Mobile activity data sources

Views:

Important

This data source query method is no longer available after February 2, 2026. For more information on the currently available data sources for use in XDR Data Explorer queries, go to https://trendmicro.github.io/tm-v1-schema/pages/index.

Field Name	Type	General Field	Description	Example	Products
appIsSystem	`bool`	-	Whether the app is a system app	`false`	Trend Vision One Mobile Security
appLabel	`string`	-	The app name (if the subject is an app)	`Collection Nes Games`	Trend Vision One Mobile Security
appOrSystemEventHashId	`string`	-	The event object hash ID	`3859886410`	Trend Vision One Mobile Security
appPkgName	`string`	-	The app package name (if the subject is an app)	`com.ConsolesXX.CollectionNesGames`	Trend Vision One Mobile Security
appPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key (if the subject is an app)	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
appSize	`string`	-	The app size (in bytes) if the subject is an app	`16906043`	Trend Vision One Mobile Security
appVerCode	`string`	-	The app version code (if the subject is an app)	`0`	Trend Vision One Mobile Security
endpointGuid	`string`	EndpointID	The host GUID of the endpoint on which the event was detected	`11111111-1111-1111-1111-111111111111`	Trend Vision One Mobile Security
endpointHostName	`string`	EndpointName	The hostname of the endpoint on which the event was detected	`PHILIPSIBE09` `WHAM6WK8XG2` `MacBook-Pro-del-Meno`	Trend Vision One Mobile Security
endpointIp	`dynamic`	IPv4 IPv6	The IP address of the endpoint on which the event was detected	`10.10.10.10` `::1` `fe80::1`	Trend Vision One Mobile Security
endpointModel	`string`	-	The endpoint device model	`Pixel 3 XL`	Trend Vision One Mobile Security
eventHashId	`string`	-	The event hash ID	`-8406473586387535914` `138486453338666581` `-7909265752378976284`	Trend Vision One Mobile Security
eventId	`int`	-	The event type	-	Trend Vision One Mobile Security
eventSubId	`int`	-	The access type	`2 - TELEMETRY_PROCESS_CREATE` `101 - TELEMETRY_FILE_CREATE` `204 - TELEMETRY_CONNECTION_CONNECT_OUTBOUND`	Trend Vision One Mobile Security
eventTime	`real`	-	The time the agent detected the event	`1657781088000`	Trend Vision One Mobile Security
extraInfo	`dynamic`	-	The extra information about the app	`N/A` `Web Client Common` `DCERPC Services`	Trend Vision One Mobile Security
filterRiskLevel	`string`	-	The top-level risk level of the event	`info` `low` `medium`	All products
firstSeen	`string`	-	The time when the event started (in milliseconds)	`1656355418449`	Trend Vision One Mobile Security
groupId	`string`	-	The group ID for the management scope filter	`11111111-1111-1111-1111-111111111111`	All products
lastSeen	`string`	-	The time when the event ended (in milliseconds)	`1656355418449`	Trend Vision One Mobile Security
logReceivedTime	`long`	-	The time when the XDR log was received	`1656324260000`	All products
logonUser	`dynamic`	UserAccount	The sign-in user name	`root` `SISTEMA` `oracle`	Trend Vision One Mobile Security
marsAccount	`string`	-	The account for Trend Micro Mobile Apps Reputation Service	`XDRv1`	Trend Vision One Mobile Security
objectAppBehavior	`string`	-	The activity that occurred on the app	`GRANTED_CAMERA_PERMISSION` `APP_NO_ICON` `APP_HIDE_ICON`	Trend Vision One Mobile Security
objectAppBehaviorAttr	`string`	-	The attributes of the app activity	`android.intent.action.BOOT_COMPLETED`	Trend Vision One Mobile Security
objectAppDexSha256	`string`	FileSHA2	The SHA-256 hash of the app Dex value	`C23A87B77B06442FD9AF9A80DD87191EDEADFAB766C862EBC592FE18063D0449`	Trend Vision One Mobile Security
objectAppInstalledTime	`string`	-	The time of app installation (in milliseconds)	`1607935850`	Trend Vision One Mobile Security
objectAppIsSystemApp	`bool`	-	Whether the app is a system app	`true`	Trend Vision One Mobile Security
objectAppLabel	`string`	-	The app name	`Collection Nes Games`	Trend Vision One Mobile Security
objectAppPackageName	`string`	-	The app package name	`com.ConsolesXX.CollectionNesGames`	Trend Vision One Mobile Security
objectAppPublicKeySha1	`string`	FileSHA1	The SHA-1 hash of the app public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
objectAppSha256	`string`	FileSHA2	The SHA-256 hash of the app	`692BC8E6BC51807A24BEACC13ED2B68E1F954E152863430E3179FA812937B8B0`	Trend Vision One Mobile Security
objectAppSize	`string`	-	The app size (in bytes)	`16906043`	Trend Vision One Mobile Security
objectAppVerCode	`string`	-	The app version code	`0`	Trend Vision One Mobile Security
