Secure Access Activity Data

Views:

Field Name	General Field	Description	Example	Products
eventSourceType	-	-	EVENT_SOURCE_NETWORK_ACTIVITY	Security Analytics Engine
version	-	-	1.1	Security Analytics Engine
eventTime	-	The event generation time from the agent side	1657135700000	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access Security Analytics Engine Deep Discovery Inspector
customerId	-	-	df1fd66c-dea3-40fb-a78b-1442d6154ecc e0f6a485-204f-4988-9253-f02b6481c205 b48f2239-d797-4967-bf8a-d0861ebb94e9	Security Analytics Engine
tags	Technique	The technique ID detected by the Security Analytics Engine based on the alert filter	MITREV9.T1057 MITREV9.T1059.003 XSAE.F2924	Security Analytics Engine
uuid	-	The unique key of the log	00008a58-5c57-46b2-ad06-335035989d08 0000ca1e-abfa-4013-9213-2dcf5cf1c4d0 0001469c-dc16-469f-8e44-3d02d2057250	Security Analytics Engine
receivedTime	-	The time of the received XDR log	1656324260000	Security Analytics Engine
productCode	-	-	sig szn	Security Analytics Engine
packageTraceId	-	-	00001008-d7ef-4066-9d93-55c3d450bf76 0000202f-92ec-4b8d-8df1-5c8551f33e4b 00002778-c203-4d2e-ac0f-d6c84ea9451b	Security Analytics Engine
filterRiskLevel	-	The event top level filter risk	info low medium	Security Analytics Engine
groupId	-	-	00000000-0000-0000-0000-000000000000	Security Analytics Engine
tenantGuid	-	-	00000000-0000-0000-0000-000000000000	Security Analytics Engine
bitwiseFilterRiskLevel	-	Bitwise filter level	1 2 8	Security Analytics Engine
endpointHostName	EndpointName	-	my_machine jeremy-mbp	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
osName	-	-	Windows 10 macOS 12.1	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
dst	IPv4 IPv6	-	10.10.10.10 10.206.209.64	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
endpointGuid	EndpointID	-	66f0cb71-4150-4437-ba8b-91151bb12345 DSP84573ULLJHM5GK2R7	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
principalName	UserAccount	-	millie.hutchinson@etlsystems.com jeremy_tong@trendmicro.com	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
request	URL	URL request that is usually found in the Web Reputation Services scan	https://google.com/ https://api/example/v1/testit	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access Deep Discovery Inspector
act	-	-	Allow Block	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
src	IPv4 IPv6	Source IP	100.100.100.100 18.162.103.100	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
serverTls	-	-	TLS 1.2	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
serverProtocol	-	-	HTTP/1.1	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
userAgent	-	-	Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Chrome/74.0.3729.108 Safari/537.36	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
rt	-	-	1599465660	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
eventName	-	-	SWG_ACTIVITY_LOG	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access Deep Discovery Inspector
application	-	-	Facebook	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
ruleName	-	-	ETL_Access Rules_Web_Host block_wiki_for_guest	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
clientIp	IPv4 IPv6	-	10.64.23.45	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access Deep Discovery Inspector
requestBase	DomainName HostDomain	The domain of the URL	www.facebook.com gary.webserver64.com	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
score	-	Web Reputation Services score	81	Zero Trust Secure Access Internet Access
userDomain	DomainName AccountDomain	Active Directory domain, domain of the user name signing in to the Trend Micro Anti-Spam administrator portal	etlsystems.com	Zero Trust Secure Access Internet Access Deep Discovery Inspector
suid	UserAccount	User name or IP address (IPv4)	Millie Hutchinson 18.162.103.100	Zero Trust Secure Access Internet Access Deep Discovery Inspector
duration	-	How long it takes the scanner to complete the scan, in milliseconds	1599465660123	Zero Trust Secure Access Internet Access
eventSubName	-	-	OneDrive download file	Zero Trust Secure Access Internet Access
fileHash	FileSHA1	The SHA-1 of the file that is violating the policy	1e15bf99022a9164708cebb3eace8fd61ad45cba	Zero Trust Secure Access Internet Access Deep Discovery Inspector
fileHashSha256	FileSHA2	The SHA-256 of the file that is violating the policy	ba9edecdd09de1307714564c24409bd25508e22fe11c768053a08f173f263e93	Zero Trust Secure Access Internet Access Deep Discovery Inspector
