Data Mapping: Network Activity Data

Table 1. Network Activity Data

Field Name

General Field

Description

Example

Products

eventSourceType

-

-

  • EVENT_SOURCE_NETWORK_ACTIVITY

  • Security Analytics Engine

version

-

-

  • 1.1

  • Security Analytics Engine

eventTime

-

The event generation time from the agent side

  • 1657135700000

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

  • Security Analytics Engine

  • Deep Discovery Inspector

customerId

-

-

  • df1fd66c-dea3-40fb-a78b-1442d6154ecc

  • e0f6a485-204f-4988-9253-f02b6481c205

  • b48f2239-d797-4967-bf8a-d0861ebb94e9

  • Security Analytics Engine

tags

  • Technique

The technique ID detected by the Security Analytics Engine based on the alert filter

  • MITREV9.T1057

  • MITREV9.T1059.003

  • XSAE.F2924

  • Security Analytics Engine

uuid

-

The unique key of the log

  • 00008a58-5c57-46b2-ad06-335035989d08

  • 0000ca1e-abfa-4013-9213-2dcf5cf1c4d0

  • 0001469c-dc16-469f-8e44-3d02d2057250

  • Security Analytics Engine

receivedTime

-

The time of the received XDR log

  • 1656324260000

  • Security Analytics Engine

productCode

-

-

  • sig

  • szn

  • Security Analytics Engine

packageTraceId

-

-

  • 00001008-d7ef-4066-9d93-55c3d450bf76

  • 0000202f-92ec-4b8d-8df1-5c8551f33e4b

  • 00002778-c203-4d2e-ac0f-d6c84ea9451b

  • Security Analytics Engine

filterRiskLevel

-

The event top level filter risk

  • info

  • low

  • medium

  • Security Analytics Engine

groupId

-

-

  • 00000000-0000-0000-0000-000000000000

  • Security Analytics Engine

tenantGuid

-

-

  • 00000000-0000-0000-0000-000000000000

  • Security Analytics Engine

bitwiseFilterRiskLevel

-

Bitwise filter level

  • 1

  • 2

  • 8

  • Security Analytics Engine

endpointHostName

  • EndpointName

-

  • my_machine

  • jeremy-mbp

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

osName

-

-

  • Windows 10

  • macOS 12.1

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

dst

  • IPv4

  • IPv6

-

  • 10.10.10.10

  • 10.206.209.64

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

endpointGuid

  • EndpointID

-

  • 66f0cb71-4150-4437-ba8b-91151bb12345

  • DSP84573ULLJHM5GK2R7

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

principalName

  • UserAccount

-

  • millie.hutchinson@etlsystems.com

  • jeremy_tong@trendmicro.com

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

request

  • URL

URL request that is usually found in the Web Reputation Services scan

  • https://google.com/

  • https://api/example/v1/testit

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

  • Deep Discovery Inspector

act

-

-

  • Allow

  • Block

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

src

  • IPv4

  • IPv6

Source IP

  • 100.100.100.100

  • 18.162.103.100

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

serverTls

-

-

  • TLS 1.2

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

serverProtocol

-

-

  • HTTP/1.1

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

userAgent

-

-

  • Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0)

  • Chrome/74.0.3729.108 Safari/537.36

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

rt

-

-

  • 1599465660

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

eventName

-

-

  • SWG_ACTIVITY_LOG

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

  • Deep Discovery Inspector

application

-

-

  • Facebook

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

ruleName

-

-

  • ETL_Access Rules_Web_Host

  • block_wiki_for_guest

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

clientIp

  • IPv4

  • IPv6

-

  • 10.64.23.45

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

  • Deep Discovery Inspector

requestBase

  • DomainName

  • HostDomain

The domain of the URL

  • www.facebook.com

  • gary.webserver64.com

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

score

-

Web Reputation Services score

  • 81

  • Zero Trust Secure Access Internet Access

userDomain

  • DomainName

  • AccountDomain

Active Directory domain, domain of the user name signing in to the Trend Micro Anti-Spam administrator portal

