	-	The app package name	`com.example.app_pkg_name_file`	TrendAI Vision One™ Mobile Security
appPublicKeySha1	`string`	FileSHA1	The app public key (SHA-1)	`72080A6B4EB11105B28E31C4753BC91414500AD4`	TrendAI Vision One™ Mobile Security
appSize	`string`	-	The app size (in bytes)	`28461`	TrendAI Vision One™ Mobile Security
appVerCode	`int`	-	The app version code	`1`	TrendAI Vision One™ Mobile Security
application	`string`	-	The name of the requested application	`HyperText Transfer Protocol` `DoubleClick` `The Secure HyperText Transfer Protocol`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Zero Trust Secure Access Private Access TrendAI™ Apex One as a Service
aptCampaigns	`dynamic`	-	The related APT campaigns	`POSSIBLE LSTUDIO` `WEB LURKER`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
aptRelated	`string`	-	Whether the event is related to an APT	`0` `1`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
attachment	`dynamic`	-	The information about the email attachment	`{"attachmentFileTlsh": "", "attachmentFileName": "testfile.txt","attachmentFileHash": "","attachmentFileSize": "-1"}`	TrendAI™ Cloud App Security Email Sensor
attachmentFileHash	`string`	FileSHA1	The SHA-1 of the email attachment	`C9877617DB6715792F9D5C959C1E8D4E56D0C281` `0340A8EE3AD2990E3EDCDB2E471EAA45B4286722` `0E56D9540B07ED15EF745348D35C72A6A00A0BD9`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Email Sensor
attachmentFileHashMd5	`string`	FileMD5	The MD5 of the attached file (attachmentFileName)	`RSjbNuJB0hx39ZpzwLdipg==` `+TmuTNLw3FMQlaTbPwjD8g==` `+XWktHxXXdY0O4A82FQMzQ==`	TrendAI™ Cloud App Security
attachmentFileHashSha1	`string`	FileSHA1	The SHA-1 of the attached file (attachmentFileName)	`d63b1739a2fe56eb412dff1c69b76d4b9aad8ebd` `3b923d078ea3bd39489ed6d334c423e4478a8ee3` `3a2e6a64e1b7f4c6cbebcb9e949dc66b667cdfbe`	TrendAI™ Cloud App Security TrendAI™ Email Security
attachmentFileHashSha256	`string`	FileSHA2	The SHA-256 of the attached file (attachmentFileName)	`D81D4C14DDEB8CA390FFADA69265AAD46CDEDD72CDD332CB8AA17D924626B397` `01DE1FC697D2D0850F0468474A3E1E0BF4D78B23F0633908CF82E504E0DCBFF9` `02D16D9970AB635A7B05C3A268E23F5B41C419DD022F1054E9FD912BE130BDB0`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Email Security
attachmentFileHashes	`dynamic`	-	The SHA-1 of the email attachment	`056a2975edffe7188c03c324ae4335f9380b57e3` `05fd3ac8f9d8407e6637e0f91cd2ff5ab076658a`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
attachmentFileHashs	`dynamic`	-	The SHA-1 hash value of the attachment file	`056a2975edffe7188c03c324ae4335f9380b57e3` `05fd3ac8f9d8407e6637e0f91cd2ff5ab076658a`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
attachmentFileName	`dynamic`	FileName	The file name of an attachment	`Mail Body` `image001.png` `image002.png`	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor Email Sensor
attachmentFileSize	`string`	-	The file size of the email attachment	`190843` `104454` `112197`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Email Sensor
attachmentFileSizes	`dynamic`	-	The file size of email attachments	`190843` `104454` `112197`	Email Sensor
attachmentFileTlshes	`dynamic`	-	The TLSH of the email attachment	`0FE18E0807B75799EF3ADD7A98D62411FEB31DAB419C913C058068A3A6B33BD114EA39` `97D18E86E87A85D1D4137E6DA6FD00580E4CF06F65DB2B2937815E4F3A3013042A2189`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
attachmentFileTlshs	`dynamic`	-	The TLSH hash value of the attachment file	`0FE18E0807B75799EF3ADD7A98D62411FEB31DAB419C913C058068A3A6B33BD114EA39` `97D18E86E87A85D1D4137E6DA6FD00580E4CF06F65DB2B2937815E4F3A3013042A2189`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
attachmentFileType	`string`	-	The file type of the email attachment	`PDF` `TEXT` `PKZIP`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
authType	`string`	-	The authorization type	`Cookie JWT` `No Auth`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
azId	`string`	-	The virtual machine Availability Zone ID	`us-east-1b` `us-west-2a`	Trend Cloud One - Cloud Sentry
behaviorCat	`string`	-	The matched policy category	`Policy Enforcement` `Grey-Detection` `Threat-Detection`	TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
blocking	`string`	-	The blocking type	`Web reputation` `Web Server`	TrendAI™ Apex One as a Service
bmGroup	`string`	-	The one-to-many data structure	logGenLocalDatetime:2022-07-08T09:21:11+00:00, act:Assessment, behaviorType:Registry, riskConfidenceLevel:1, ruleId:7, ruleName:New Service, behaviorCategory:Policy Enforcement, processFilePath:C:\Windows\SysWOW64\srts\wmipr.exe, aegisOperation:Set Key, objectFilePath:HKLM\SYSTEM\CurrentControlSet\Services\DpsiBSvc\Start, policyId:007, objectFileHashSha1:null, objectCmd:null, processFileHashSha1:null, processCmd:null, objectRegistryData:null, objectRegistryKeyHandle:null, objectRegistryValue:null	TrendAI™ Apex One as a Service
botCmd	`string`	CLICommand	The bot command	`1068` `indows` `chrome.exe`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
botUrl	`string`	URL	The bot URL	`7?01` `0000` `indows`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
category	`string`	-	The event category	`Exploits` `Reconnaissance` `Vulnerabilities` `Security Policy`	TippingPoint Security Management System TrendAI™ Mobile Network Security Trend Cloud One - Endpoint & Workload Security
cccaDestination	`string`	URL	The destination domain, IP, URL, or recipient	`10.10.10.10:443` `www.example.dns04.com` `example.ru`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
cccaDestinationFormat	`string`	-	The C&C server access format	`IP_DOMAIN` `URL`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
cccaDetection	`string`	-	Whether this log is identified as a C&C callback address detection	`Yes`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
cccaDetectionSource	`string`	-	The list which defines this CCCA detection rule	`CCCA_GLOBAL_LIST (0)` `GLOBAL_INTELLIGENCE` `USER_DEFINED`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
cccaRiskLevel	`int`	-	The severity level of the threat actors associated with the C&C servers	`0` `1` `2`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
censusMaturityValue	`int`	-	The CENSUS maturity value	`0` `1` `2`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
censusPrevalenceValue	`int`	-	The CENSUS prevalence value	`0` `1` `2`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
channel	`string`	-	The channel through which the demanded Windows Event is delivered	`Local file or network drive` `Local file`	TrendAI™ Apex One as a Service
clientFlag	`string`	-	Whether the client is a source or destination	`dst` `src`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
clientIp	`dynamic`	-	The IP addresses of the source	`10.10.10.10`	TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Zero Trust Secure Access Private Access
clientStatus	`string`	-	The client status when the event occurred	`Rebuilding database` `Online` `Offline`	TrendAI™ Apex One as a Service
cloudAccountId	`string`	-	The AWS cloud account ID, Google Cloud product ID, or Azure subscription ID	`123456789012` `00000000-0000-0000-0000-000000000000` `ocid1.compartment.oc1..aaaaaaaa54yuau7prqquu3gqs4jcjzvz2yf7vwlqnkqlixq5tcjsdezqmyua`	Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
cloudAppCat	`string`	-	The category of the event in Cloud Reputation Service	`All` `Online Service` `Application Suite` `Business Intelligence and Analytics` `Cloud Computing Platform`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
cloudAppName	`string`	-	The cloud app name	`teams` `sharepoint` `exchange` `gmail`	TrendAI™ Cloud App Security
cloudMachineImageId	`string`	-	The cloud machine image ID	`ami-092d1c9fb626c2ba7` `3111106172944241000` `Oracle-Linux-9.5-aarch64-2025.05.19-0` `ubuntu_22_04_x64_20G_alibase_20250113.vhd`	Trend Cloud One - Cloud Sentry
cloudMachineImageName	`string`	-	The cloud machine image name	`Windows_Server-2022-English-Full-SQL_2022_Standard-2024.05.15` `https://www.googleapis.com/compute/v1/projects/debian-cloud/global/images/debian-12-bookworm-v20240617`	Trend Cloud One - Cloud Sentry
cloudProvider	`string`	-	The service provider of the cloud asset	`alibaba cloud` `aws` `azure` `gcp` `oci`	Trend Cloud One - Endpoint & Workload Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
cloudResourceDigest	`string`	-	The cloud resource digest	`sha256:e8759728bdf756c2546bf88d772634d4b746ba2be6da74cb68d2a75fb135e29e` `Z29gD6/9+UmEejeSqt4zcqux+1nNIRdGhoffijjkaBc=`	Trend Cloud One - Cloud Sentry
cloudResourceId	`string`	-	The cloud resource ID	`vol-00000000000000000` `123456789012.dkr.ecr.us-west-1.amazonaws.com/us-west-1-sentry-scan-samples-ecr` `arn:aws:lambda:us-east-1:000000000000:function:StackSet-SentrySetdb47aff3-cc084aaa-5-sideScanVuln-6Dyn7ZcwCSPw` `6132111784399111342` `us-east1-docker.pkg.dev/987654321012/ebsscan/ebsscanfunction@sha256:49eb55144d868a5bea1487e35837115f51eb158361c2c11beb6935667a04c489` `/subscriptions/bae4f362-e3a0-482f-ba7a-f883d8b410ce/resourceGroups/csf-test-data/providers/Microsoft.Compute/disks/csf-test-shared-ssd` `ocid1.volume.oc1.iad.abuwcljsobhbezpfpgajgxecncmdjxxq5yiyimx4tdtzm33gawvhvfvn62iq`	Trend Cloud One - Cloud Sentry
cloudResourceTags	`string`	-	The cloud resource tags	`-` `-` `-` `-`	Trend Cloud One - Cloud Sentry
cloudResourceType	`string`	-	The cloud resource type	`alibaba-cloud-repository-image` `azure-repository-image` `disk` `ebs-volume` `ecr-repository-image` `lambda-function` `lambda-layer` `google-cloud-repository-image` `oracle-cloud-repository-image`	Trend Cloud One - Cloud Sentry
cloudResourceVersion	`string`	-	The cloud resource version	`113`	Trend Cloud One - Cloud Sentry
cloudStorageName	`string`	-	The cloud storage name	`my-bucket`	Trend Cloud One – File Storage Security
clusterId	`string`	-	The cluster ID of the container	`ben_eks_test-20k90A3jGa4d3YMYfrdGIgs7g9u`	Trend Cloud One - Container Security
clusterName	`string`	-	The cluster name of the container	`ben_eks_test`	Trend Cloud One - Container Security
cnt	`string`	-	The total number of logs	`1` `2` `3`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TXOne EdgeOne (on-premises) TrendAI™ Mobile Network Security
compressedFileHash	`string`	FileSHA1	The SHA-1 of the decompressed archive	`6E2ECB34B7798E179CC704111FB9733FBAAD5ACA` `FA71B59F35F0EE44D27F74917EF5A0DA2797E80B` `14D2302172EB81465CE12E01361AE24CDE170F7B`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service Trend Cloud One - Cloud Sentry
compressedFileHashSha256	`string`	FileSHA2	The SHA-256 of the compressed suspicious file	`60C7C5924DD09F7C6B150120FB92DCEE00AE82DB75C7402FA4D9152CF487A94F` `482FFC4F87B78C3C7073983CF65B593D9F13F0A3D6DC54B4A3F616F79838F3CE` `68C0126D9B4B0FC32DE181D0D67DA8FE82E23745F6023317D5E053B6F6ED26CF`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service Trend Cloud One - Cloud Sentry
