tm-v1-schema

Collaboration sensor

Layer: Email

This documentation provides detailed information about all fields available for Collaboration sensor.

Field Name Type Searchable General Field Description Example Products
actionName string true - The user or service action UserLoggedIn Collaboration sensor
actResult dynamic true - The action result Success Collaboration sensor
applicationId string true - The application ID 11111111-1111-1111-1111-111111111111 Collaboration sensor
clientIp string true
  • IPv4
  • IPv6
 The client IP 10.10.10.10 Collaboration sensor
cloudStorageId string true - The file or folder location ID 11111111-1111-1111-1111-111111111111 Collaboration sensor
cloudStorageName string true - The file or folder URL https://test.trendmicro.com/sites/123 Collaboration sensor
correlationId string true - The correlation ID 11111111-1111-1111-1111-111111111111 Collaboration sensor
eventId int true - The event ID
  • 1 - MESSAGING_EMAIL_META
  • 2 - MESSAGING_COLLABORATION_ACTIVITY
  • Trend Micro Cloud App Security
  • Trend Micro Email Security
  • Email Sensor
  • Collaboration sensor
eventName string true - The event type COLLABORATION_ACTIVITY Collaboration sensor
eventSubName string true - The event type sub-name
  • Audit.Exchange
  • Audit.Sharepoint
  • Audit.General
 Collaboration sensor
extraInfo dynamic true - The additional information about the sharing action <ClientType>SPHomePagesWeb</ClientType> Collaboration sensor
fileExt string true - The file extension (If the object is a folder, there is no value for this field.) jpg Collaboration sensor
fileName string true FileName The file or folder name test.pdf Collaboration sensor
isExternalAccess bool true - Whether the cmdlet was run by an external user (True=external user, False=internal user in your organization) True Collaboration sensor
isSensitiveInfo bool true - Whether the event contains sensitive information True Collaboration sensor
orgName string true - The tenant name test.trendmicro.com Collaboration sensor
originatingServer string true - The server where the operation originated TY0PR03MB6449 (15.20.5746.023) Collaboration sensor
parameters string true - The names and values of all parameters used in the cmdlet identified in the Operations property [{"Name": "AlwaysDeleteOutlookRulesBlob","Value": "False"},{"Name" : "Force","Value": "False"}] Collaboration sensor
principalName string true UserAccount The User Principal Name sample_email@trendmicro.com Collaboration sensor
recordType int true - The operation type
  • 1
  • 2
 Collaboration sensor
service string true - The Microsoft 365 service where the activity occurred
  • SecurityComplianceCenter
  • AzureActiveDirectory
  • SharePoint
 Collaboration sensor
target string true - The object accessed by a user or application
  • APCPR000000.PROD.OUTLOOK.COM/Microsoft Exchange Hosted
  • Organizations/test.trendmicro.com/test\\testRule001
 Collaboration sensor
targetType string true - The type of object that was accessed or modified File Collaboration sensor
userAgent string true - The user agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Collaboration sensor
userSessionId string true - The user session ID 11111111-1111-1111-1111-111111111111 Collaboration sensor
userType string true - The user type
  • Regular
  • Reserved
  • Admin
 Collaboration sensor

Field Statistics

Generated by XDR Common Schema Public Doc Generator V2

This site is open source. Improve this page.