fileName	FileName FileFullPath	The name of file that is violating the policy	word.doc	Zero Trust Secure Access Internet Access Deep Discovery Inspector
fileSize	-	The size of file that is violating the policy	12134	Zero Trust Secure Access Internet Access Deep Discovery Inspector
malName	-	The name of the detected malware	-	Zero Trust Secure Access Internet Access
fileType	-	The type of file that is violating the policy	Microsoft Word	Zero Trust Secure Access Internet Access Deep Discovery Inspector
mimeType	-	The mime type or content type of the response body	Text or HTML	Zero Trust Secure Access Internet Access Deep Discovery Inspector
sender	-	Roaming users or Trend Micro Web Security gateway where the web traffic passed	ETL VPN	Zero Trust Secure Access Internet Access
profile	-	The name of the triggered Threat Protection template or Data Loss Prevention profile	-	Zero Trust Secure Access Internet Access
detectionType	-	Scan type	Does not match any rule Access control	Zero Trust Secure Access Internet Access Zero Trust Secure Access Private Access
userDepartment	-	User department	Sales Department	Zero Trust Secure Access Internet Access
requestMethod	-	The request method of the network protocol	POST	Zero Trust Secure Access Internet Access Deep Discovery Inspector
pname	-	Product name	Zero Trust Secure Access Internet Access	Zero Trust Secure Access Internet Access
pver	-	Product version	1	Zero Trust Secure Access Internet Access
deviceGUID	-	The GUID of an object that is a device but not an endpoint	d1142f61-5bdf-4a48-bee8-b35f7b6c2376	Zero Trust Secure Access Internet Access Deep Discovery Inspector
requestMimeType	-	Request content-type	application/json; charset=utf-8	Zero Trust Secure Access Internet Access Deep Discovery Inspector
tlsJA3Fingerprint	-	JA3 fingerprint	-	Zero Trust Secure Access Internet Access Deep Discovery Inspector
failedHTTPSInspection	-	If the HTTPS traffic failed to be inspected	true	Zero Trust Secure Access Internet Access
responseSize	-	Response length	1324	Zero Trust Secure Access Internet Access
clientProtocol	-	Client protocol	HTTP/1.1	Zero Trust Secure Access Internet Access
clientTls	-	-	TLS 1.2	Zero Trust Secure Access Internet Access
contentEncoding	-	Response or request content-encoding	gzip	Zero Trust Secure Access Internet Access
authType	-	Authorization type	Cookie	Zero Trust Secure Access Internet Access
requestSize	-	Request length	1324	Zero Trust Secure Access Internet Access
serverRespTime	-	How long it takes for the server to respond to the request, in milliseconds	1599465660123	Zero Trust Secure Access Internet Access
trafficType	-	-	Forward	Zero Trust Secure Access Internet Access
urlCat	-	URL category	Social Networking	Zero Trust Secure Access Internet Access
ruleType	-	-	access	Zero Trust Secure Access Private Access
ruleUuid	-	Designed for risk assessment and control, defined by Zero Trust Secure Access risk control rules	12340518-abd7-43e1-9b73-2f55c4c95a8e	Zero Trust Secure Access Private Access
objectId	-	The UUID of Zero Trust Secure Access Private Access	6f1fe071-9636-4c99-9a4d-c9f6d409a4c8	Zero Trust Secure Access Private Access
spt	Port	The virtual port assigned to the Zero Trust Secure Access agent	57763	Zero Trust Secure Access Private Access
policyUuid	-	UUID of private access or risk control rules in Zero Trust Secure Access	afef0518-abd7-43e1-9b73-2f55c4c95a8e	Zero Trust Secure Access Private Access
dpt	Port	Service port of the private application server	443	Zero Trust Secure Access Private Access
companyName	-	The company name	Trend Micro	Zero Trust Secure Access Private Access
start	-	Start time, in milliseconds	1575462989	Zero Trust Secure Access Private Access
sessionStart	-	Session start time, in seconds	1575462989	Zero Trust Secure Access Private Access Deep Discovery Inspector
sessionEnd	-	Session end time, in seconds	1575462989	Zero Trust Secure Access Private Access Deep Discovery Inspector
policyTemplate	-	Data Loss Prevention template names	Australia, New Zealand: Healthcare Template, Germany: Banking and Financial Information	Zero Trust Secure Access Internet Access
serverIp	IPv4 IPv6	Server IP address	104.210.35.94	Deep Discovery Inspector
clientPort	Port	Client port number	5566	Deep Discovery Inspector
serverPort	Port	Server port number	443	Deep Discovery Inspector
clientMAC	-	Client MAC address	00-08-e3-ff-fd-90	Deep Discovery Inspector
serverMAC	-	Server MAC address	58-35-d9-de-4a-42	Deep Discovery Inspector
flowId	-	NA flow ID	6837014561409730558	Deep Discovery Inspector
status	-	The connection status of the NA flow	2	Deep Discovery Inspector