compressedFileName	`string`	FileName	The file name of the compressed file	`/proc/32058/fd/150` `NONAMEFL` `/proc/10006/fd/30` `VirusActionSample/RPF2_OtherMalwareSample-other.exe`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Endpoint & Workload Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
compressedFileSize	`string`	-	The file size of the decompressed archive file	`0` `265314` `175864`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security
compressedFileType	`string`	-	The file type of the decompressed archive file	`EXE` `JAVA` `PDF`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
computerDomain	`string`	-	The computer domain	`COMCEL_DOMINIO` `HDWA` `RANDON`	TrendAI™ Apex One as a Service
containerId	`string`	-	The Kubernetes container ID	`4102001853b8`	Trend Cloud One - Container Security
containerImage	`string`	-	The Kubernetes container image	`dockerhub.io/ubuntu:latest`	Trend Cloud One - Container Security
containerImageDigest	`string`	-	The Kubernetes container image digest	`sha256:626ffe58f6e7566e00254b638eb7e0f3b11d4da9675088f4781a50ae288f3322`	Trend Cloud One - Container Security
containerName	`string`	-	The Kubernetes container name	`k8s_ubuntu_ubuntu-ds-fp2jk_default_00000000-0000-0000-0000-000000000000_2`	Trend Cloud One - Container Security
correlatedIntelligence	`dynamic`	-	The Correlated Intelligence detection	{"risk_type": "Anomaly","matched_rules": [{"threat_type": "Possibly Unwanted Email","matched_filters": [{"id":"FIL013", "name": "Marketing Email Traits"},{"id":"FIL098", "name": "Infrequent Sender Email Domain"}],"name": "Possibly Unwanted Marketing Email","id": "AN004"}]}	TrendAI™ Email Security Email Sensor
correlationCat	`string`	-	The correlation category	`Suspicious Traffic` `Authentication` `Reconnaissance`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
customAssetTags	`dynamic`	-	The list of custom asset tags	`{"os":["linux", "windows"], "org":["bu1"]}`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service Trend Cloud One - Container Security
customTags	`dynamic`	-	The event tags	`network` `mitre_discovery`	Trend Cloud One - Container Security TrendAI Vision One™ File Security
cve	`string`	-	The CVE identifier	`MS17-010` `CVE-2021-45046` `CVE-2021-44228`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
cves	`dynamic`	-	The CVEs associated with this filter	`CVE-2014-3567` `CVE-2016-6304` `CVE-2011-1385`	TippingPoint Security Management System Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor
dOSClass	`string`	-	The destination device OS class	`Linux`	TrendAI™ Mobile Network Security
dOSName	`string`	-	The destination host OS	`Windows` `Windows 10` `Android`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Mobile Network Security
dOSVendor	`string`	-	The destination device OS vendor	`Others`	TrendAI™ Mobile Network Security
dUser1	`string`	UserAccount	The latest sign-in user of the destination	`user\example`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
dacDeviceType	`string`	-	The device type	`USB storage device` `Mobile devices` `Floppy disks` `Network driver`	TrendAI™ Apex One as a Service
data0	`string`	-	The value of the Deep Discovery Inspector correlation log	`1` `USR_SUSPICIOUS_IP.UMXX` `USR_SUSPICIOUS_URL.UMXX`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data0Name	`string`	-	The name of the Deep Discovery Inspector correlation log	`Malware Name` `Attacked this IP` `IP Address under Attack`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data1	`string`	-	The Deep Discover Inspector correlation log metadata	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data1Name	`string`	-	The name of the Deep Discovery Inspector correlation log	`Port Used` `Malicious File Transferred To This IP Address` `Malware Server IP Address`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data2	`string`	-	The value of the Deep Discovery Inspector correlation log	`1` `10003` `2`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data2Name	`string`	-	The name of the Deep Discovery Inspector correlation log	`Number of Malware Files Downloaded` `Protocol`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data3	`string`	-	The value of the Deep Discovery Inspector correlation log	`1` `10.10.10.10` `23903`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
data4	`string`	-	The value of the Deep Discovery Inspector correlation log	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
dceArtifactActions	`dynamic`	-	The actions performed on Damage Cleanup Engine artifacts	`folder_backup` `objproc_dump` `subproc_dump`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
dceHash1	`string`	-	Whether the TrendAI™ Threat Mitigation Server requires the log	`0`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
dceHash2	`string`	-	Whether the TrendAI™ Threat Mitigation Server requires the log	`0`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListFileHash	`string`	FileSHA1	The SHA-1 of the Virtual Analyzer Suspicious Object	`746C4D6048A409F33446463B28CA21CB2C5DD941` `DAA66CE3C1F08144885BB0E99837030C5231DE60`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListFileHashSha256	`string`	-	The SHA-256 of User-Defined Suspicious Object	`757E5C8823CAA7406030A7E26AED2A2C95D16F69C5A14C884C8CAA72A0C001C3`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListHost	`string`	DomainName	The domain of the Virtual Analyzer Suspicious Object	`www.example.dns01.com` `example.com`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListIp	`dynamic`	IPv4 IPv6	The IP of the Virtual Analyzer Suspicious Object	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListRequest	`string`	-	The block list event request	`*` `test.url.com` `https://example.com:443/gfx/flags/ua.png`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
denyListType	`string`	-	The block list type	`Deny List URL` `Deny List File SHA1`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
destinationPath	`string`	-	The intended destination of the file containing the digital asset or channel	`Cloud Storage (OneDrive)` `Printer` `example.sharepoint.com/personal/page_path/onedrive.aspx`	TrendAI™ Apex One as a Service
detectedActions	`dynamic`	-	The actions performed on detected artifacts	`folder_backup` `objproc_dump` `subproc_dump`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
detectedBackupArtifacts	`dynamic`	-	The information about detected artifacts	`{"objectArtifactId": "025d9f2a-ac9c-4cdf-b9e4-cf20c6e40281_0.dmp", "action": "object_process_dump", "status": 0, "processCreationTime": "1627574338077", "processImageFileName": "C:\Program Files\aaa\bbb\objprocess.exe"}`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
detectedBackupArtifactsStatus	`dynamic`	-	The backup status of detected artifacts	`-`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
detectedBackupFolder	`string`	-	The folder path for detected backup folders	`C:\\Program Files (x86)\\TrendAI™\\artifact\\DCE`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service XDR Endpoint Sensor
detectedPattern	`string`	-	The detected pattern	`dct.virus`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
detectionAggregationId	`string`	-	The correlation key for detection logs and artifacts	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	XDR Endpoint Sensor
detectionAggregationIds	`dynamic`	-	The list of detection aggregation IDs	`-`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
detectionDetail	`string`	-	The details about each event type	`{}` `{"detail":"4.7.1 \u003csample_email@trendmicro.com\u003e: Recipient address rejected: Ratelimit-2"}` `{"detail":"4.7.1 \u003csample_email@trendmicro.com.br\u003e: Recipient address rejected: Ratelimit-2"}`	TrendAI™ Email Security
detectionEngineVersion	`string`	-	The detection engine version	`7.6.0`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
detectionFileList	`dynamic`	-	The information about the related files	`{"fileName": "sample.txt", "edgeId": "00000000-0000-0000-0000-000000000000"}`	Data Detection and Response
detectionMeta	`dynamic`	-	The descriptions of the detected techniques	`-`	TrendAI™ Apex One as a Service TrendAI™ Apex One Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
detectionName	`string`	-	The general name for the detection	`Troj.Win32.TRX.XXPE50F13017` `Troj.Win32.TRX.XXPE50FFF059`	TrendAI™ Apex One as a Service TrendAI Vision One™ Mobile Security
detectionNames	`dynamic`	-	The rules that triggered the event	`-`	TrendAI™ Apex One as a Service TrendAI™ Apex One Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
detectionType	`string`	-	The detection type	`1` `File` `Process` `net`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Web Security TrendAI™ Apex One as a Service TrendAI™ Cloud App Security TrendAI™ Deep Security TrendAI™ Email Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security
deviceDirection	`string`	-	The device direction	`outbound` `inbound`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security
deviceGUID	`string`	-	The GUID of the agent which reported the detection	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TippingPoint Security Management System XDR Endpoint Sensor Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
deviceMacAddress	`string`	-	The device MAC address	`00:00:00:00:00:00` `ff:ff:ff:ff:ff:ff`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
deviceModel	`string`	-	The device model number	`c96a`	TrendAI™ Apex One as a Service
devicePayloadId	`string`	-	The device payload ID	`0:14343219::F:S` `0:94174860::F:` `0:9665982::F:`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
deviceSerial	`string`	-	The device serial ID	`000000063a2e8f`	TrendAI™ Apex One as a Service
dhost	`string`	DomainName	The destination hostname	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Mobile Network Security
direction	`string`	-	The direction	`Incoming` `Outgoing` `Unknown`	TrendAI™ Apex One as a Service TXOne EdgeOne (on-premises)
diskPartitionId	`string`	-	The cloud volume partition ID	`0` `1` `2`	Trend Cloud One - Cloud Sentry
dmac	`string`	-	The MAC address of the destination IP (dest_ip)	`00:00:00:00:00:00` `ff:ff:ff:ff:ff:ff`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TXOne EdgeOne (on-premises)
domainName	`string`	DomainName	The detected domain name	`http://10.10.10.10` `example.domain.com`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Cloud App Security
dpt	`int`	Port	The destination port	`0` `445` `80`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TippingPoint Security Management System TrendAI™ Deep Security Trend Cloud One - Network Security XDR Endpoint Sensor TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security TrendAI™ Mobile Network Security
dst	`dynamic`	IPv4 IPv6	The destination IP	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TippingPoint Security Management System TrendAI™ Deep Security Trend Cloud One - Network Security XDR Endpoint Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security TrendAI™ Mobile Network Security
