Views:
Field Name
Type
General Field
Description
Example
Products
appIsSystem
-
-
Whether the app is a system app
  • false
  • Trend Vision One Mobile Security
appLabel
-
-
The app name (if the subject is an app)
  • Collection Nes Games
  • Trend Vision One Mobile Security
appOrSystemEventHashId
-
-
The event object hash ID
  • 3859886410
  • Trend Vision One Mobile Security
appPkgName
-
-
The app package name (if the subject is an app)
  • com.ConsolesXX.CollectionNesGames
  • Trend Vision One Mobile Security
appPublicKeySha1
-
  • FileSHA1
The SHA-1 hash of the app public key (if the subject is an app)
  • 05FC638156219800DADAC48D8E621E0BCBD3C321
  • Trend Vision One Mobile Security
appSize
-
-
The app size (in bytes) if the subject is an app
  • 16906043
  • Trend Vision One Mobile Security
appVerCode
-
-
The app version code (if the subject is an app)
  • 0
  • Trend Vision One Mobile Security
endpointGuid
-
  • EndpointID
The host GUID of the endpoint on which the event was detected
  • 885fd860-cc63-5c61-9eca-37911c864cc9
  • fbcf0426-c46b-4fe7-b3a8-e6896de49ea3
  • Trend Vision One Mobile Security
endpointHostName
-
  • EndpointName
The hostname of the endpoint on which the event was detected
  • PHILIPSIBE09
  • WHAM6WK8XG2
  • MacBook-Pro-del-Meno
  • Trend Vision One Mobile Security
endpointIp
-
  • IPv4
  • IPv6
The IP address of the endpoint on which the event was detected
  • 127.0.0.1
  • ::1
  • fe80::1
  • Trend Vision One Mobile Security
endpointModel
-
-
The endpoint device model
  • Pixel 3 XL
  • Trend Vision One Mobile Security
eventHashId
-
-
The event hash ID
  • -8406473586387535914
  • 138486453338666581
  • -7909265752378976284
  • Trend Vision One Mobile Security
eventId
-
-
The event type
-
  • Trend Vision One Mobile Security
eventSubId
-
-
The access type
  • 2 - TELEMETRY_PROCESS_CREATE
  • 101 - TELEMETRY_FILE_CREATE
  • 204 - TELEMETRY_CONNECTION_CONNECT_OUTBOUND
  • Trend Vision One Mobile Security
eventTime
-
-
The time the agent detected the event
  • 1657781088000
  • Trend Vision One Mobile Security
extraInfo
-
-
The extra information about the app
  • N/A
  • Web Client Common
  • DCERPC Services
  • Trend Vision One Mobile Security
filterRiskLevel
-
-
The top-level risk level of the event
  • info
  • low
  • medium
  • Security Analytics Engine
firstSeen
-
-
The time when the event started (in milliseconds)
  • 1656355418449
  • Trend Vision One Mobile Security
lastSeen
-
-
The time when the event ended (in milliseconds)
  • 1656355418449
  • Trend Vision One Mobile Security
logReceivedTime
-
-
The time when the XDR log was received
  • 1656324260000
  • Security Analytics Engine
logonUser
-
  • UserAccount
The sign-in user name
  • root
  • SISTEMA
  • oracle
  • Trend Vision One Mobile Security
marsAccount
-
-
The account for Trend Micro Mobile Apps Reputation Service
  • XDRv1
  • Trend Vision One Mobile Security
objectAppBehavior
-
-
The activity that occurred on the app
  • GRANTED_CAMERA_PERMISSION
  • APP_NO_ICON
  • APP_HIDE_ICON
  • Trend Vision One Mobile Security
objectAppBehaviorAttr
-
-
The attributes of the app activity
  • android.intent.action.BOOT_COMPLETED
  • Trend Vision One Mobile Security
objectAppDexSha256
-
  • FileSHA2
The SHA-256 hash of the app Dex value
  • C23A87B77B06442FD9AF9A80DD87191EDEADFAB766C862EBC592FE18063D0449
  • Trend Vision One Mobile Security
objectAppInstalledTime
-
-
The time of app installation (in milliseconds)
  • 1607935850
  • Trend Vision One Mobile Security
objectAppIsSystemApp
-
-
Whether the app is a system app
  • true
  • Trend Vision One Mobile Security
objectAppLabel
-
-
The app name
  • Collection Nes Games
  • Trend Vision One Mobile Security
objectAppPackageName
-
-
The app package name
  • com.ConsolesXX.CollectionNesGames
  • Trend Vision One Mobile Security
objectAppPublicKeySha1
-
  • FileSHA1
The SHA-1 hash of the app public key
  • 05FC638156219800DADAC48D8E621E0BCBD3C321
  • Trend Vision One Mobile Security
objectAppSha256
-
  • FileSHA2
The SHA-256 hash of the app
  • 692BC8E6BC51807A24BEACC13ED2B68E1F954E152863430E3179FA812937B8B0
  • Trend Vision One Mobile Security
objectAppSize
-
-
The app size (in bytes)
  • 16906043
  • Trend Vision One Mobile Security
objectAppVerCode
-
-
The app version code
  • 0
  • Trend Vision One Mobile Security
objectAppVerName
-
-
The app version
  • 1
  • Trend Vision One Mobile Security
objectCertAttr
-
-
The SHA-1 hash of the certificate public key
  • 05FC638156219800DADAC48D8E621E0BCBD3C321
  • Trend Vision One Mobile Security
objectFileCreation
-
-