app	-	Application layer protocol	HTTP	Deep Discovery Inspector
httpReferer	URL	HTTP referrer header	www.google.com.tw	Deep Discovery Inspector
httpXForwardedFor	-	HTTP x-forwarded-for header	192.168.1.103, 192.168.1.104, 192.168.1.106	Deep Discovery Inspector
requestClientApplication	-	HTTP user agent	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36	Deep Discovery Inspector
requestDate	-	HTTP date header	Fri, 20 Oct 2017 06:02:09 GMT	Deep Discovery Inspector
requestHeaders	-	All HTTP headers without sensitive information	Host: 192.168.1.201:8080 User-Agent: curl/7.78.0 Accept: /	Deep Discovery Inspector
overSsl	-	If the connection is over SSL protocol or not	YES	Deep Discovery Inspector
respCode	-	The response code of the network protocol	200 25	Deep Discovery Inspector
respDate	-	HTTP response date header	Fri, 20 Oct 2017 06:02:09 GMT	Deep Discovery Inspector
httpLocation	URL	HTTP location header	www.google.com.tw	Deep Discovery Inspector
respHeaders	-	All HTTP response headers without sensitive information	Accept-Ranges: bytes Content-Length: 68 Content-Type: text/plain; charset=utf-8 Last-Modified: Thu, 19 Aug 2021 06:23:54 GMT Date: Thu, 19 Aug 2021 06:24:00 GMT	Deep Discovery Inspector
respFileHash	FileSHA1	The SHA-1 of the file detected in response direction	f17d9c55dea88f9aec8f74363f01e918cffb4142	Deep Discovery Inspector
respFileHashSha256	FileSHA2	The SHA-256 of the file detected in response direction	5ad4396d67f0c9d54572f051e28e9e62f4010c269a953d25259b17ad5fab4fd5	Deep Discovery Inspector
respFileType	-	The file type of the file detected in response direction	PKZIP	Deep Discovery Inspector
respArchFiles	-	Information from files extracted from the file detected in response direction	null	Deep Discovery Inspector
httpXForwardedForIp	IPv4 IPv6	The x-forwarded-for IP used by the sensor	192.168.1.103	Deep Discovery Inspector
httpXForwardedForPort	-	The patched HTTP server port when the sensor selects an x-forwarded-for IP to use	65535	Deep Discovery Inspector
resolvedUrlIp	IPv4 IPv6	The IP of the URL FQDN	142.251.43.3	Deep Discovery Inspector
resolvedUrlPort	Port	The port of the HTTP server	443	Deep Discovery Inspector
respMethod	-	The response method	KRB_ERROR AS_REP	Deep Discovery Inspector
msgId	EmailMessageID	The message ID provided by the service provider	b03cf177d9bf4e2f834cd3a005b2cc4b@12345.com.tw	Deep Discovery Inspector
mailMsgSubject	EmailSubject	The email subject	test	Deep Discovery Inspector
suser	EmailSender	The email sender	P1234567_C12345@12345.com.tw	Deep Discovery Inspector
duser	EmailRecipient	The email recipient	p1234567@xxxxxx.tw	Deep Discovery Inspector
requests	URL	URLs	www.google.com.tw www.12345micro.com	Deep Discovery Inspector
direction	-	The object transfer direction	Download	Deep Discovery Inspector
archFiles	-	-	null	Deep Discovery Inspector
hostName	DomainName HostDomain	The host name	NJ-EFFY-ZHAO1	Deep Discovery Inspector
tlsSelectedCipher	-	The selected cipher of TLS protocol	c02f	Deep Discovery Inspector
sslCertCommonName	-	The common name of the certificate	*.www.yahoo.com	Deep Discovery Inspector
sslCertIssuer	-	The issuer of the certificate	/C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA	Deep Discovery Inspector
sslCertValidFrom	-	The time that the certificate starts to be valid	2014-11-21T02:43:28	Deep Discovery Inspector
sslCertValidUntil	-	The time that the certificate stops being valid	2018-11-21T02:43:28	Deep Discovery Inspector
sslCertSerialNumber	-	The serial number of the certificate	0888b1ad2a593310593f47565a5a5a4a	Deep Discovery Inspector
sslCertSANs	-	The subject alternative name of the certificate	*.www.yahoo.com add.my.yahoo.com au.yahoo.com	Deep Discovery Inspector
sslCertFingerprint	-	The fingerprint of the certificate	3914af80223c833f26df001cbf342eff8a31aba1	Deep Discovery Inspector
ja3Hash	-	JA3 hash	478e74fad764c966f19c5232c7cdfc5a	Deep Discovery Inspector
ja3sHash	-	JA3S hash	6d37fb1b3306d6e9f875650d8eb74b4f	Deep Discovery Inspector
tlsJA3SFingerprint	-	JA3S raw	771,157,65281-15	Deep Discovery Inspector
ftpTrans	-	Transaction information of the FTP protocol	null	Deep Discovery Inspector
customFilterTags	Technique	The filter ID matched by XDR based on custom filters	XCUS.CF0131 USER.HELLOWORLD	Security Analytics Engine
customFilterRiskLevel	-	The top-level risk level of the event by custom filter	info low medium high critical	Security Analytics Engine
e2eLatency	-	The latency time of the E2E traffic, in milliseconds	10000	Zero Trust Secure Access Internet Access