dstEquipmentId	`string`	-	The destination IMEI	`350548054087659`	TrendAI™ Mobile Network Security
dstFamily	`string`	-	The destination device family	`Computer`	TrendAI™ Mobile Network Security
dstGroup	`string`	-	The group name defined by the administrator of the destination	`Default` `Data Center Services DL_Deployed Block` `Rede Wifi Visitantes-Pacientes`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Mobile Network Security
dstLocation	`string`	-	The destination country	`JP`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
dstSubscriberDirNum	`string`	-	The destination MSISDN	`8618687654321`	TrendAI™ Mobile Network Security
dstSubscriberId	`string`	-	The destination IMSI	`466686007810478`	TrendAI™ Mobile Network Security
dstType	`string`	-	The destination device type	`Desktop/Laptop`	TrendAI™ Mobile Network Security
dstZone	`string`	-	The network zone defined by the destination administrator	`1` `0` `2`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
duration	`string`	-	The detection interval (in milliseconds)	`300000`	Data Detection and Response
duser	`dynamic`	EmailRecipient	The email recipient	`(no user)` `SYSTEM` `SYSTEM`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Email Sensor
dvc	`dynamic`	-	The Deep Discovery Inspector appliance IP	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
dvchost	`string`	-	The computer which installed the TrendAI™ product	`CU-PRO1-9039-2` `LTPF32PMNN`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
endTime	`long`	-	The time when the last event was received (in Unix milliseconds)	`1750983926000`	Trend Cloud One - Endpoint & Workload Security
endpointGUID	`string`	EndpointID	The GUID of the agent which reported the detection	`ae4d64aa-f8b8-bb36-b265-f59272ed342f` `8fb979f6-1376-bed3-227f-f2886e66194e` `ca2b3a7e-8415-c571-cc19-e45f69470026`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security XDR Endpoint Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access TXOne Stellar (on-premises) Trend Cloud One - Container Security Data Detection and Response
endpointHostName	`string`	EndpointName	The endpoint hostname or node where the event was detected	`10.10.10.10 (swpos-aws-aza02) [i-0f0f0f0f0f0f0f0f0]` `ip-10-10-10-10.us-west-1.compute.internal`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Apex One as a Service XDR Endpoint Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access TXOne Stellar (on-premises) Trend Cloud One - Container Security Trend Cloud One - Cloud Sentry Data Detection and Response
endpointIp	`dynamic`	IPv4 IPv6	The IP address of the endpoint on which the event was detected	`10.10.10.10`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Apex One as a Service TippingPoint Security Management System Trend Cloud One - Network Security TXOne EdgeOne (on-premises) Trend Cloud One - Cloud Sentry Data Detection and Response
endpointMacAddress	`string`	-	The endpoint MAC address	`00:00:00:00:00:00` `ff:ff:ff:ff:ff:ff`	TrendAI™ Apex One as a Service TXOne EdgeOne (on-premises) TXOne Stellar (on-premises)
endpointModel	`string`	-	The mobile device model	`M2101K9G`	TrendAI Vision One™ Mobile Security
engType	`string`	-	The engine type	`Virus Scan Engine (Windows XP/Server 2003, x64)` `Virus Scan NT Kernel Engine` `Spyware/Grayware Scan Engine v.6 (64-bit)`	TrendAI™ Apex One as a Service TrendAI Vision One™ File Security
engVer	`string`	-	The engine version	`1.0.0.1123_1.0.0.1101` `9.0.1004` `22.540.1001`	XDR Endpoint Sensor TrendAI™ Cloud App Security TrendAI™ Apex One as a Service TrendAI Vision One™ File Security
engineOperation	`string`	-	The operation of the engine event	`Set Key` `Invoke API` `Create`	TrendAI™ Apex One as a Service XDR Endpoint Sensor
eventClass	`string`	-	The event category	`Suspicious Traffic` `Authentication` `Reconnaissance`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
eventId	`string`	-	The event ID from the logs of each product	`100100` `100101` `100116` `100117` `100119`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI™ Cloud App Security XDR Endpoint Sensor TrendAI™ Email Security TXOne Stellar (on-premises) Trend Cloud One - Container Security Email Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry TrendAI Vision One™ Mobile Security TrendAI™ Mobile Network Security Data Detection and Response
eventName	`string`	-	The event type	`LOG_INSPECTION_EVENT` `SECURITY_RISK_DETECTION` `WEB_THREAT_DETECTION` `LOG_INSPECTION_EVENT` `MALWARE_DETECTION` `PROCESS_ACTIVITY` `WEB_POLICY_VIOLATION` `DEEP_PACKET_INSPECTION_EVENT` `INTEGRITY_MONITORING_EVENT` `DISRUPTIVE_APPLICATION_DETECTION` `PRODUCT_SUMMARY` `PRODUCT_UPDATE` `BEHAVIORAL_VIOLATION` `FIREWALL_POLICY_VIOLATION` `SUSPICIOUS_BEHAVIOUR_DETECTION` `DENYLIST_CHANGE` `MACHINE_LEARNING_DETECTION` `DLP_VIOLATION` `MALWARE_OUTBREAK_DETECTION` `SENSITIVE_DATA_DETECTION`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TippingPoint Security Management System TrendAI™ Cloud App Security TrendAI™ Email Security XDR Endpoint Sensor Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access TXOne Stellar (on-premises) Email Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry TrendAI Vision One™ Mobile Security TrendAI™ Mobile Network Security Data Detection and Response
eventSubClass	`string`	-	The event sub-class	`DNS` `Port Mis-use` `Port Scanning`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
eventSubId	`int`	-	The access type	`4` `101` `102`	Trend Cloud One - Endpoint & Workload Security TXOne Stellar (on-premises)
eventSubName	`string`	-	The event type sub-name	`IPS Detection` `Personal Firewall` `Attack Discovery`	TrendAI™ Apex One as a Service TrendAI™ Cloud App Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Email Security XDR Endpoint Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access Trend Cloud One - Cloud Sentry
extraInfo	`dynamic`	-	The network application name	`N/A` `Web Client Common` `DCERPC Services`	TrendAI™ Apex One as a Service
fileCreation	`string`	-	The file creation date	`1595918517000`	TrendAI™ Apex One as a Service
fileDesc	`string`	-	The file description	`Atualiza PJRO` `Carpeta de archivos` `7z Setup SFX (x86)`	TrendAI™ Apex One as a Service Trend Cloud One - Container Security
fileExt	`string`	-	The file extension of the suspicious file	`.lnk` `.exe` `.EXE`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
fileHash	`string`	FileSHA1	The SHA-1 of the file that triggered the rule or policy	`DA39A3EE5E6B4B0D3255BFEF95601890AFD80709` `89CE26EAD139D52B8A6B61BFFC6AF89AF246580F` `3AD1F4E7CAA11E5199EE80B8983677ADDD065450`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry Data Detection and Response
fileHashMd5	`string`	FileMD5	The MD5 of the file	`d5120786925038601a77c2e1eB9a3a0a`	Palo Alto Networks Next-Generation Firewalls
fileHashSha256	`string`	FileSHA2	The SHA-256 of the file (fileName)	`6A6EB2D717CEA041B4444193B45EDFB6CA1287518203B7230B3C4B8FFB031EAB` `BFF703FF836196644586014DA13A097C2EE9A08E4D596DFB7C8E0F685FE01294` `12327F460AC9CBBC34D39EB3CF89C7FECCA37F08773A04566840F73F6ECC4104`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI Vision One™ Zero Trust Secure Access Internet Access Trend Cloud One - Endpoint & Workload Security TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
fileName	`dynamic`	FileName	The file name	`spoolss` `hosts` `svcrestarttask`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne Stellar (on-premises) TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
fileOperation	`string`	-	The operation of the file	`Created` `Updated` `Deleted`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
filePath	`string`	FileFullPath	The file path without the file name	`security` `/var/log/audit/audit.log` `application`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor TXOne Stellar (on-premises) TrendAI Vision One™ File Security Trend Cloud One – File Storage Security
filePathName	`string`	FileFullPath	The file path with the file name	`vss` `spoolss` `/etc/hosts`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TXOne Stellar (on-premises)
fileSize	`string`	-	The file size of the suspicious file	`0` `1255856` `1237880`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI™ Apex One as a Service TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
fileSystemUuid	`string`	-	The file system UUID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	Trend Cloud One - Cloud Sentry
fileType	`string`	-	The file type of the suspicious file	`EXE` `LNK` `MIME`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
fileVer	`string`	-	The file version	`10.0.19041.1` `10.0.19041.1766` `10.0.18362.1`	TrendAI™ Apex One as a Service
filterName	`string`	-	The filter name	`ConnectionFilter` `Virtual Analyzer` `Data Loss Prevention`	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Apex One as a Service TXOne EdgeOne (on-premises)
filterRiskLevel	`string`	-	The top level filter risk of the event	`info` `low` `medium`	All products TrendAI™ Deep Discovery Inspector Virtual Network Sensor
filterType	`string`	-	The filter type	`Spam filter` `Size filter`	TrendAI™ Apex One as a Service TXOne EdgeOne (on-premises)
firmalware	`dynamic`	-	The Deep Discovery Inspector firmware version	`2017-12-01 15:05:07-05:00 3.83.1170 5.0.1555` `2020-11-13 18:04:29-05:00 5.0.1555 5.5.1200` `2020-11-13 18:43:30-05:00 5.5.1200 5.7.1178`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
firstAct	`string`	-	The first scan action	`Pass` `Quarantine` `Clean`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security
firstActResult	`string`	-	The first scan action result	`File passed` `Unable to quarantine file` `File quarantined`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security
firstSeen	`string`	-	The first time the XDR log appeared	`1657195233000`	TrendAI™ Cloud App Security TXOne Stellar (on-premises) Data Detection and Response
flowId	`string`	-	The connection ID	`6717474604962545666` `6915244861077872618` `6915244908215815814`	XDR add-on: Deep Discovery Inspector
forensicFileHash	`string`	-	The hash value of the forensic data file	`177844c5927d0f20da06d79d986c7e7f8c7a3b6a` `da39a3ee5e6b4b0d3255bfef95601890afd80709` `8dab234ab6cd96301f9452994f015a449d629edd`	TrendAI™ Apex One as a Service
forensicFilePath	`string`	-	The file path of the forensic file	`C:\Program Files (x86)\TrendAI™\OfficeScan Client\dlplite\forensic\frnsc_200411DC0594_xml_00000000000_20220314_132326281` `C:\Program Files (x86)\TrendAI™\OfficeScan Client\dlplite\forensic\frnsc_CIL-OPRCOGEN_docx_00000000000_20211025_225445873` `C:\Program Files (x86)\TrendAI™\OfficeScan Client\dlplite\forensic\frnsc_SHA-ESHOU_h265_00000000000_20220601_082417865`	TrendAI™ Apex One as a Service
ftpUser	`string`	-	The FTP sign-in user name	`USER\TREND` `User` `ftpuser_service`	TrendAI™ Apex One as a Service
