Mobile Activity Data | Trend Micro Service Central

Views:

Field Name	Type	General Field	Description	Example	Products
appIsSystem	`bool`	-	Whether the app is a system app	`false`	Trend Vision One Mobile Security
appLabel	`string`	-	The app name (if the subject is an app)	`Collection Nes Games`	Trend Vision One Mobile Security
appOrSystemEventHashId	`string`	-	The event object hash ID	`3859886410`	Trend Vision One Mobile Security
appPkgName	`string`	-	The app package name (if the subject is an app)	`com.ConsolesXX.CollectionNesGames`	Trend Vision One Mobile Security
appPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key (if the subject is an app)	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
appSize	`int64`	-	The app size (in bytes) if the subject is an app	`16906043`	Trend Vision One Mobile Security
appVerCode	`int64`	-	The app version code (if the subject is an app)	`0`	Trend Vision One Mobile Security
endpointGuid	`string`	EndpointID	The host GUID of the endpoint on which the event was detected	`11111111-1111-1111-1111-111111111111`	Trend Vision One Mobile Security
endpointHostName	`string`	EndpointName	The hostname of the endpoint on which the event was detected	`PHILIPSIBE09` `WHAM6WK8XG2` `MacBook-Pro-del-Meno`	Trend Vision One Mobile Security
endpointIp	`string[]`	IPv4 IPv6	The IP address of the endpoint on which the event was detected	`10.10.10.10` `::1` `fe80::1`	Trend Vision One Mobile Security
endpointModel	`string`	-	The endpoint device model	`Pixel 3 XL`	Trend Vision One Mobile Security
eventHashId	`int64`	-	The event hash ID	`-8406473586387535914` `138486453338666581` `-7909265752378976284`	Trend Vision One Mobile Security
eventId	`enum_TelemetryHeader.TELEMETRY_EVENT_ID`	-	The event type	-	Trend Vision One Mobile Security
eventSubId	`enum_TelemetryHeader.TELEMETRY_EVENT_SUB_ID`	-	The access type	`2 - TELEMETRY_PROCESS_CREATE` `101 - TELEMETRY_FILE_CREATE` `204 - TELEMETRY_CONNECTION_CONNECT_OUTBOUND`	Trend Vision One Mobile Security
eventTime	`int64`	-	The time the agent detected the event	`1657781088000`	Trend Vision One Mobile Security
extraInfo	`string[]`	-	The extra information about the app	`N/A` `Web Client Common` `DCERPC Services`	Trend Vision One Mobile Security
filterRiskLevel	`string`	-	The top-level risk level of the event	`info` `low` `medium`	Security Analytics Engine
firstSeen	`int64`	-	The time when the event started (in milliseconds)	`1656355418449`	Trend Vision One Mobile Security
groupId	`string`	-	The group ID for the management scope filter	`11111111-1111-1111-1111-111111111111`	Security Analytics Engine
lastSeen	`int64`	-	The time when the event ended (in milliseconds)	`1656355418449`	Trend Vision One Mobile Security
logReceivedTime	`int64`	-	The time when the XDR log was received	`1656324260000`	Security Analytics Engine
logonUser	`string[]`	UserAccount	The sign-in user name	`root` `SISTEMA` `oracle`	Trend Vision One Mobile Security
marsAccount	`string`	-	The account for Trend Micro Mobile Apps Reputation Service	`XDRv1`	Trend Vision One Mobile Security
objectAppBehavior	`string`	-	The activity that occurred on the app	`GRANTED_CAMERA_PERMISSION` `APP_NO_ICON` `APP_HIDE_ICON`	Trend Vision One Mobile Security
objectAppBehaviorAttr	`string`	-	The attributes of the app activity	`android.intent.action.BOOT_COMPLETED`	Trend Vision One Mobile Security
objectAppDexSha256	`string`	FileSHA2	The SHA-256 hash of the app Dex value	`C23A87B77B06442FD9AF9A80DD87191EDEADFAB766C862EBC592FE18063D0449`	Trend Vision One Mobile Security
objectAppInstalledTime	`int64`	-	The time of app installation (in milliseconds)	`1607935850`	Trend Vision One Mobile Security
objectAppIsSystemApp	`bool`	-	Whether the app is a system app	`true`	Trend Vision One Mobile Security
objectAppLabel	`string`	-	The app name	`Collection Nes Games`	Trend Vision One Mobile Security
objectAppPackageName	`string`	-	The app package name	`com.ConsolesXX.CollectionNesGames`	Trend Vision One Mobile Security
objectAppPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
objectAppSha256	`string`	FileSHA2	The SHA-256 hash of the app	`692BC8E6BC51807A24BEACC13ED2B68E1F954E152863430E3179FA812937B8B0`	Trend Vision One Mobile Security
objectAppSize	`int64`	-	The app size (in bytes)	`16906043`	Trend Vision One Mobile Security
objectAppVerCode	`string`	-	The app version code	`0`	Trend Vision One Mobile Security
objectAppVerName	`string`	-	The app version	`1`	Trend Vision One Mobile Security
