Mobile activity data sources

Views:

Important

This data source query method is no longer available after May 1, 2026. For more information on the currently available data sources for use in XDR Data Explorer queries, go to https://trendmicro.github.io/tm-v1-schema/pages/index.

Field Name	Type	General Field	Description	Example	Products
appIsSystem	`bool`	-	Whether the app is a system app	`false`	TrendAI Vision One™ Mobile Security
appLabel	`string`	-	The app name (if the subject is an app)	`Collection Nes Games`	TrendAI Vision One™ Mobile Security
appOrSystemEventHashId	`string`	-	The event object hash ID	`3859886410`	TrendAI Vision One™ Mobile Security
appPkgName	`string`	-	The app package name (if the subject is an app)	`com.ConsolesXX.CollectionNesGames`	TrendAI Vision One™ Mobile Security
appPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key (if the subject is an app)	`05FC638156219800DADAC48D8E621E0BCBD3C321`	TrendAI Vision One™ Mobile Security
appSize	`string`	-	The app size (in bytes) if the subject is an app	`16906043`	TrendAI Vision One™ Mobile Security
appVerCode	`string`	-	The app version code (if the subject is an app)	`0`	TrendAI Vision One™ Mobile Security
endpointGuid	`string`	EndpointID	The host GUID of the endpoint on which the event was detected	`11111111-1111-1111-1111-111111111111`	TrendAI Vision One™ Mobile Security
endpointHostName	`string`	EndpointName	The hostname of the endpoint on which the event was detected	`PHILIPSIBE09` `WHAM6WK8XG2` `MacBook-Pro-del-Meno`	TrendAI Vision One™ Mobile Security
endpointIp	`dynamic`	IPv4 IPv6	The IP address of the endpoint on which the event was detected	`10.10.10.10` `::1` `fe80::1`	TrendAI Vision One™ Mobile Security
endpointModel	`string`	-	The endpoint device model	`Pixel 3 XL`	TrendAI Vision One™ Mobile Security
eventHashId	`string`	-	The event hash ID	`-8406473586387535914` `138486453338666581` `-7909265752378976284`	TrendAI Vision One™ Mobile Security
eventId	`int`	-	The event type	-	TrendAI Vision One™ Mobile Security
eventSubId	`int`	-	The access type	`2 - TELEMETRY_PROCESS_CREATE` `101 - TELEMETRY_FILE_CREATE` `204 - TELEMETRY_CONNECTION_CONNECT_OUTBOUND`	TrendAI Vision One™ Mobile Security
eventTime	`real`	-	The time the agent detected the event	`1657781088000`	TrendAI Vision One™ Mobile Security
extraInfo	`dynamic`	-	The extra information about the app	`N/A` `Web Client Common` `DCERPC Services`	TrendAI Vision One™ Mobile Security
filterRiskLevel	`string`	-	The top-level risk level of the event	`info` `low` `medium`	All products
firstSeen	`string`	-	The time when the event started (in milliseconds)	`1656355418449`	TrendAI Vision One™ Mobile Security
groupId	`string`	-	The group ID for the management scope filter	`11111111-1111-1111-1111-111111111111`	All products
lastSeen	`string`	-	The time when the event ended (in milliseconds)	`1656355418449`	TrendAI Vision One™ Mobile Security
logReceivedTime	`long`	-	The time when the XDR log was received	`1656324260000`	All products
logonUser	`dynamic`	UserAccount	The sign-in user name	`root` `SISTEMA` `oracle`	TrendAI Vision One™ Mobile Security
marsAccount	`string`	-	The account for TrendAI™ Mobile Apps Reputation Service	`XDRv1`	TrendAI Vision One™ Mobile Security
objectAppBehavior	`string`	-	The activity that occurred on the app	`GRANTED_CAMERA_PERMISSION` `APP_NO_ICON` `APP_HIDE_ICON`	TrendAI Vision One™ Mobile Security
objectAppBehaviorAttr	`string`	-	The attributes of the app activity	`android.intent.action.BOOT_COMPLETED`	TrendAI Vision One™ Mobile Security
objectAppDexSha256	`string`	FileSHA2	The SHA-256 hash of the app Dex value	`C23A87B77B06442FD9AF9A80DD87191EDEADFAB766C862EBC592FE18063D0449`	TrendAI Vision One™ Mobile Security
objectAppInstalledTime	`string`	-	The time of app installation (in milliseconds)	`1607935850`	TrendAI Vision One™ Mobile Security
objectAppIsSystemApp	`bool`	-	Whether the app is a system app	`true`	TrendAI Vision One™ Mobile Security
objectAppLabel	`string`	-	The app name	`Collection Nes Games`	TrendAI Vision One™ Mobile Security
objectAppPackageName	`string`	-	The app package name	`com.ConsolesXX.CollectionNesGames`	TrendAI Vision One™ Mobile Security
objectAppPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	TrendAI Vision One™ Mobile Security
objectAppSha256	`string`	FileSHA2	The SHA-256 hash of the app	`692BC8E6BC51807A24BEACC13ED2B68E1F954E152863430E3179FA812937B8B0`	TrendAI Vision One™ Mobile Security
objectAppSize	`string`	-	The app size (in bytes)	`16906043`	TrendAI Vision One™ Mobile Security
objectAppVerCode	`string`	-	The app version code	`0`	TrendAI Vision One™ Mobile Security