fullPath	`string`	FileFullPath	The combination of the file path and the file name	`\etc\hosts` `c:\windows\system32\tasks\microsoft\windows\softwareprotectionplatform\svcrestarttask` `\var\log\auth.log`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TXOne Stellar (on-premises) TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
groupId	`string`	-	The group ID for the management scope filter	`00000000-0000-0000-0000-000000000000`	All products
groups	`string`	-	The OSSEC rule group names	`auditd,audit,` `dirservice_log,authentication_failure,` `windows,authentication_failures,`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
hasdtasres	`string`	-	Whether the log contains a report from Virtual Analyzer	`No` `Yes`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
highlightMailMsgSubject	`string`	-	The email subject	`Delivery Status` `Undelivered Mail Returned to Sender` `Successful Mail Delivery Report`	TrendAI™ Email Security
highlightedFileHashes	`dynamic`	FileSHA1	The SHA-1 hashes of the highlighted file	`C9877617DB6715792F9D5C959C1E8D4E56D0C281` `0340A8EE3AD2990E3EDCDB2E471EAA45B4286722` `0E56D9540B07ED15EF745348D35C72A6A00A0BD9`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
highlightedFileName	`dynamic`	-	The file names of suspicious attachments	`detect_me.zip` `covid.zip`	TrendAI™ Cloud App Security Email Sensor
hostName	`string`	DomainName HostDomain	The computer name of the client host (The hostname from the suspicious URL detected by Deep Discovery Inspector)	`Let's Encrypt` `10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TXOne EdgeOne (on-premises)
hostSeverity	`int`	-	The severity of the threat (specific to the interestedIp)	`1` `2` `4`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
hotFix	`dynamic`	-	The applied Deep Discovery Inspector hotfix version	`2021-07-22 15:08:01+08:00 Hotfix 1042 hfb1042 Apply` `2021-12-22 09:03:42-06:00 Hotfix 1211 hfb1211 Apply` `2022-03-30 13:16:28-07:00 Hotfix 1218 hfb1218 Apply`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
httpReferer	`string`	URL	The HTTP referer	`http://172.16.58.233/` `http://example/page1/` `https://www.google.com/`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
icmpCode	`int`	-	The ICMP protocol code field	`0`	TrendAI™ Mobile Network Security
icmpType	`int`	-	The ICMP protocol type	`0` `3`	TrendAI™ Mobile Network Security
instanceId	`string`	-	The ID of the instance that indicates the meta-cloud or data center VM	`52294e7b-f732-c6e9-b2c3-7a6b6f50d101` `00030912-c5e7-4348-9012-7c684751c531` `0008ae58-db0c-34ee-3e5c-5dfc9b10a739` `i-0b22a22eec53b9321` `/subscriptions/bae4f362-e3a0-482f-ba7a-f883d8b410ce/resourceGroups/avtd-csf-sg-lzniibr0/providers/Microsoft.Compute/virtualMachines/avtd-csf-scanner-lzniibr0` `ocid1.instance.oc1.us-ashburn-1.an2g6ljrgs553pqcjuokzvvwpmwxh564f6f5sx3jpi2sowt6as44uejmsrzq`	TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security Trend Cloud One - Cloud Sentry TrendAI™ Mobile Network Security
instanceName	`string`	-	The name of the instance that indicates the meta-cloud or data center VM	`instapecot-1`	TrendAI™ Mobile Network Security
integrityLevel	`int`	-	The integrity level of a process	`16384`	XDR Endpoint Sensor
interestedGroup	`string`	-	The network group associated with the user-defined source IP or destination IP	`Default` `Rede DATACENTER Lumen/FORTIGATE - AD ESTACIO CORP` `Data Center Services DL_Deployed Block`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
interestedHost	`string`	DomainName	The endpoint hostname	`10.10.10.10 (swpos-aws-aza02) [i-0f0f0f0f0f0f0f0f0]` `es-dtc-w-dc02.example.corp`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service
interestedIp	`dynamic`	IPv4 IPv6	The IP of the interestedHost	`10.10.10.10`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service TippingPoint Security Management System Trend Cloud One - Network Security TXOne EdgeOne (on-premises)
interestedMacAddress	`string`	-	The log owner MAC address	`00:00:00:00:00:00` `ff:ff:ff:ff:ff:ff`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor TXOne EdgeOne (on-premises)
ircChannelName	`string`	-	The IRC channel name	`ManageEngine` `unknown` `Global Product Delivery Group`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
ircUserName	`string`	-	The IRC user name	`R3` `ManageEngineCA` `DigiCert TLS RSA SHA256 2020 CA1`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
isEntity	`string`	-	The current entity (or after change/modification)	`{"key":"<example>","type":"Service","attributes":[{"friendlyValue":null,"name":"binaryPathName","value":"C:\\Windows\\system32\\vssvc.exe"},{"friendlyValue":"manual","name":"startType","value":"3"},{"friendlyValue":"running","name":"state","value":"4"}]}` `{"key":"<example>":"Service","attributes":[{"friendlyValue":null,"name":"binaryPathName","value":"C:\\Windows\\system32\\vssvc.exe"},{"friendlyValue":"manual","name":"startType","value":"3"},{"friendlyValue":"stopped","name":"state","value":"1"}]}` `{"key":"<example>","type":"File","attributes":[]}`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
isHidden	`string`	-	Whether the detection log generated a grey rule match	`Yes`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service
isPrivateApp	`bool`	-	Whether the requested application is private	`true` `false`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
isProxy	`bool`	-	Whether something is a proxy	`false`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
isRetroScan	`bool`	-	Whether the event matches the Security Analytics Engine filter	`true`	All products
ja3Hash	`string`	-	The fingerprint of an SSL/TLS client application as detected via a network sensor or device	`72a589da586844d7f0818ce684948eea` `cd08e31494f9531f560d64c695473da9` `6dca00d8741247e245e4f2a632f1e62b`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
ja3sHash	`string`	-	The fingerprint of an SSL/TLS server application as detected via a network sensor or device	`e54965894d6b45ecb4323c7ea3d6c115` `ec74a5c51106f0419184d0dd08fb05bc` `ba1b42efc7dc57bb43bf81de59791c1b`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
k8sNamespace	`string`	-	The Kubernetes namespace of the container	`default`	Trend Cloud One - Container Security
k8sPodId	`string`	-	The Kubernetes pod ID of the container	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	Trend Cloud One - Container Security
k8sPodName	`string`	-	The Kubernetes pod name of the container	`ubuntu-ds-fp2jk`	Trend Cloud One - Container Security
lastSeen	`string`	-	The last time the XDR log appeared	`1657195233000`	TrendAI™ Cloud App Security TXOne Stellar (on-premises) Data Detection and Response
lineageId	`string`	-	The lineage ID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	Data Detection and Response
logKey	`string`	-	The unique key of the event	`123e4567-e89b-12d3-a456-426614174000` `987f6543-21ba-43cd-9e8f-123456789abc` `456789ab-cdef-1234-5678-9abcdef01234`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI™ Cloud App Security TrendAI™ Email Security TippingPoint Security Management System XDR Endpoint Sensor TrendAI™ Web Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
logReceivedTime	`long`	-	The time when the XDR log was received	`1656324260000`	All products
logonUsers	`dynamic`	-	The telemetry events that match the Security Analytics Engine filter, and logonUsers stores the logonUsers value of the original events	`BHBShortJ`	All products Data Detection and Response
mDevice	`dynamic`	-	The source IP	`10.10.10.10` `fe80::1234:5678:9abc:def0`	TrendAI™ Apex One as a Service
mDeviceGUID	`string`	-	The GUID of the agent host	`C5B09EDD-C725-907F-29D9-B8C30D18C48F` `C05B75AB-B518-BDD0-D2B5-E9CB631C539F` `9C28ACD3-D0EC-22A4-B08D-5B0BEFF501FC`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security
mailDeliveryTime	`string`	-	The mail delivery time	`1900-1-1 00:00:00`	TrendAI™ Apex One as a Service
mailFolder	`string`	-	The email folder name	`CATEGORY_PROMOTIONS, UNREAD, INBOX` `UNREAD, CATEGORY_PERSONAL, INBOX` `UNREAD, CATEGORY_UPDATES, INBOX`	TrendAI™ Cloud App Security
mailMsgId	`string`	-	The internet message ID of the email	`<sample_email@trendmicro.com>`	TrendAI™ Cloud App Security
mailMsgSubject	`string`	EmailSubject	The email subject	`FW. mail subject` `ManageEngine`	TrendAI™ Cloud App Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Email Security TrendAI™ Apex One as a Service Email Sensor
mailReceivedTime	`string`	-	The mail received timestamp	-	TrendAI™ Cloud App Security TrendAI™ Email Security
mailSmtpFromAddresses	`dynamic`	-	The envelope address of the sender	`sample_email@trendmicro.com`	TrendAI™ Email Security
mailSmtpHelo	`string`	-	The domain name of the email server by using the SMTP HELO command	`example.com`	TrendAI™ Email Security
mailSmtpOriginalRecipients	`dynamic`	-	The envelope addresses of the original recipients	`sample_email@trendmicro.com`	TrendAI™ Email Security
mailSmtpRecipients	`dynamic`	-	The envelope addresses of the current recipients	`sample_email@trendmicro.com`	TrendAI™ Email Security
mailSmtpTls	`string`	-	The SMTP TLS version	`noTLS` `TLS 1.2` `TLS 1.3`	TrendAI™ Email Security
mailUniqueId	`string`	-	The unique ID of the email	`example_unique_id_1` `example_unique_id_2` `example_unique_id_3`	TrendAI™ Cloud App Security
mailbox	`string`	-	The mailbox that is protected by TrendAI™	`sample_email@trendmicro.com`	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI Vision One™ Mobile Security Email Sensor
majorVirusType	`string`	-	The virus type	`Virus` `Suspicious Activity` `Trojan` `TROJ`	TrendAI™ Deep Security Trend Cloud One - Endpoint & Workload Security TrendAI Vision One™ Mobile Security TXOne EdgeOne (on-premises) TXOne Stellar (on-premises) Trend Cloud One – File Storage Security
malDst	`string`	-	The malware infection destination	`3334_02W3P7` `2666_02N413` `3334_02NHEL`	TrendAI™ Apex One as a Service
malFamily	`string`	-	The threat family	`EQUATED` `STARTER` `0`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TrendAI Vision One™ File Security
malName	`string`	-	The name of the detected malware	`SecurityLevelDrop` `Regla Logs All` `USR_SUSPICIOUS_DOMAIN.UMXX`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Web Security TXOne Stellar (on-premises) Email Sensor TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
malSrc	`string`	FileFullPath	The malware infection source	`\\10.172.1.33\kortiz` `\\10.240.0.148\wbind` `\\10.240.1.69\MT26933059`	TrendAI™ Apex One as a Service TrendAI™ Mobile Network Security
malSubType	`string`	-	The virus sub-type	`Unknown`	TrendAI™ Apex One as a Service TrendAI Vision One™ File Security
malType	`string`	-	The risk type for Network Content Correlation Engine rules	`OTHERS` `MALWARE` `Others`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI Vision One™ File Security Trend Cloud One - Container Security
