Data Dictionary
The data dictionary describes:
Device Field Names
This table contains the device field names and sample values imported into the index miclouddevices.
|
Key Name |
Sample Key Value |
|
android_admin_activated |
TRUE |
|
android_attestation |
Unknown |
|
android_brand |
samsung |
|
android_c2dmToken |
APA91bEEY0MOk6Ba8XRShyHl5EAcxTjJwk5OzuvBfkr9VTZKwsWaXzHejED7A2Ty3GTS-c7MukYCHQGbIKZGhMGWNfGxgeZquhTozXe8TU0RrTnzcTRXYy0aWHfm8iE-jesKTmWu_R212YtjKiB7x_WgLciM9Dt5Wmn6hozlJ0-efdafc45LsdA |
|
android_device |
jactivelteatt |
|
android_device_roaming_flag |
FALSE |
|
android_incremental |
I537UCUCNE3 |
|
android_knox_version |
KNOX API 1.2.0 |
|
android_mdm_enabled |
TRUE |
|
android_media_card_capacity |
11716670000 |
|
android_media_card_free |
9316540000 |
|
android_multi_mdm |
TRUE |
|
android_os_build_number |
KOT49H.I537UCUCNE3 |
|
android_platform_flags |
0x3 |
|
android_samsung_dm |
FW: Key2,4 |
|
android_secure_apps_enabled |
TRUE |
|
android_secure_apps_encryption_enabled |
TRUE |
|
android_secure_apps_encryption_mode |
AES-256 |
|
android_security_detail |
0 |
|
android_usb_debugging |
TRUE |
|
common_apns_capable |
FALSE |
|
common_background_status |
0 |
|
common_battery_level |
91 |
|
common_blocked |
FALSE |
|
common_blocked_reasons |
COMPROMISED |
|
common_cellular_technology |
GSM |
|
common_client_build_date |
2014-01-24T14:30:14.000Z |
|
common_client_id |
1073744469 |
|
common_client_name |
com.mobileiron |
|
common_client_version |
7.0.0.0.121R |
|
common_comment |
test:2014-09-22 05:06 |
|
common_compliant |
TRUE |
|
common_creation_date |
2014-06-03T22:44:49.000Z |
|
common_current_country_code |
US |
|
common_current_country_name |
United States |
|
common_current_operator_name |
Orange |
|
common_current_phone_number |
18476441337 |
|
common_data_protection_enabled |
TRUE |
|
common_data_protection_reasons |
TRUE |
|
common_device_admin_enabled |
TRUE |
|
common_device_is_compromised |
FALSE |
|
common_device_space_ids |
1 |
|
common_device_space_name |
Global |
|
common_device_space_path |
/1/ |
|
common_display_size |
1920X1080 |
|
common_eas_last_sync_time |
2014-06-07T08:22:02.000Z |
|
common_ethernet_mac |
3c15c2b96f5c |
|
common_home_country_code |
US |
|
common_home_country_name |
United States |
|
common_home_operator_name |
AT&T |
|
common_home_phone_number |
18476445555 |
|
common_id |
2640 |
|
common_imei |
3.57E+14 |
|
common_imsi |
3.10E+14 |
|
common_ip_address |
172.23.64.10 |
|
common_lang_country_id |
183 |
|
common_language_id |
1 |
|
common_last_connected_at |
2014-10-02T14:34:28.000Z |
|
common_locale |
en-US |
|
common_location |
"-84.426897,33.659254" |
|
common_location_last_captured_at |
2014-10-02T14:33:13.922Z |
|
common_manufacturer |
samsung |
|
common_mdm_managed |
FALSE |
|
common_memory_capacity |
1909991669 |
|
common_memory_free |
221102735 |
|
common_miclient_last_connected_at |
2014-10-02T14:34:28.000Z |
|
common_model |
SAMSUNG-SGH-I537 |
|
common_model_name |
iPhone |
|
common_noncompliance_reasons |
DEVICE_ADMIN_DEACTIVE |
|