objectCertAttr	`string`	-	The SHA-1 hash of the certificate public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
objectFileCreation	`int64`	-	The time the target file was created (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	Trend Vision One Mobile Security
objectFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the target process image or target file	`39109eef00821658893b45634fe2f4664f880da9242712df907f1327d4ceefb8` `49fa3e206abf6a1f4546417dbe09f3f06b38847866a4a66de75bd90f39cb6c1c` `0969321ad5a0923f0f03896ad2c10e49290515c44b721d773942a37f62a24893`	Trend Vision One Mobile Security
objectFileModifiedTime	`int64`	-	The modification time of the target file (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	Trend Vision One Mobile Security
objectFilePath	`string`	FileFullPath FileName	The file path of the target process image or target file	`/usr/bin/bash` `/bin/bash` `/opt/folder1/probes/system/processes/processes`	Trend Vision One Mobile Security
objectFileSize	`int64`	-	The target file size	`0` `59456` `60`	Trend Vision One Mobile Security
objectFirstSeen	`int64`	-	The time when the object first appeared (in milliseconds)	`1656458063638` `1656260547165` `0`	Trend Vision One Mobile Security
objectHashId	`int64`	-	The event object hash ID	`8576474808125313522` `-599270888483415002` `2177864258235728980` `2432229257`	Trend Vision One Mobile Security
objectLastSeen	`int64`	-	The time when the object was last seen (in milliseconds)	`1656458354730` `1656260580722` `0`	Trend Vision One Mobile Security
objectSystemEventAttr	`string`	-	The system event attributes	`LOCK_SCREEN`	Trend Vision One Mobile Security
osName	`string`	-	The host OS name	`Windows` `Linux` `macOS`	Trend Vision One Mobile Security
osVer	`string`	-	The OS version	`Amazon Linux 2` `10.0.19044` `10.0.19042`	Trend Vision One Mobile Security
pname	`string`	-	The internal product ID (deprecated, use productCode)	`2200` `751` `533`	Trend Vision One Mobile Security
policyTreePath	`string`	-	The policy tree path (endpoint only)	`policyname1/policyname2/policyname3`	Security Analytics Engine
productCode	`string`	-	The internal product code	`sds` `xes` `sao`	Security Analytics Engine
pver	`string`	-	The product version	`1.2.0.2752` `1.0.345` `1.2.0.2657`	Trend Vision One Mobile Security
request	`string`	URL	The request URL	`http://10.10.10.10/fake/site` `http:///fake/param.cgi?action=list&group=Alarm.Status` `http://fake.com/`	Trend Vision One Mobile Security
srcFileCreation	`int64`	-	The time when the source file was created (in milliseconds)	`1577865600000` `1626201752000` `1626201750000`	Trend Vision One Mobile Security
srcFileHashId	`int64`	-	The source file hash ID	`1102079405020678318` `-6926286289273504319` `8528955148329941480`	Trend Vision One Mobile Security
srcFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the source file	`4eaa002225f4ea2dedcd19b7f1337d7c58ea7dd6d4571c12468dde95e6bcfdaf` `e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80` `16b20a3ad485b4fbbe3028c7e743b226db21ea93cacc8b3d7d7d4a731bf02333`	Trend Vision One Mobile Security
srcFileModifiedTime	`int64`	-	The time when the source file was modified (in milliseconds)	`1626201752000` `1626201750000` `1577865600000`	Trend Vision One Mobile Security
srcFilePath	`string`	FileFullPath FileName	The source file path	`\\cnva-apps\megaclockprod\traveler\travelerprint.accdb` `c:\program files\common files\microsoft shared\clicktorun\officesvcmgrschedule.xml` `q:\a7_dbs\a4_pkg\a4_packaging.accde`	Trend Vision One Mobile Security
srcFileSize	`int64`	-	The source file size	`0` `131072` `196608`	Trend Vision One Mobile Security
srcFirstSeen	`int64`	-	The time when the source file first appeared (in milliseconds)	`0` `1656355418449` `1656714760440`	Trend Vision One Mobile Security
srcLastSeen	`int64`	-	The time when the source file was last seen (in milliseconds)	`0` `1656355418449` `1656715147313`	Trend Vision One Mobile Security
systemEventAttr	`string`	-	The attributes of the system event (if the subject is a system event)	`usbdebugging`	Trend Vision One Mobile Security
tags	`string[]`	Technique	The detected technique ID based on the alert filter	`MITREV9.T1057` `MITREV9.T1059.003` `XSAE.F2924`	Security Analytics Engine
userType	`string`	-	The user type	`Microsoft Endpoint Manager` `Azure Active Directory` `VMware Workspace ONE UEM`	Trend Vision One Mobile Security
uuid	`string`	-	The unique key of the log	`11111111-1111-1111-1111-111111111111`	Security Analytics Engine