objectAppVerName	`string`	-	The app version	`1`	Trend Vision One Mobile Security
objectCertAttr	`string`	-	The SHA-1 hash of the certificate public key	`05FC638156219800DADAC48D8E621E0BCBD3C321`	Trend Vision One Mobile Security
objectFileCreation	`string`	-	The time the target file was created (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	Trend Vision One Mobile Security
objectFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the target process image or target file	`39109eef00821658893b45634fe2f4664f880da9242712df907f1327d4ceefb8` `49fa3e206abf6a1f4546417dbe09f3f06b38847866a4a66de75bd90f39cb6c1c` `0969321ad5a0923f0f03896ad2c10e49290515c44b721d773942a37f62a24893`	Trend Vision One Mobile Security
objectFileModifiedTime	`string`	-	The modification time of the target file (in milliseconds)	`1652131848000` `1577865600000` `1648279273000`	Trend Vision One Mobile Security
objectFilePath	`string`	FileFullPath FileName	The file path of the target process image or target file	`/usr/bin/bash` `/bin/bash` `/opt/folder1/probes/system/processes/processes`	Trend Vision One Mobile Security
objectFileSize	`string`	-	The target file size	`0` `59456` `60`	Trend Vision One Mobile Security
objectFirstSeen	`string`	-	The time when the object first appeared (in milliseconds)	`1656458063638` `1656260547165` `0`	Trend Vision One Mobile Security
objectHashId	`string`	-	The event object hash ID	`8576474808125313522` `-599270888483415002` `2177864258235728980` `2432229257`	Trend Vision One Mobile Security
objectLastSeen	`string`	-	The time when the object was last seen (in milliseconds)	`1656458354730` `1656260580722` `0`	Trend Vision One Mobile Security
objectSystemEventAttr	`string`	-	The system event attributes	`LOCK_SCREEN`	Trend Vision One Mobile Security
osName	`string`	-	The host OS name	`Windows` `Linux` `macOS`	Trend Vision One Mobile Security
osVer	`string`	-	The OS version	`Amazon Linux 2` `10.0.19044` `10.0.19042`	Trend Vision One Mobile Security
pname	`string`	-	The internal product ID (Deprecated, use productCode)	`2200` `751` `533`	Trend Vision One Mobile Security
policyTreePath	`string`	-	The policy tree path (endpoint only)	`policyname1/policyname2/policyname3`	All products
productCode	`string`	-	The internal product code	`sds` `xes` `sao`	All products
pver	`string`	-	The product version	`1.2.0.2752` `1.0.345` `1.2.0.2657`	Trend Vision One Mobile Security
request	`string`	URL	The request URL	`http://10.10.10.10/fake/site` `http:///fake/param.cgi?action=list&group=Alarm.Status` `http://fake.com/`	Trend Vision One Mobile Security
srcFileCreation	`string`	-	The time when the source file was created (in milliseconds)	`1577865600000` `1626201752000` `1626201750000`	Trend Vision One Mobile Security
srcFileHashId	`string`	-	The source file hash ID	`1102079405020678318` `-6926286289273504319` `8528955148329941480`	Trend Vision One Mobile Security
srcFileHashSha256	`string`	FileSHA2	The SHA-256 hash of the source file	`4eaa002225f4ea2dedcd19b7f1337d7c58ea7dd6d4571c12468dde95e6bcfdaf` `e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80` `16b20a3ad485b4fbbe3028c7e743b226db21ea93cacc8b3d7d7d4a731bf02333`	Trend Vision One Mobile Security
srcFileModifiedTime	`string`	-	The time when the source file was modified (in milliseconds)	`1626201752000` `1626201750000` `1577865600000`	Trend Vision One Mobile Security
srcFilePath	`string`	FileFullPath FileName	The source file path	`\\cnva-apps\megaclockprod\traveler\travelerprint.accdb` `c:\program files\common files\microsoft shared\clicktorun\officesvcmgrschedule.xml` `q:\a7_dbs\a4_pkg\a4_packaging.accde`	Trend Vision One Mobile Security
srcFileSize	`string`	-	The source file size	`0` `131072` `196608`	Trend Vision One Mobile Security
srcFirstSeen	`string`	-	The time when the source file first appeared (in milliseconds)	`0` `1656355418449` `1656714760440`	Trend Vision One Mobile Security
srcLastSeen	`string`	-	The time when the source file was last seen (in milliseconds)	`0` `1656355418449` `1656715147313`	Trend Vision One Mobile Security
systemEventAttr	`string`	-	The attributes of the system event (if the subject is a system event)	`usbdebugging`	Trend Vision One Mobile Security
tags	`dynamic`	Technique	The detected technique ID based on the alert filter	`MITREV9.T1057` `MITREV9.T1059.003` `XSAE.F2924`	All products
userType	`string`	-	The user type	`Microsoft Endpoint Manager` `Azure Active Directory` `VMware Workspace ONE UEM`	Trend Vision One Mobile Security
uuid	`string`	-	The unique key of the log	`11111111-1111-1111-1111-111111111111`	All products