malTypeGroup	`string`	-	The risk type group for Network Content Correlation Engine rules	`Others` `Malware` `Spyware`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI Vision One™ File Security
matchedContent	`dynamic`	-	The one-to-many data structure	`-` `-`	TrendAI™ Apex One as a Service
matchedPolicies	`dynamic`	-	The matched policies of detection records	`-`	Data Detection and Response
mimeType	`string`	-	The MIME type or content type of the response body	`application/octet-stream` `application/json; charset=utf-8` `application/json`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
minorVirusType	`string`	-	The minor virus type	`RANSOMWARE` `BANKER` `CREDENTIAL`	TrendAI Vision One™ Mobile Security
mitigationTaskId	`string`	-	The unique ID to identify the mitigation request	`09dcd06f-2f9c-4bab-8114-f823620fecb6` `0ed72c3c-05af-4c16-b2c4-789eaeccb944` `0f29cfc3-954a-4fd9-954e-bf14f7253d20`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
mitreMapping	`dynamic`	-	The MITRE tags	`T1090 (TA0011)` `T1071 (TA0011)` `T1071.001 (TA0011)`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
mitreVersion	`string`	-	The MITRE version	`v9` `v6`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
moduleScanType	`string`	-	The module scan type	`traditional`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
mpname	`string`	-	The management product name	`Cloud One - Workload Security` `Apex Central` `Deep Security Software`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security TippingPoint Security Management System XDR Endpoint Sensor Trend Cloud One - Network Security
mpver	`string`	-	The product version	`Microsoft-Windows-Security-Auditing` `Level -- Medium security` `TASK1`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Apex One as a Service XDR Endpoint Sensor
msgAct	`string`	-	The message action	`Quarantine` `Deliver`	TrendAI™ Apex One as a Service
msgId	`string`	EmailMessageID	The internet message ID	`66.6.00.0006` `example.test.com` `dameware1svr`	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Email Sensor
msgTOCUuid	`string`	-	The email unique ID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Cloud App Security TrendAI™ Email Security
msgUuid	`string`	-	The unique email ID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
msgUuidChain	`string`	-	The message UUID chain	`00027ac3-f8f2-cc8f-d078-3a57f12f3d55;00027ac3-f8f2-cc8f-d078-3a57f12f3d55` `0005ab64-3992-644c-3592-503c3610cec9;0005ab64-3992-644c-3592-503c3610cec9` `00062621-fec4-9e4d-7609-25b2b3189214;00062621-fec4-9e4d-7609-25b2b3189214`	TrendAI™ Email Security
netBiosDomainName	`string`	DomainName	The NetBIOS domain name	`TREND`	Microsoft Active Directory
objectActions	`dynamic`	-	The object process actions	`ProcessDump` `FileCollection`	XDR Endpoint Sensor
objectApiName	`string`	-	The API name	`GetIpNetTable`	XDR Endpoint Sensor
objectArtifactIds	`dynamic`	-	The artifact IDs generated by objectAction	`00000000-0000-0000-0000-000000000000_0.dmp` `11111111-1111-1111-1111-111111111111_2.bak`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
objectAttributes	`string`	-	The object attributes	`attribute`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
objectCmd	`dynamic`	CLICommand	The object process command line	`C:\WINDOWS\system32\wbem\wmiprvse.exe -Embedding` `"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -NoLogo -Noninteractive -NoProfile -ExecutionPolicy Bypass "& 'C:\WINDOWS\CCM\SystemTemp\afd6f0e5-e491-4764-a20a-9f1d9edf3cce.ps1'"` `C:\WINDOWS\system32\lsass.exe`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor
objectEntityName	`string`	-	The object entity name	`any_process` `exe_file` `powershell`	TrendAI™ Apex One as a Service
objectFileAccess	`string`	-	The object file access details	`1717658631000`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
objectFileCreation	`string`	-	The UTC time that the object was created	`2014-11-22T01:45:51-06:00` `2009-07-13T23:31:13-05:00` `2014-11-21T02:43:28-05:00`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
objectFileHashMd5	`string`	FileMD5	The MD5 of the object	`801E8003C257C8F540B20F1E0DECD3A6` `CDA48FC75952AD12D99E526D0B6BF70A` `D5120786925038601A77C2E1EB9A3A0A`	TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security
objectFileHashSha1	`string`	FileSHA1	The SHA-1 of the objectFilePath object	`51B8646308EE0B68AD1F7F1291B85395434DE49A` `36C5D12033B2EAF251BAE61C00690FFB17FDDC87` `2586528000199793730B05D3F169BCF139E4D7A1`	TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security
objectFileHashSha256	`string`	FileSHA2	The SHA-256 of the object (objectFilePath)	`A75C85F3B089993E9C042FB82ECB7757E8F460ED8065FC7991CAA38A6DE0F50C` `908B64B1971A979C7E3E8CE4621945CBA84854CB98D76367B791A6E22B5F6D53` `1A2ABAAD8A166B66CA35AB51C7432C5A7E46996472C8174281842896408D7F96`	TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security
objectFileModified	`string`	-	The UTC time that the object was modified	`2024-10-10T10:10:10.0000000Z` `2024-11-11T11:11:11.0000000Z`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
objectFileName	`string`	FileName	The object file name	`powershell.exe` `wmiprvse.exe` `dismhost.exe`	TrendAI™ Apex One as a Service Trend Cloud One - Container Security Trend Cloud One - Endpoint & Workload Security
objectFilePath	`string`	FileFullPath	The file path of the target process image or target file	`c:\windows\system32\windowspowershell\v1.0\powershell.exe` `zwwritevirtualmemory` `c:\windows\system32\wbem\wmiprvse.exe`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor Trend Cloud One - Container Security
objectFileSize	`long`	-	The object file size	`0` `59456` `60`	Trend Cloud One - Endpoint & Workload Security
objectFirstRecorded	`string`	-	The first time that the object appeared	-	TrendAI™ Apex One as a Service
objectId	`string`	-	The UUID of the object	`3` `2`	TrendAI™ Apex One as a Service TrendAI Vision One™ Zero Trust Secure Access Private Access
objectIp	`dynamic`	IPv4 IPv6	The IP address of the domain	`10.10.10.10`	Trend Cloud One - Endpoint & Workload Security
objectName	`string`	-	The base name of the object file or process	`net.exe`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
objectPayloadFileHashSha1	`string`	FileSHA1	The SHA-1 of the object payload file	-
objectPipeName	`string`	-	The object pipe name	`\\.\pipe\F451F406BD`	XDR Endpoint Sensor
objectRegistryData	`string`	RegistryValueData	The registry data contents	`C:\Program Files\AlertMedia\AlertMedia Desktop Notifications\AlertMedia.exe`	XDR Endpoint Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
objectRegistryKeyHandle	`string`	RegistryKey	The registry key path	`HKCR\CID\{00000000-0000-0000-0000-000000000001}` `HKLM\SOFTWARE\WOW6432Node\Eos` `HKCU\SOFTWARE\Cerner\InstantAccess`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
objectRegistryRoot	`string`	-	The name of the object registry root key	`HKCR` `HKLM` `HKCU`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security
objectRegistryValue	`string`	RegistryValue	The registry value name	`1` `key` `reg`	XDR Endpoint Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
objectSigner	`dynamic`	-	The list of object process signers	`Microsoft Windows` `Microsoft Windows Publisher` `SecureWorks Inc`	TrendAI™ Apex One as a Service XDR Endpoint Sensor
objectSignerFlagsAdhoc	`dynamic`	-	The list of object process signature adhoc flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
objectSignerFlagsLibValid	`dynamic`	-	The list of object process signature library validation flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
objectSignerFlagsRuntime	`dynamic`	-	The list of object process signature runtime flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
objectSignerValid	`dynamic`	-	Whether each signer of the object process is valid	-	XDR Endpoint Sensor
objectSubType	`string`	-	The sub-types of the policy event	`Spam Others` `malware` `ContentFiltering`	TrendAI™ Cloud App Security TrendAI™ Email Security
objectTargetProcess	`string`	-	The file path of the target process that the API performs	`C:\\Windows\\System32\\lsass.exe`
objectType	`string`	-	The object type	`file` `process` `qil`	TrendAI™ Cloud App Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Email Security XDR Endpoint Sensor TrendAI Vision One™ File Security
objectUser	`string`	UserAccount	The owner name of the target process or the sign-in user name	`Système` `SYSTEM` `SISTEMA`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
objectUserDomain	`string`	-	The owner domain of the target process	`NT AUTHORITY` `UNEB`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
oldFileHash	`string`	FileSHA1	The SHA-1 of the target process image or target file (wasEntity from an IM event)	`DA39A3EE5E6B4B0D3255BFEF95601890AFD80709` `89CE26EAD139D52B8A6B61BFFC6AF89AF246580F` `57247B810B0EE61DD86CE24AC14097B9B5405EEC`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
online	`string`	-	Whether the endpoint is online	`Yes` `No`	TrendAI™ Apex One as a Service
orgId	`string`	-	The organization ID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Cloud App Security Email Sensor
originEventSourceType	`string`	-	The event source type of the original events which matches the Security Analytics Engine filter	`EVENT_SOURCE_TELEMETRY`	All products
originUUID	`dynamic`	-	The UUID of the original events which matches the Security Analytics Engine filter	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	All products
originalFileHashes	`dynamic`	FileSHA1	The hashes of the original file	`ba4700bfd55741c657a99fbe416787835fb384da` `639dfe4a69c1e6aace1e4eece3b3bb25af6a1392`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
originalFilePaths	`dynamic`	FileFullPath FileName	The paths of the original file	`C:\\Users\\user_name\\Downloads\\run.exe`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
osName	`string`	-	The host OS name	`Linux` `windows 10.0.22000` `windows 10.0.19044` `windows 10.0.19043`	TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access Data Detection and Response Trend Cloud One - Cloud Sentry
osVer	`string`	-	The OS version	`11`	TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access Data Detection and Response
out	`string`	-	The IP datagram length (in bytes)	`0` `439` `1314`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
overSsl	`string`	-	Whether the event was triggered by an SSL decryption stream	`Not over SSL/TLS` `0` `Over SSL/TLS`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TippingPoint Security Management System Trend Cloud One - Network Security
pAttackPhase	`string`	-	The category of the primary Attack Phase	`Lateral Movement` `Point of Entry` `Asset and Data Discovery`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
pComp	`string`	-	The component that made the detection	`CAV` `NCIE` `TMUFE`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service