  • etlsystems.com

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

suid

  • UserAccount

User name or IP address (IPv4)

  • Millie Hutchinson

  • 18.162.103.100

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

duration

-

How long it takes the scanner to complete the scan, in milliseconds

  • 1599465660123

  • Zero Trust Secure Access Internet Access

eventSubName

-

-

  • OneDrive download file

  • Zero Trust Secure Access Internet Access

fileHash

  • FileSHA1

The SHA-1 of the file that is violating the policy

  • 1e15bf99022a9164708cebb3eace8fd61ad45cba

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

fileHashSha256

  • FileSHA2

The SHA-256 of the file that is violating the policy

  • ba9edecdd09de1307714564c24409bd25508e22fe11c768053a08f173f263e93

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

fileName

  • FileName

  • FileFullPath

The name of file that is violating the policy

  • word.doc

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

fileSize

-

The size of file that is violating the policy

  • 12134

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

malName

-

The name of the detected malware

-

  • Zero Trust Secure Access Internet Access

fileType

-

The type of file that is violating the policy

  • Microsoft Word

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

mimeType

-

The mime type or content type of the response body

  • Text or HTML

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

sender

-

Roaming users or Trend Micro Web Security gateway where the web traffic passed

  • ETL VPN

  • Zero Trust Secure Access Internet Access

profile

-

The name of the triggered Threat Protection template or Data Loss Prevention profile

-

  • Zero Trust Secure Access Internet Access

detectionType

-

Scan type

  • Does not match any rule

  • Access control

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Private Access

userDepartment

-

User department

  • Sales Department

  • Zero Trust Secure Access Internet Access

requestMethod

-

The request method of the network protocol

  • POST

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

pname

-

Product name

  • Zero Trust Secure Access Internet Access

  • Zero Trust Secure Access Internet Access

pver

-

Product version

  • 1

  • Zero Trust Secure Access Internet Access

deviceGUID

-

The GUID of an object that is a device but not an endpoint

  • d1142f61-5bdf-4a48-bee8-b35f7b6c2376

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

requestMimeType

-

Request content-type

  • application/json; charset=utf-8

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

tlsJA3Fingerprint

-

JA3 fingerprint

-

  • Zero Trust Secure Access Internet Access

  • Deep Discovery Inspector

failedHTTPSInspection

-

If the HTTPS traffic failed to be inspected

  • true

  • Zero Trust Secure Access Internet Access

responseSize

-

Response length

  • 1324

  • Zero Trust Secure Access Internet Access

clientProtocol

-

Client protocol

  • HTTP/1.1

  • Zero Trust Secure Access Internet Access

clientTls

-

-

  • TLS 1.2

  • Zero Trust Secure Access Internet Access

contentEncoding

-

Response or request content-encoding

  • gzip

  • Zero Trust Secure Access Internet Access

authType

-

Authorization type

  • Cookie

  • Zero Trust Secure Access Internet Access

requestSize

-

Request length

  • 1324

  • Zero Trust Secure Access Internet Access

serverRespTime

-

How long it takes for the server to respond to the request, in milliseconds

  • 1599465660123

  • Zero Trust Secure Access Internet Access

trafficType

-

-

  • Forward

  • Zero Trust Secure Access Internet Access

urlCat

-

URL category

  • Social Networking

  • Zero Trust Secure Access Internet Access

ruleType

-

-

  • access

  • Zero Trust Secure Access Private Access

ruleUuid

-

Designed for risk assessment and control, defined by Zero Trust Secure Access risk control rules

