tm-v1-schema

Audit Log

Layer: Others

This documentation provides detailed information about all fields available for Audit Log.

Field Name Type Searchable General Field Description Example Products
eventRawData dynamic true - The original event log string (JSON format) {"type":"audit","timestamp":"2020-02-20T08:10:01.904Z","serviceName":"uic","componentName":"backend","siteName":"us-east-1-xdr-eks-prod","customerId":"74b629cb-8fc6-4a1b-a00f-b5003ab9f0e3","identifier":{"id":"db09668d-9d85-42ee-946f-5f8d37f288b2","type":"managedAccount","name":"John Smith","email":"john_smith@abc.com"},"userId":"db09668d-9d85-42ee-946f-5f8d37f288b2","user":"xdr-stg@trendmicro.com","roleId":"53a580c5-d952-43e1-8ce3-79eac4961ee6","role":"admin","sourceIp":"180.10.1.2","access":0,"category":"01","activity":"01","result":true,"triggerService":"awb","details":{"ipAddr":"10.0.0.1"}} Audit Log
eventSourceType int true - The event source type 14 - EVENT_SOURCE_AUDIT_LOG Audit Log
eventTime long true - The time the agent or product detected the event
  • 1656324260000
  • 1728192606034
  • 1758293606034
 Audit Log
filterRiskLevel string true - The top level filter risk of the event
  • info
  • low
  • medium
 Audit Log
groupId string true - The group ID for the management scope filter 11111111-1111-1111-1111-111111111111 Audit Log
groupName string false - The group name example.com Audit Log
logReceivedTime long true - The time when the XDR log was received 1656324260000 Audit Log
policyTreePath string true - The policy tree path policyname1/policyname2/policyname3 Audit Log
productCode string true - The product code aal Audit Log
tags dynamic true
  • Technique
  • Tactic
 The detected technique ID based on the alert filter
  • ['MITREV9.T1090']
  • ['MITRE.T1071']
  • ['MITREV9.T1059.001']
 Audit Log
uuid guid true - The unique key of the log 11111111-1111-1111-1111-111111111111 Audit Log

Field Statistics

Generated by XDR Common Schema Public Doc Generator V2

This site is open source. Improve this page.