objectAppVerName	`string`	-	The app version	`1`	TrendAI Vision One™ Mobile Security
objectCertAttr	`string`	-	The SHA-1 hash of the certificate public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	TrendAI Vision One™ Mobile Security
objectFileCreation	`string`	-	The time the target file was created (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	TrendAI Vision One™ Mobile Security
objectFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the target process image or target file	`39109eef00821658893b45634fe2f4664f880da9242712df907f1327d4ceefb8` `49fa3e206abf6a1f4546417dbe09f3f06b38847866a4a66de75bd90f39cb6c1c` `0969321ad5a0923f0f03896ad2c10e49290515c44b721d773942a37f62a24893`	TrendAI Vision One™ Mobile Security
objectFileModifiedTime	`string`	-	The modification time of the target file (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	TrendAI Vision One™ Mobile Security
objectFilePath	`string`	FileFullPath FileName	The file path of the target process image or target file	`/usr/bin/bash` `/bin/bash` `/opt/folder1/probes/system/processes/processes`	TrendAI Vision One™ Mobile Security
objectFileSize	`string`	-	The target file size	`0` `59456` `60`	TrendAI Vision One™ Mobile Security
objectFirstSeen	`string`	-	The time when the object first appeared (in milliseconds)	`1656458063638` `1656260547165` `0`	TrendAI Vision One™ Mobile Security
objectHashId	`string`	-	The event object hash ID	`8576474808125313522` `-599270888483415002` `2177864258235728980` `2432229257`	TrendAI Vision One™ Mobile Security
objectLastSeen	`string`	-	The time when the object was last seen (in milliseconds)	`1656458354730` `1656260580722` `0`	TrendAI Vision One™ Mobile Security
objectSystemEventAttr	`string`	-	The system event attributes	`LOCK_SCREEN`	TrendAI Vision One™ Mobile Security
osName	`string`	-	The host OS name	`Windows` `Linux` `macOS`	TrendAI Vision One™ Mobile Security
osVer	`string`	-	The OS version	`Amazon Linux 2` `10.0.19044` `10.0.19042`	TrendAI Vision One™ Mobile Security
pname	`string`	-	The internal product ID (Deprecated, use productCode)	`2200` `751` `533`	TrendAI Vision One™ Mobile Security
policyTreePath	`string`	-	The policy tree path (endpoint only)	`policyname1/policyname2/policyname3`	All products
productCode	`string`	-	The internal product code	`sds` `xes` `sao`	All products
pver	`string`	-	The product version	`1.2.0.2752` `1.0.345` `1.2.0.2657`	TrendAI Vision One™ Mobile Security
request	`string`	URL	The request URL	`http://10.10.10.10/fake/site` `http:///fake/param.cgi?action=list&group=Alarm.Status` `http://fake.com/`	TrendAI Vision One™ Mobile Security
srcFileCreation	`string`	-	The time when the source file was created (in milliseconds)	`1577865600000` `1626201752000` `1626201750000`	TrendAI Vision One™ Mobile Security
srcFileHashId	`string`	-	The source file hash ID	`1102079405020678318` `-6926286289273504319` `8528955148329941480`	TrendAI Vision One™ Mobile Security
srcFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the source file	`4eaa002225f4ea2dedcd19b7f1337d7c58ea7dd6d4571c12468dde95e6bcfdaf` `e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80` `16b20a3ad485b4fbbe3028c7e743b226db21ea93cacc8b3d7d7d4a731bf02333`	TrendAI Vision One™ Mobile Security
srcFileModifiedTime	`string`	-	The time when the source file was modified (in milliseconds)	`1626201752000` `1626201750000` `1577865600000`	TrendAI Vision One™ Mobile Security
srcFilePath	`string`	FileFullPath FileName	The source file path	`\\cnva-apps\megaclockprod\traveler\travelerprint.accdb` `c:\program files\common files\microsoft shared\clicktorun\officesvcmgrschedule.xml` `q:\a7_dbs\a4_pkg\a4_packaging.accde`	TrendAI Vision One™ Mobile Security
srcFileSize	`string`	-	The source file size	`0` `131072` `196608`	TrendAI Vision One™ Mobile Security
srcFirstSeen	`string`	-	The time when the source file first appeared (in milliseconds)	`0` `1656355418449` `1656714760440`	TrendAI Vision One™ Mobile Security
srcLastSeen	`string`	-	The time when the source file was last seen (in milliseconds)	`0` `1656355418449` `1656715147313`	TrendAI Vision One™ Mobile Security
systemEventAttr	`string`	-	The attributes of the system event (if the subject is a system event)	`usbdebugging`	TrendAI Vision One™ Mobile Security
tags	`dynamic`	Technique	The detected technique ID based on the alert filter	`MITREV9.T1057` `MITREV9.T1059.003` `XSAE.F2924`	All products
userType	`string`	-	The user type	`Microsoft Endpoint Manager` `Azure Active Directory` `VMware Workspace ONE UEM`	TrendAI Vision One™ Mobile Security
uuid	`string`	-	The unique key of the log	`11111111-1111-1111-1111-111111111111`	All products