  • 12340518-abd7-43e1-9b73-2f55c4c95a8e

  • Zero Trust Secure Access Private Access

objectId

-

The UUID of Zero Trust Secure Access Private Access

  • 6f1fe071-9636-4c99-9a4d-c9f6d409a4c8

  • Zero Trust Secure Access Private Access

spt

  • Port

The virtual port assigned to the Zero Trust Secure Access agent

  • 57763

  • Zero Trust Secure Access Private Access

policyUuid

-

UUID of private access or risk control rules in Zero Trust Secure Access

  • afef0518-abd7-43e1-9b73-2f55c4c95a8e

  • Zero Trust Secure Access Private Access

dpt

  • Port

Service port of the private application server

  • 443

  • Zero Trust Secure Access Private Access

companyName

-

The company name

  • Trend Micro

  • Zero Trust Secure Access Private Access

start

-

Start time, in milliseconds

  • 1575462989

  • Zero Trust Secure Access Private Access

sessionStart

-

Session start time, in seconds

  • 1575462989

  • Zero Trust Secure Access Private Access

  • Deep Discovery Inspector

sessionEnd

-

Session end time, in seconds

  • 1575462989

  • Zero Trust Secure Access Private Access

  • Deep Discovery Inspector

policyTemplate

-

Data Loss Prevention template names

  • Australia, New Zealand: Healthcare Template, Germany: Banking and Financial Information

  • Zero Trust Secure Access Internet Access

serverIp

  • IPv4

  • IPv6

Server IP address

  • 104.210.35.94

  • Deep Discovery Inspector

clientPort

  • Port

Client port number

  • 5566

  • Deep Discovery Inspector

serverPort

  • Port

Server port number

  • 443

  • Deep Discovery Inspector

clientMAC

-

Client MAC address

  • 00-08-e3-ff-fd-90

  • Deep Discovery Inspector

serverMAC

-

Server MAC address

  • 58-35-d9-de-4a-42

  • Deep Discovery Inspector

flowId

-

NA flow ID

  • 6837014561409730558

  • Deep Discovery Inspector

status

-

The connection status of the NA flow

  • 2

  • Deep Discovery Inspector

app

-

Application layer protocol

  • HTTP

  • Deep Discovery Inspector

httpReferer

  • URL

HTTP referrer header

  • www.google.com.tw

  • Deep Discovery Inspector

httpXForwardedFor

-

HTTP x-forwarded-for header

  • 192.168.1.103, 192.168.1.104, 192.168.1.106

  • Deep Discovery Inspector

requestClientApplication

-

HTTP user agent

  • Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36

  • Deep Discovery Inspector

requestDate

-

HTTP date header

  • Fri, 20 Oct 2017 06:02:09 GMT

  • Deep Discovery Inspector

requestHeaders

-

All HTTP headers without sensitive information

  • Host: 192.168.1.201:8080 User-Agent: curl/7.78.0 Accept: */*

  • Deep Discovery Inspector

overSsl

-

If the connection is over SSL protocol or not

  • YES

  • Deep Discovery Inspector

respCode

-

The response code of the network protocol

  • 200

  • 25

  • Deep Discovery Inspector

respDate

-

HTTP response date header

  • Fri, 20 Oct 2017 06:02:09 GMT

  • Deep Discovery Inspector

httpLocation

  • URL

HTTP location header

  • www.google.com.tw

  • Deep Discovery Inspector

respHeaders

-

All HTTP response headers without sensitive information

  • Accept-Ranges: bytes Content-Length: 68 Content-Type: text/plain; charset=utf-8 Last-Modified: Thu, 19 Aug 2021 06:23:54 GMT Date: Thu, 19 Aug 2021 06:24:00 GMT

  • Deep Discovery Inspector

respFileHash

  • FileSHA1

The SHA-1 of the file detected in response direction

  • f17d9c55dea88f9aec8f74363f01e918cffb4142

  • Deep Discovery Inspector

respFileHashSha256

  • FileSHA2

The SHA-256 of the file detected in response direction

  • 5ad4396d67f0c9d54572f051e28e9e62f4010c269a953d25259b17ad5fab4fd5

  • Deep Discovery Inspector

respFileType

-

The file type of the file detected in response direction

  • PKZIP

  • Deep Discovery Inspector

respArchFiles

-

Information from files extracted from the file detected in response direction

  • null

  • Deep Discovery Inspector

httpXForwardedForIp

  • IPv4

  • IPv6

The x-forwarded-for IP used by the sensor

  • 192.168.1.103

  • Deep Discovery Inspector

httpXForwardedForPort

-

The patched HTTP server port when the sensor selects an x-forwarded-for IP to use