common_os_version |
4.4 |
|
common_owner |
COMPANY |
|
common_pending_device_passcode |
275295 |
|
common_pending_device_passcode_expiration_time |
2014-08-12T14:22:47.000Z |
|
common_platform |
Android |
|
common_platform_name |
Android 4.4 |
|
common_processor_architecture |
ARM |
|
common_quarantined |
FALSE |
|
common_quarantined_action |
0 |
|
common_quarantined_reasons |
DATA_PROTECTION |
|
common_registration_date |
2014-04-28T14:56:44.000Z |
|
common_registration_imsi |
3.10E+14 |
|
common_registration_uuid |
437bf8c92a6d2b93 |
|
common_retired |
FALSE |
|
common_roaming |
FALSE |
|
common_security_state |
Ok |
|
common_status |
ACTIVE |
|
common_storage_capacity |
11736670000 |
|
common_storage_free |
9336540000 |
|
common_uuid |
42d9f2a6-dad0-4ccf-834a-fc3e292b1929 |
|
common_wifi_mac_address |
400e852b535f |
|
ios_apnsToken |
657c9d0a7c9fbec51753e728a213a9e298d6efabc10af1dbebf3755ffd079f21 |
|
ios_BluetoothMAC |
0088656ae258 |
|
ios_BuildVersion |
11D257 |
|
ios_CarrierSettingsVersion |
16 |
|
ios_CurrentMCC |
310 |
|
ios_CurrentMNC |
410 |
|
ios_data_protection |
Enabled |
|
ios_DataRoamingEnabled |
FALSE |
|
ios_DeviceName |
Stephen Smith's iPhone 5 |
|
ios_forceEncryptedBackup |
TRUE |
|
ios_HardwareEncryptionCaps |
3 |
|
ios_iOSBackgroundStatus |
Denied by User |
|
ios_ip_address |
(null) |
|
ios_iPhoneICCID |
8901 4104 2556 4464 7398 |
|
ios_iPhoneMAC_ADDRESS_EN0 |
0 |
|
ios_iPhonePRODUCT |
iPhone5,1 |
|
ios_iPhoneUDID |
2a0831410d822c199461b8bccdc42dcc49e76504 |
|
ios_iPhoneUserID |
Global |
|
ios_iPhoneUserLongName |
Michael smith |
|
ios_iPhoneUserShortName |
michaelsmith |
|
ios_iPhoneVERSION |
11D201 |
|
ios_IsDeviceLocatorServiceEnabled |
TRUE |
|
ios_IsDoNotDisturbInEffect |
FALSE |
|
ios_it_policy_result |
1 |
|
ios_iTunesStoreAccountIsActive |
TRUE |
|
ios_ModemFirmwareVersion |
2.18.02 |
|
ios_PasscodeIsCompliant |
TRUE |
|
ios_PasscodeIsCompliantWithProfiles |
TRUE |
|
ios_PasscodePresent |
TRUE |
|
ios_ProductName |
iPhone5,1 |
|
ios_security_reason_code |
0x40000000 |
|
ios_SerialNumber |
C39K27D0F38Y |
|
ios_SIMMCC |
310 |
|
ios_SIMMNC |
410 |
|
ios_SubscriberCarrierNetwork |
AT&T |
|
ios_Supervised |
FALSE |
|
ios_VoiceRoamingEnabled |
FALSE |
|
ios_vpn_ip_address |
(null) |
|
user_display_name |
David Smith |
|
user_email_address |
|
|
user_first_name |
David |
|
user_last_admin_portal_login_time |
2014-10-01T07:47:55.481Z |
|
user_last_name |
Smith |
|
user_ldap_attr_dn |
"CN=David Smith,OU=Users,OU=acme,DC=acme,DC=com" |
|
user_ldap_dn |
cn=david Smith,ou=users,ou=acme,dc=acme,dc=com |
|
user_ldap_groups |
{u'dn': u'cn=acme-users,ou=groups,ou=acme,dc=acme,dc=com', u'name': u'acme-Users'} |
|
user_ldap_locale |
40 |
|
user_ldap_principal |
dSmith |
|
user_ldap_upn |
|
|
user_ldap_user_attributes_cn |
David Smith |
|
user_ldap_user_attributes_displayName |
David Smith |
|
user_ldap_user_attributes_distinguishedName |
CN=David Smith,OU=Users,OU=acme,DC=acme,DC=com |
|
user_ldap_user_attributes_givenName |
David |
|
user_ldap_user_attributes_mail |
|
|