pTags	`string`	-	The event tagging system	`attack-T1059.001, mitre attack detection` `suppress_alert` `SMB`	TrendAI™ Deep Security
parentCmd	`string`	CLICommand	The command line of the subject parent process	`"C:\Tiburon\CommandCAD\Test\Startup.exe"` `C:\WINDOWS\Explorer.EXE` `C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Appinfo`	XDR Endpoint Sensor Trend Cloud One - Container Security
parentFileHashMd5	`string`	FileMD5	The MD5 of the subject parent process	`7B9E6D992AA86F0D2ECDF8F65A6BB792` `2B47C89252BB932B292122E54C3DAF25` `CD10CB894BE2128FCA0BF0E2B0C27C16`	XDR Endpoint Sensor
parentFileHashSha1	`string`	FileSHA1	The SHA-1 of the subject parent process	`9CF40F19A625F7033689D04F4C8E1CC6A8FA4F5B` `799AB02945EDB9A37A42A3F742DE73165F4A9665` `1F912D4BEC338EF10B7C9F19976286F8ACC4EB97`	XDR Endpoint Sensor
parentFileHashSha256	`string`	FileSHA2	The SHA-256 of the subject parent process	`14A1223722D486ABBC88682AB49AF8E56DC65AC4E153027985BFFFF7C815C0EC` `2EF51284CA9211ADEC3E8E095F386FEC742E0532075894AE99024C65949F935E` `F3FEB95E7BCFB0766A694D93FCA29EDA7E2CA977C2395B4BE75242814EB6D881`	XDR Endpoint Sensor TXOne Stellar (on-premises)
parentFilePath	`string`	FileFullPath	The full file path of the parent process	`c:\windows\explorer.exe` `c:\tiburon\commandcad\test\startup.exe` `c:\windows\system32\svchost.exe`	XDR Endpoint Sensor
parentHashId	`string`	-	The FNV of the parent process	`-1364311042632324339` `1879227689087156956` `4246064157470561345`	XDR Endpoint Sensor
parentIntegrityLevel	`int`	-	The integrity level of a parent	`16384`	XDR Endpoint Sensor
parentName	`string`	-	The image name of the parent process	`explorer.exe` `startup.exe` `svchost.exe`	XDR Endpoint Sensor Trend Cloud One - Container Security
parentPayloadSigner	`dynamic`	-	The signer name list of the parent process payload	`Microsoft Windows` `Microsoft Windows Publisher`	XDR Endpoint Sensor
parentPayloadSignerFlagsAdhoc	`dynamic`	-	The list of parent process payload signature adhoc flags	-	XDR Endpoint Sensor
parentPayloadSignerFlagsLibValid	`dynamic`	-	The list of parent process payload signature library validation flags	-	XDR Endpoint Sensor
parentPayloadSignerFlagsRuntime	`dynamic`	-	The list of parent process payload signature runtime flags	-	XDR Endpoint Sensor
parentPayloadSignerValid	`dynamic`	-	Whether each signer of the parent process payload is valid	-	XDR Endpoint Sensor
parentPid	`int`	-	The PID of the parent process	-	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor TrendAI™ Deep Security Trend Cloud One - Container Security
parentSigner	`dynamic`	-	The signers of the parent process	`Microsoft Windows` `Microsoft Windows Publisher` `Azul Systems, Inc.`	XDR Endpoint Sensor
parentSignerFlagsAdhoc	`dynamic`	-	The list of parent process signature adhoc flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
parentSignerFlagsLibValid	`dynamic`	-	The list of parent process signature library validation flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
parentSignerFlagsRuntime	`dynamic`	-	The list of parent process signature runtime flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
parentSignerValid	`dynamic`	-	Whether each signer of the parent process is valid	-	XDR Endpoint Sensor
parentUser	`string`	-	The account name of the parent process	`Administrator`	Trend Cloud One - Endpoint & Workload Security
parentUserDomain	`string`	-	The domain name of the parent process	`builtindomain`	Trend Cloud One - Endpoint & Workload Security
patType	`string`	-	The pattern type	`NCIE CNC Pattern` `NCIE RR Pattern` `NCIE User Define Block List`	TrendAI™ Apex One as a Service
patVer	`string`	-	The version of the behavior pattern	`35.1053.00` `630` `35.1071.00`	TrendAI™ Apex One as a Service XDR Endpoint Sensor TrendAI™ Cloud App Security
pcapUUID	`string`	-	The PCAP file UUID	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
peerEndpointGUID	`string`	-	The endpoint GUID of the agent peer host	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Network Security TippingPoint Security Management System
peerGroup	`string`	-	The peer IP group	`Default` `Rede DATACENTER Lumen/PALOALTO VPNSSL - VPN CLIENT` `UHS`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
peerHost	`string`	DomainName	The hostname of peerIp	`dns.google` `10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
peerIp	`dynamic`	IPv4 IPv6	The IP of peerHost	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service
platformAssetTags	`dynamic`	-	The list of platform custom asset tags	`{"Asset group":["finance"], "some.ip": ["10.1.0.1"]}`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service Trend Cloud One - Container Security
pname	`string`	-	The internal product ID	`TrendAI™ Deep Security` `Deep Discovery Inspector` `Apex One`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI™ Cloud App Security TrendAI™ Email Security TippingPoint Security Management System XDR Endpoint Sensor TrendAI™ Web Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security Trend Cloud One - Container Security Email Sensor
policyId	`string`	-	The policy ID of which the event was detected	`00000001-0001-0001-0001-000000007610` `007` `003` `TM000001`	TippingPoint Security Management System TrendAI™ Apex One as a Service XDR Endpoint Sensor Trend Cloud One - Network Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security Trend Cloud One - Container Security
policyName	`string`	-	The name of the triggered policy	`Steelcase` `Cabot` `Tigre - Medium Policy` `apiPostedPolicy`	TrendAI™ Apex One as a Service TrendAI™ Cloud App Security TrendAI™ Web Security TrendAI™ Email Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne EdgeOne (on-premises) Trend Cloud One - Container Security TrendAI™ Mobile Network Security
policyTemplate	`dynamic`	-	The one-to-many data structure	`policyName:Monitoreo All Files, template:Managed - All files` `policyName:HSS DLP, template:All File Extension` `India: Mobile Numbers`	TrendAI™ Apex One as a Service TrendAI™ Cloud App Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
policyTreePath	`string`	-	The policy tree path	`policyname1/policyname2/policyname3`	All products
policyUuid	`string`	-	The UUID of the cloud access or risk control policy, or the hard-coded string that indicates the rule of the global blocked/approved URL list	`7937cb0b-e598-4c8f-a50f-65c32905ba3a` `C!7c4433e3-5b2c-449f-b66e-ccaac006b6f1` `8d265639-7202-4455-b640-48683aa2b57d`	TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Zero Trust Secure Access Private Access
potentialRisk	`string`	-	Whether something is a potential risk	`1` `0`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
principalName	`string`	-	The user principal name used to sign in to the proxy	`sample_email@trendmicro.com`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI™ Cloud App Security TrendAI Vision One™ Zero Trust Secure Access Private Access
processActions	`dynamic`	-	The process actions	`ProcessDump` `FileCollection`	XDR Endpoint Sensor
processArtifactIds	`dynamic`	-	The artifact IDs generated by processAction	`00000000-0000-0000-0000-000000000000_1.dmp` `11111111-1111-1111-1111-111111111111_2.bak`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
processCmd	`string`	CLICommand	The subject process command line	`"C:\Program Files (x86)\AADM\AADM.exe"` `/usr/lib/inet/sendmail -bl -q15m` `ComDir`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service Trend Cloud One - Container Security
processFileCreation	`string`	-	The Unix time of object creation	`1645828113585` `1655412594237` `1647162053219`	Trend Cloud One - Endpoint & Workload Security
processFileHashMd5	`string`	FileMD5	The MD5 of the subject process	`D07ADD0CE6E000D3CD20193B891E8ED3` `1a9ba93ebe4cb60030831f8ce9e7d5f9` `EEE6691B48D2FB604DDF0CBC90D75B0E`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor
processFileHashSha1	`string`	FileSHA1	The SHA-1 of the subject process	`C0885381EBAC94AB20E78936434FA208F6B65352` `ac373ed32b491da22924e2e11e36574e5d582a35` `DF93F7DF887E86C3B56539B5046B286001C6F150`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor TrendAI™ Apex One as a Service
processFileHashSha256	`string`	FileSHA2	The SHA-256 of the subject process	`4314A869B8DAE1BD3FFF810B1366E90FB7C961D4A3424260692377FDD87361D2` `7824c45fc033696603fe97d8f193a1872dfb2b5db75f0cda21df27017b3cb623` `1A6D5986EFEAE89308D9EE11B4A7907012603392E0E66D0E529DB09DF1B4CB64`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor
processFilePath	`string`	ProcessFullPath FileFullPath FileName	The file path of the subject process	`c:\windows\system32\svchost.exe` `c:\windows\system32\windowspowershell\v1.0\powershell.exe` `c:\windows\syswow64\srts\wmipr.exe`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor
processHashId	`string`	-	The FNV of the subject process	`-2965450813604216022` `7111735426732308768` `-7600358934761747729`	XDR Endpoint Sensor
processImageFileNames	`dynamic`	-	The process image file names of detected backup artifacts	`C:\Program Files\aaa\bbb\objprocess.exe` `C:\Program Files\ccc\ddd\sample.exe`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
processImagePath	`string`	-	The process triggered by the file event	`c:\windows\system32\svchost.exe` `/usr/bin/python2.7` `/usr/bin/sed`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor TrendAI™ Deep Security Trend Cloud One - Container Security
processLaunchTime	`string`	-	The time the subject process was launched	`1656400286556` `1656566610259` `1656587180493`	Trend Cloud One - Endpoint & Workload Security
processName	`string`	ProcessName	The image name of the process that triggered the event	`c:\windows\system32\svchost.exe` `/usr/bin/python2.7` `/usr/bin/sed`	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor TrendAI™ Deep Security Trend Cloud One - Container Security TrendAI™ Apex One as a Service
processPayloadSigner	`dynamic`	-	The signer name list of the process payload	`Microsoft Windows` `Microsoft Windows Publisher`	XDR Endpoint Sensor
processPayloadSignerFlagsAdhoc	`dynamic`	-	The list of process payload signature adhoc flags	-	XDR Endpoint Sensor
processPayloadSignerFlagsLibValid	`dynamic`	-	The list of process payload signature library validation flags	-	XDR Endpoint Sensor
processPayloadSignerFlagsRuntime	`dynamic`	-	The list of process payload signature runtime flags	-	XDR Endpoint Sensor
processPayloadSignerValid	`dynamic`	-	Whether each signer of the process payload is valid	-	XDR Endpoint Sensor
processPid	`int`	-	The PID of the subject process	-	Trend Cloud One - Endpoint & Workload Security XDR Endpoint Sensor Trend Cloud One - Container Security
processPkgName	`string`	-	The process package name	`MSTeams` `Microsoft.SkypeApp`	XDR Endpoint Sensor
processSigner	`dynamic`	-	The signer name list of the subject process	`Microsoft Windows` `Microsoft Windows Publisher`	XDR Endpoint Sensor Trend Cloud One - Endpoint & Workload Security