The time the target file was created (in milliseconds)
  • 1652131848000
  • 1577865600000
  • 1648279273000
  • Trend Vision One Mobile Security
objectFileHashSha256
-
  • FileSHA2
The SHA256 hash of the target process image or target file
  • 39109eef00821658893b45634fe2f4664f880da9242712df907f1327d4ceefb8
  • 49fa3e206abf6a1f4546417dbe09f3f06b38847866a4a66de75bd90f39cb6c1c
  • 0969321ad5a0923f0f03896ad2c10e49290515c44b721d773942a37f62a24893
  • Trend Vision One Mobile Security
objectFileModifiedTime
-
-
The modification time of the target file (in milliseconds)
  • 1652131848000
  • 1577865600000
  • 1648279273000
  • Trend Vision One Mobile Security
objectFilePath
-
  • FileFullPath
  • FileName
The file path of the target process image or target file
  • /usr/bin/bash
  • /bin/bash
  • /opt/nimsoft/probes/system/processes/processes
  • Trend Vision One Mobile Security
objectFileSize
-
-
The target file size
  • 0
  • 59456
  • 60
  • Trend Vision One Mobile Security
objectFirstSeen
-
-
The time when the object first appeared (in milliseconds)
  • 1656458063638
  • 1656260547165
  • 0
  • Trend Vision One Mobile Security
objectHashId
-
-
The event object hash ID
  • 8576474808125313522
  • -599270888483415002
  • 2177864258235728980
  • 2432229257
  • Trend Vision One Mobile Security
objectLastSeen
-
-
The time when the object was last seen (in milliseconds)
  • 1656458354730
  • 1656260580722
  • 0
  • Trend Vision One Mobile Security
objectSystemEventAttr
-
-
The system event attributes
  • LOCK_SCREEN
  • Trend Vision One Mobile Security
osName
-
-
The host OS name
  • Windows
  • Linux
  • macOS
  • Trend Vision One Mobile Security
osVer
-
-
The OS version
  • Amazon Linux 2
  • 10.0.19044
  • 10.0.19042
  • Trend Vision One Mobile Security
pname
-
-
The internal product ID (deprecated, use productCode)
  • 2200
  • 751
  • 533
  • Trend Vision One Mobile Security
policyTreePath
-
-
The policy tree path (endpoint only)
  • policyname1/policyname2/policyname3
  • Security Analytics Engine
productCode
-
-
The internal product code
  • sds
  • xes
  • sao
  • Security Analytics Engine
pver
-
-
The product version
  • 1.2.0.2752
  • 1.0.345
  • 1.2.0.2657
  • Trend Vision One Mobile Security
request
-
  • URL
The request URL
  • http://10.1.222.175/Conserver/CommunicationNode
  • http:///cgi-bin/admin/param.cgi?action=list&group=Alarm.Status
  • http://search.namequery.com/
  • Trend Vision One Mobile Security
srcFileCreation
-
-
The time when the source file was created (in milliseconds)
  • 1577865600000
  • 1626201752000
  • 1626201750000
  • Trend Vision One Mobile Security
srcFileHashId
-
-
The source file hash ID
  • 1102079405020678318
  • -6926286289273504319
  • 8528955148329941480
  • Trend Vision One Mobile Security
srcFileHashSha256
-
  • FileSHA2
The SHA-256 hash of source file
  • 4eaa002225f4ea2dedcd19b7f1337d7c58ea7dd6d4571c12468dde95e6bcfdaf
  • e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
  • 16b20a3ad485b4fbbe3028c7e743b226db21ea93cacc8b3d7d7d4a731bf02333
  • Trend Vision One Mobile Security
srcFileModifiedTime
-
-
The time when the source file was modified (in milliseconds)
  • 1626201752000
  • 1626201750000
  • 1577865600000
  • Trend Vision One Mobile Security
srcFilePath
-
  • FileFullPath
  • FileName
The source file path
  • \\cnva-apps\megaclockprod\traveler\travelerprint.accdb
  • c:\program files\common files\microsoft shared\clicktorun\officesvcmgrschedule.xml
  • q:\a7_dbs\a4_pkg\a4_packaging.accde
  • Trend Vision One Mobile Security
srcFileSize
-
-
The source file size
  • 0
  • 131072
  • 196608
  • Trend Vision One Mobile Security
srcFirstSeen
-
-
The time when the source file first appeared (in milliseconds)
  • 0
  • 1656355418449
  • 1656714760440
  • Trend Vision One Mobile Security
srcLastSeen
-
-
The time when the source file was last seen (in milliseconds)
  • 0
  • 1656355418449
  • 1656715147313
  • Trend Vision One Mobile Security
systemEventAttr
-
-
The attributes of the system event (if the subject is a system event)
  • usbdebugging
  • Trend Vision One Mobile Security
tags
-
  • Technique
The detected technique ID based on the alert filter
  • MITREV9.T1057
  • MITREV9.T1059.003
  • XSAE.F2924
  • Security Analytics Engine
userType
-
-
The user type
  • Microsoft Endpoint Manager
  • Azure Active Directory
  • VMware Workspace ONE UEM
  • Trend Vision One Mobile Security
uuid
-
-
The unique key of the log
  • 00000003-be87-4aad-add2-d395e4efad3e
  • 00000014-0493-459d-9f90-93565402f41e
  • 0000006b-b5ea-4f5e-8d56-ddec452ef3bd
  • Security Analytics Engine