  • 65535

  • Deep Discovery Inspector

resolvedUrlIp

  • IPv4

  • IPv6

The IP of the URL FQDN

  • 142.251.43.3

  • Deep Discovery Inspector

resolvedUrlPort

  • Port

The port of the HTTP server

  • 443

  • Deep Discovery Inspector

respMethod

-

The response method

  • KRB_ERROR

  • AS_REP

  • Deep Discovery Inspector

msgId

  • EmailMessageID

The message ID provided by the service provider

  • b03cf177d9bf4e2f834cd3a005b2cc4b@12345.com.tw

  • Deep Discovery Inspector

mailMsgSubject

  • EmailSubject

The email subject

  • test

  • Deep Discovery Inspector

suser

  • EmailSender

The email sender

  • P1234567_C12345@12345.com.tw

  • Deep Discovery Inspector

duser

  • EmailRecipient

The email recipient

  • p1234567@xxxxxx.tw

  • Deep Discovery Inspector

requests

  • URL

URLs

  • www.google.com.tw

  • www.12345micro.com

  • Deep Discovery Inspector

direction

-

The object transfer direction

  • Download

  • Deep Discovery Inspector

archFiles

-

-

  • null

  • Deep Discovery Inspector

hostName

  • DomainName

  • HostDomain

The host name

  • NJ-EFFY-ZHAO1

  • Deep Discovery Inspector

tlsSelectedCipher

-

The selected cipher of TLS protocol

  • c02f

  • Deep Discovery Inspector

sslCertCommonName

-

The common name of the certificate

  • *.www.yahoo.com

  • Deep Discovery Inspector

sslCertIssuer

-

The issuer of the certificate

  • /C=US/O=DigiCert Inc/OU=www.digicert.com/CN=DigiCert SHA2 High Assurance Server CA

  • Deep Discovery Inspector

sslCertValidFrom

-

The time that the certificate starts to be valid

  • 2014-11-21T02:43:28

  • Deep Discovery Inspector

sslCertValidUntil

-

The time that the certificate stops being valid

  • 2018-11-21T02:43:28

  • Deep Discovery Inspector

sslCertSerialNumber

-

The serial number of the certificate

  • 0888b1ad2a593310593f47565a5a5a4a

  • Deep Discovery Inspector

sslCertSANs

-

The subject alternative name of the certificate

  • *.www.yahoo.com

  • add.my.yahoo.com

  • au.yahoo.com

  • Deep Discovery Inspector

sslCertFingerprint

-

The fingerprint of the certificate

  • 3914af80223c833f26df001cbf342eff8a31aba1

  • Deep Discovery Inspector

ja3Hash

-

JA3 hash

  • 478e74fad764c966f19c5232c7cdfc5a

  • Deep Discovery Inspector

ja3sHash

-

JA3S hash

  • 6d37fb1b3306d6e9f875650d8eb74b4f

  • Deep Discovery Inspector

tlsJA3SFingerprint

-

JA3S raw

  • 771,157,65281-15

  • Deep Discovery Inspector

ftpTrans

-

Transaction information of the FTP protocol

  • null

  • Deep Discovery Inspector

customFilterTags

  • Technique

The filter ID matched by XDR based on custom filters

  • XCUS.CF0131

  • USER.HELLOWORLD

  • Security Analytics Engine

customFilterRiskLevel

-

The top-level risk level of the event by custom filter

  • info

  • low

  • medium

  • high

  • critical

  • Security Analytics Engine

e2eLatency

-

The latency time of the E2E traffic, in milliseconds

  • 10000

  • Zero Trust Secure Access Internet Access
Parent topic: Search Method Data Sources