processSignerFlagsAdhoc	`dynamic`	-	The list of process signature adhoc flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
processSignerFlagsLibValid	`dynamic`	-	The list of process signature library validation flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
processSignerFlagsRuntime	`dynamic`	-	The list of process signature runtime flags	-	XDR Endpoint Sensor TrendAI™ Apex One as a Service TrendAI™ Apex One
processUser	`string`	UserAccount	The user name of the process or the file creator	`SYSTEM` `SVC_JENKINS_CODE_DEV` `NETWORK SERVICE`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
processUserDomain	`string`	-	The owner domain of the subject process image	`NT AUTHORITY` `DOMAINBA` `PAEDMZ`	Trend Cloud One - Endpoint & Workload Security
processUserGroupId	`string`	-	The process user group ID or file creator	`0` `S-1-5-1`	Trend Cloud One - Endpoint & Workload Security
processUserGroupName	`string`	-	The process user group name or file creator	`root` `NT AUTHORITY`	Trend Cloud One - Endpoint & Workload Security
processUserId	`string`	-	The process user ID or file creator	`0` `S-1-5-1`	Trend Cloud One - Endpoint & Workload Security
productCode	`string`	-	The internal product code	`sds` `pdi` `xns` `sao`	All products
profile	`string`	-	The name of the triggered Threat Protection template or Data Loss Prevention profile	`Primary Protection Rule` `Multibak Scaner Threat` `default`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
proto	`string`	-	The exploited layer network protocol	`6` `TCP` `17`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TXOne EdgeOne (on-premises) Trend Cloud One - Container Security TrendAI™ Mobile Network Security
protoFlag	`string`	-	The data flags	`ACK PSH DF=1` `ACK DF=1` `DF=1`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
pver	`string`	-	The product version	`20.0.0.4726` `20.0.0.4416` `6.2.1125`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service TippingPoint Security Management System Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Mobile Security Trend Cloud One - Container Security TrendAI Vision One™ File Security Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
quarantineFileId	`string`	-	The unique identifier of the quarantined object	`ASLUMVS0.4FC`	TrendAI™ Apex One as a Service TrendAI™ Apex One Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
quarantineFileName	`string`	-	The file path of the quarantined object	`C:\Program Files\TXOne\StellarProtect\private\quarantine\00000000-0000-0000-0000-000000000000`	TXOne Stellar (on-premises)
quarantineFilePath	`string`	FileFullPath	The file path of the quarantined object	`C:\ProgramData\TrendAI™\AMSP\quarantine\ASLUMVS0.4FC`	TrendAI™ Apex One as a Service TrendAI™ Apex One Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
quarantineFileSha256	`string`	FileSHA2	The SHA-256 of the quarantined object	`84B2FA19B05EA88D6E785B4ADB528120485AA3F72F3E5E114DE6D3696B0D151F`	TrendAI™ Apex One as a Service TrendAI™ Apex One Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
quarantineType	`string`	-	The descriptive name for the quarantine area	`0` `1` `538`	TrendAI™ Apex One as a Service
rating	`string`	-	The credibility level	`Safe` `Unknown` `Dangerous`	TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rawDstIp	`string`	IPv4 IPv6	The destination IP without replacement	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rawDstPort	`int`	Port	The destination port without replacement	`33186`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rawSrcIp	`string`	IPv4 IPv6	The source IP without replacement	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rawSrcPort	`int`	Port	The source port without replacement	`80`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
regionCode	`string`	-	The cloud provider region code	`us-east-1`	Trend Cloud One – File Storage Security Trend Cloud One - Cloud Sentry
regionId	`string`	-	The cloud asset region	`US East (N. Virginia)` `Europe (Frankfurt)`	Trend Cloud One - Endpoint & Workload Security
remarks	`string`	-	The additional information	`warning: fork: Resource temporarily unavailable` `pam_unix(cron:session): session opened for user root by (uid=0)` `WinEvtLog: Application: AUDIT_FAILURE(18470): MSSQL$SA: (no user): no domain: EXAMPLE.com: Login failed for user 'example_user'. Reason: The account is disabled. [CLIENT: 10.10.10.10]`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Cloud App Security TrendAI™ Apex One as a Service TrendAI™ Email Security Trend Cloud One - Network Security TXOne EdgeOne (on-premises) Email Sensor TrendAI Vision One™ File Security Trend Cloud One - Cloud Sentry
reportGUID	`string`	-	The GUID for Workbench to request report page data	`00000000-0000-0000-0000-000000000000` `11111111-1111-1111-1111-111111111111` `22222222-2222-2222-2222-222222222222`	TrendAI™ Cloud App Security TrendAI Vision One™ File Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor
request	`string`	URL	The notable URLs	`http://example.page.com/canonical.html` `http://10.10.10.10` `https://drive.google.com/`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TippingPoint Security Management System Trend Cloud One - Endpoint & Workload Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI™ Cloud App Security Trend Cloud One - Network Security TrendAI™ Email Security TrendAI™ Deep Security TrendAI Vision One™ Mobile Security TrendAI Vision One™ Zero Trust Secure Access Private Access
requestBase	`string`	DomainName HostDomain	The domain of the request URL	`weather.service.msn.com` `test.domain.com`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI Vision One™ Zero Trust Secure Access Private Access
requestClientApplication	`string`	-	The protocol user agent information	`Microsoft-Delivery-Optimization/10.0` `Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)` `example Software GmbH`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
requestMethod	`string`	-	The network protocol request method	`POST`	Palo Alto Networks Next-Generation Firewalls
respCode	`string`	-	The network protocol response code	`302` `200`	TrendAI™ Cloud App Security TrendAI™ Email Security
rewrittenUrl	`string`	-	The rewritten URL	`https://cas5-0-urlprotect.trendmicro.com:443/wis/clicktime/v1/query?url=https%3a%2f%2fexample.io%2`	TrendAI™ Cloud App Security TrendAI™ Email Security
riskConfidenceLevel	`string`	-	The risk confidence level	`0` `1` `2`	TrendAI™ Apex One as a Service TrendAI™ Cloud App Security
riskLevel	`string`	-	The risk level	`1` `high` `No Risk`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Cloud App Security XDR Endpoint Sensor TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rozRating	`string`	-	The overall Virtual Analyzer rating	`0` `-1` `1`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
rtDate	`string`	-	The date of the log generation	`1655337600000`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security
rtWeekDay	`string`	-	The weekday of the log generation	`Monday` `Tuesday` `Friday`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security
ruleId	`int`	-	The rule ID	`1002795` `1003802`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service TrendAI™ Mobile Network Security
ruleId64	`long`	-	The IPS rule ID	`1134268` `4026531849` `4026531852`	TXOne EdgeOne (on-premises) TrendAI™ Mobile Network Security
ruleIdStr	`string`	-	The rule ID	`TM-00000043`	Trend Cloud One - Container Security
ruleName	`string`	-	The name of the rule that triggered the event	`Directory Server - Microsoft Windows Active Directory` `Microsoft Windows Events` `Microsoft Windows Security Events - 3` `(T1234) New executable created (chmod)` `Sensitive Files Upload to Personal Cloud` `Multiple Sensitive Files Compression` `Transfer Sensitive Files to Removable Storage` `Move Multiple Sensitive Files to Central Location` `Multiple Sensitive Files Modification` `Multiple Sensitive Files Deletion` `GEN_CCFR_OVERLAY_TEST.A`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security TrendAI™ Cloud App Security TippingPoint Security Management System XDR Endpoint Sensor TrendAI™ Email Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security Email Sensor TrendAI™ Mobile Network Security Data Detection and Response
ruleSetId	`string`	-	The rule set ID	`AllRules-1zSSZPsDqfqkcOt5vNsD6f383HN`	Trend Cloud One - Container Security
ruleSetName	`string`	-	The rule set name	`AllRules`	Trend Cloud One - Container Security Trend Cloud One - Network Security TippingPoint Security Management System Trend Cloud One - Endpoint & Workload Security
ruleType	`string`	-	The access rule type	`udso` `point of entry` `unknown`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Cloud App Security TrendAI Vision One™ Zero Trust Secure Access Private Access
ruleUuid	`string`	-	The signature UUID from Digital Vaccine	`00000001-0001-0001-0001-000000007610` `00000001-0001-0001-0001-000000007120` `00000001-0001-0001-0001-000000017056`	TippingPoint Security Management System Trend Cloud One - Network Security TrendAI™ Cloud App Security TrendAI Vision One™ Zero Trust Secure Access Private Access
ruleVer	`string`	-	The rule version	`202207060001` `202207190001`	TrendAI™ Cloud App Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Email Security Email Sensor
sAttackPhase	`string`	-	The category of the second Attack Phase	`Lateral Movement` `Command and Control Communication`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
sOSClass	`string`	-	The source device OS class	`Linux`	TrendAI™ Mobile Network Security
sOSName	`string`	-	The source OS	`Windows` `Windows 10` `Windows XP`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Mobile Network Security
sOSVendor	`string`	-	The source device OS vendor	`Others`	TrendAI™ Mobile Network Security
sUser1	`string`	UserAccount	The latest sign-in user of the source	`example\admin` `example.us.com\account`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
scanTs	`string`	-	The mail scan time	-	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor
scanType	`string`	-	The scan type	`realtime_mailmeta-exchange` `exchange_mailbox_realtime_detection_logs` `gateway_realtime_blocking_traffic` `malware_schedule_image` `malware_schedule_file` `malware_realtime_image` `malware_realtime_file`	TrendAI™ Cloud App Security TrendAI™ Email Security Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security Email Sensor TrendAI Vision One™ File Security Trend Cloud One - Cloud Sentry Trend Cloud One - Container Security
schemaVersion	`string`	-	The schema version	`1.0`	TrendAI™ Cloud App Security
secondAct	`string`	-	The second scan action	`Unknown` `N/A` `Deny Access`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security
secondActResult	`string`	-	The result of the second scan action	`Unknown` `N/A` `Access denied`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Security
sender	`string`	-	The roaming users or the gateway where the web traffic passed	`test user` `VE C&W - 10.10.10.10`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
senderGUID	`string`	-	The sender GUID	`346648FC-9862-D2F0-F94C-FAB1A838ABD7` `36E5239E-EEBA-0100-C10E-C057E0455E1D` `9606BBD5-38A7-9024-83C8-9C88A2AF90CC`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Deep Security
senderIp	`dynamic`	-	The sender IP	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service TrendAI™ Email Security
sessionEnd	`string`	-	The session end time (in seconds)	`1575462989`	TrendAI Vision One™ Zero Trust Secure Access Private Access
sessionStart	`string`	-	The session start time (in seconds)	`1575462989`	TrendAI Vision One™ Zero Trust Secure Access Private Access
severity	`int`	-	The severity of the event	`2` `4` `6` `8`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Apex One as a Service TippingPoint Security Management System Trend Cloud One - Network Security Trend Cloud One - Container Security TrendAI™ Mobile Network Security
shost	`string`	DomainName	The source hostname	`dns.google` `sw_us-east-1a_10-124-17-69` `sw_us-east-1c_10-124-21-139`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Deep Security TrendAI™ Mobile Network Security
signInCountries	`dynamic`	-	The countries from which a user signed in	`PH` `AU`	TrendAI™ Cloud App Security Microsoft Entra ID
signer	`string`	-	The signer of the file	`Shenzhen Smartspace Software technology Co.,Limited;Symantec Class 3 SHA256 Code Signing CA;1429491600;1492649999`	TrendAI™ Apex One as a Service
smac	`string`	-	The source MAC address	`00:11:22:33:44:55` `66:77:88:99:AA:BB` `CC:DD:EE:FF:00:11`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TXOne EdgeOne (on-premises)
smbSharedName	`string`	-	The shared folder name for the server that contains the files to be opened	`C:\sharedfolder`	XDR Endpoint Sensor
sourceType	`string`	-	The source type	`user defined` `sandbox` `syscall`	TrendAI™ Apex One as a Service Trend Cloud One - Container Security XDR Endpoint Sensor
sproc	`string`	-	The OSSEC program name	`postfix/sendmail` `CRON` `sshd`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
spt	`int`	Port	The source port	`53` `0` `7680`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TippingPoint Security Management System TrendAI™ Deep Security Trend Cloud One - Network Security XDR Endpoint Sensor TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security TrendAI™ Mobile Network Security
src	`dynamic`	IPv4 IPv6	The source IP	`10.10.10.10`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security TippingPoint Security Management System TrendAI™ Deep Security Trend Cloud One - Network Security XDR Endpoint Sensor TrendAI Vision One™ Zero Trust Secure Access Internet Access TXOne EdgeOne (on-premises) TrendAI Vision One™ Zero Trust Secure Access Private Access Trend Cloud One - Container Security TrendAI™ Mobile Network Security
srcEquipmentId	`string`	-	The source IMEI	`350548054087659`	TrendAI™ Mobile Network Security
srcFamily	`string`	-	The source device family	`Computer`	TrendAI™ Mobile Network Security
srcFileHashMd5	`string`	FileMD5	The MD5 of the source file	-
srcFileHashSha1	`string`	FileSHA1	The SHA-1 of the source file	-
srcFileHashSha256	`string`	FileSHA2	The SHA-256 of the source file	-
srcFilePath	`string`	FileFullPath	The source file path	`C:\\temp\\a.exe`
srcGroup	`string`	-	The group named defined by the source administrator	`Default` `Rede DATACENTER example/example - AD example CORP`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Mobile Network Security
srcLocation	`string`	-	The source country	`JP`	TrendAI Vision One™ Zero Trust Secure Access Internet Access
srcSubscriberDirNum	`string`	-	The source MSISDN	`8618687654321`	TrendAI™ Mobile Network Security
srcSubscriberId	`string`	-	The source IMSI	`466686007810478`	TrendAI™ Mobile Network Security
srcType	`string`	-	The source device type	`Desktop/Laptop`	TrendAI™ Mobile Network Security
srcZone	`string`	-	The network zone defined by the source administrator	`1` `0` `2`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
sslCertCommonName	`string`	DomainName HostDomain	The subject common name	`settings-win.data.microsoft.com`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
sslCertIssuerCommonName	`string`	-	The issuer common name	`Microsoft Azure TLS Issuing CA 05`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
sslCertIssuerOrgName	`string`	-	The issuer organization name	`Microsoft Corporation`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
sslCertOrgName	`string`	-	The subject organization name	`Microsoft`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
startTime	`long`	-	The time when the first event was received (in Unix milliseconds)	`1750983848000`	Trend Cloud One - Endpoint & Workload Security
subRuleId	`string`	-	The sub-rule ID	`85262` `914520` `18152`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security Trend Cloud One - Network Security
subRuleName	`string`	-	The sub-rule name	`Pre-authentication failed.` `ATTACK T1070.002,T1070.004: Indicator Removal on Host : Clear Linux or Mac System Logs,File Deletion` `ATTACK T1110: Multiple Windows Logon Failures` `invisible_url_domain`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security TrendAI™ Cloud App Security TrendAI™ Email Security Email Sensor
suid	`string`	UserAccount	The user name or mailbox	`root` `US EXAMPLE\TEST` `sample_email@trendmicro.com`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Cloud App Security TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Web Security TrendAI™ Deep Security Trend Cloud One - Network Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
suser	`dynamic`	EmailSender	The email sender	`sample_email@trendmicro.com`	TrendAI™ Cloud App Security TrendAI™ Email Security TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Email Sensor
suspiciousObject	`string`	-	The matched suspicious object	`36ba9de3da9e6f8abfffdda7787ab0ecc16724bb`	XDR Endpoint Sensor
suspiciousObjectType	`string`	-	The matched suspicious object type	`sha1`	XDR Endpoint Sensor
tacticId	`dynamic`	Tactic	The list of MITRE tactic IDs	`TA0011` `TA0008` `TA0001`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor XDR Endpoint Sensor TrendAI™ Apex One as a Service
tags	`dynamic`	Technique Tactic	The detected technique ID based on the alert filter	`MITREV9.T1090` `MITRE.T1071` `MITREV9.T1059.001`	All products Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
target	`string`	-	The target object for the behavior	`c:\windows\system32\windowspowershell\v1.0\powershell.exe` `zwwritevirtualmemory` `/proc/211296/exe`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
targetShare	`string`	FileFullPath	The subject state or province name (for HTTPS) or the shared folder (for SMB)	`3MHIS` `NETLOGON` `CA`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
targetType	`string`	-	The target object type	`File System` `Uncategorized` `Exploit`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
techniqueId	`dynamic`	Technique	The technique ID detected by the product agent based on a detection rule	-	TXOne Stellar (on-premises) TrendAI™ Deep Discovery Inspector Virtual Network Sensor
threatName	`string`	-	The threat name	`Malicious_CnC_access_on_UDP_blocked` `Malicious_CnC_access_on_TCP_blocked` `Other protected file`	TrendAI™ Cloud App Security TrendAI™ Apex One as a Service TrendAI™ Deep Discovery Inspector Virtual Network Sensor
threatNames	`dynamic`	-	The associated threats	`HM_GERAL.MIP00000001` `HM_JADTRE.MIP00000001` `VAN_BOT.UMXX`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor
threatType	`string`	-	The log threat type	`2` `99` `5`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Apex One as a Service Trend Cloud One - Cloud Sentry
trigger	`string`	-	The action trigger	`ATSE` `On-demand scan`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Apex One as a Service
triggerInfo	`dynamic`	-	The trigger information	`-`	TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
triggerReason	`string`	-	The cause of the triggered action	`FILEMETA.T1027.009.TRICKBOT.SMITRE1B2, T1027.009` `ST002` `Scheduled Scan (custom)` `Scheduled Scan (system)` `Remote Scan: the user triggered the Apex One agent from the TrendAI Vision One™ console` `Manual Scan: the user triggered the local agent`	XDR Endpoint Sensor TrendAI™ Apex One as a Service Trend Cloud One - Endpoint & Workload Security
urlCat	`dynamic`	-	The requested URL category	`Untested` `158` `Web Advertisement`	TrendAI™ Deep Discovery Inspector Virtual Network Sensor TrendAI™ Web Security TrendAI™ Apex One as a Service TrendAI Vision One™ Zero Trust Secure Access Internet Access TrendAI™ Cloud App Security TrendAI Vision One™ Mobile Security Trend Cloud One - Endpoint & Workload Security
userDepartment	`string`	-	The user department	`Operations` `BANCA CONSTRUCCION` `CONTACT CENTER`	TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
userDomain	`string`	EndpointName DomainName AccountDomain	The user domain	`example.com.pa` `DOMAIN`	TrendAI™ Apex One as a Service TrendAI™ Web Security TrendAI Vision One™ Zero Trust Secure Access Internet Access
userDomains	`dynamic`	-	The telemetry events that match the Security Analytics Engine filter, and userDomains stores the userDomains value of the original events	`CORP`	All products
uuid	`string`	-	The unique key of the log	`000008d7-35fd-4d7b-bada-7f38dca2abf7` `0000116b-ac61-48d2-89e1-3d1ce2d13cdd` `000017f4-ac10-43b4-8aef-97158e0f8533`	All products
uuids	`dynamic`	-	The UUIDs of detection records	`-`	Data Detection and Response
vendor	`string`	-	The device vendor	`adata`	TrendAI™ Apex One as a Service
vpcId	`string`	-	The virtual private cloud that contains the cloud asset	`vpc-01234567890abcdef` `avtd-vnet-ozyww04h` `ocid1.vnic.oc1.iad.abuwcljs4szq5rylkxikcthyegnqn5mjhkyn3xwtoa3uvbonxqn52nofibgq`	Trend Cloud One - Endpoint & Workload Security Trend Cloud One - Cloud Sentry
wasEntity	`string`	-	The entity before change/modification	`{"key":"<example>","type":"Service","attributes":[{"friendlyValue":null,"name":"binaryPathName","value":"C:\\Windows\\system32\\vssvc.exe"},{"friendlyValue":"manual","name":"startType","value":"3"},{"friendlyValue":"stopped","name":"state","value":"1"}]}` `{"key":"<example>","type":"Service","attributes":[{"friendlyValue":null,"name":"binaryPathName","value":"C:\\Windows\\system32\\vssvc.exe"},{"friendlyValue":"manual","name":"startType","value":"3"},{"friendlyValue":"running","name":"state","value":"4"}]}` `{"key":"<example>","type":"File","attributes":[]}`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security
winEventId	`int`	-	The Windows Event ID	`11` `4624` `4670`	Trend Cloud One - Endpoint & Workload Security TrendAI™ Deep Security