user_ldap_user_attributes_memberOf |
CN=acme-Users,OU=Groups,OU=acme,DC=acme,DC=com |
|
user_ldap_user_attributes_sAMAccountName |
dSmith |
|
user_ldap_user_attributes_sn |
Smith |
|
user_ldap_user_attributes_userPrincipalName |
|
|
user_user_id |
dSmith |
|
user_uuid |
7eda4e77-ba3c-4065-8701-2d558e885dac |
|
windows_phone_dm_client_version |
1.3 |
|
windows_phone_network_adapter |
Intel(R) 82574L Gigabit Network Connection |
|
windows_phone_wns_channel_url |
https://db3.notify.windows.com/?token=AgYAAADYIAVJSlBMdhfPA3%2fjtO2mCuKI5azbrwCMno9yBSeEudYfSjc39AF6STDbKmdiZlvgIA2qqD7UhzyKHf1Ca4aYts45LOF%2bobWHHIOLnaESBCqsgs7N%2bowPv0O9peqZ48Y%3d |
|
windows_phone_wp_device_instance_service_identity2_roaming |
FALSE |
|
windows_phone_wp_device_instance_service_roaming |
FALSE |
|
windows_phone_wp_ent_dm_id |
0 |
|
windows_phone_wp_exchange_id |
A5BA6D16F37BF71BD900A6B9115AFC2E |
|
windows_phone_wp_firmware_version |
3051.40000.1347.1001 |
|
windows_phone_wp_hardware_version |
2.2.2.5 |
|
windows_phone_wp_local_time |
2014-08-30T23:28:45.000Z |
|
windows_phone_wp_processor_type |
0 |
|
windows_phone_wp_publisher_device_id |
294C2F26C7AAD3E552FC0222EF9A70CE12AE5248 |
|
windows_phone_wp_radio_swv |
1.0.202158.3 |
|
windows_phone_wp_signed_ent_dm_id |
0 |
|
Key Name |
Sample Key Value |
|
lastName |
McGavin |
|
wifiMacAddress |
c0:f2:fb:86:8c:d4 |
|
imei |
|
|
kioskState |
NOT_CONFIGURED |
|
supervised |
TRUE |
|
roaming |
FALSE |
|
windowsDeviceType |
WINDOWS_PHONE |
|
iccid |
8901 4103 2566 4483 8251 |
|
lastRegistrationTime |
1.49E+12 |
|
clientLastCheckin |
1.49E+12 |
|
udid |
4ee106ea638b31344cbfb18e3cb770f0fac3ec5f |
|
secureAppsStatus |
UNKNOWN |
|
complianceState |
TRUE |
|
emailAddress |
|
|
supportLockMessage |
TRUE |
|
accountCustomAttributes |
|
|
customAttributes |
|
|
ownerId |
6347767 |
|
lastCheckin |
1.49E+12 |
|
phoneNumber |
16509245168 |
|
manufacturer |
Apple Inc. |
|
currentCarrierNetwork |
AT&T |
|
currentMcc |
310 |
|
locationStatusDetail/lastUpdatedAt |
1.49E+12 |
|
locationStatusDetail/locationStatus |
AVAILABLE |
|
firstName |
Nathan |
|
subscriberMnc |
410 |
|
policyViolationCount |
1 |
|
latitude |
37.395996 |
|
platformVersion |
10.2 |
|
osBuildVersion |
14C92 |
|
currentMnc |
410 |
|
mdmChannelId |
|
|
locale |
es_ES |
|
subscriberMcc |
310 |
|
serialNumber |
F4KN81ERG5V1 |
|
easDeviceIdentifiers/0 |
1FHG4M8DL91I93H8P6QHR233MC |
|
uid |
|
|
subscriberCarrierNetwork |
AT&T |
|
meid |
3.59E+13 |
|
secureAppsEncryptionMode |
NONE |
|
secureAppsEncryptionStatus |
UNKNOWN |
|
registrationState |
ACTIVE |
|
locationLastCapturedAt |
1.49E+12 |
|
platformType |
IOS |
|
clientVersion |
2.13.1 (2.13.1.11) |
|
deviceModel |
iPad4,7 |
|
imsi |
3.10E+14 |
|
deviceName |
F4KN81ERG5V1 |
|
longitude |
-122.0563 |
|
multiUser |
FALSE |
|
androidDeviceOwnerModeEnabled |
FALSE |
|
lostModeEnabled |
FALSE |
|
displayName |
Nathan McGavin |
|
ownershipType |
COMPANY |
|
androidWorkContainerEnabled |
FALSE |
|
cellularTechnology |
device__p_cellular_technology |
|
id |
914484 |
|
prettyModel |
iPad Mini 3 |
Audit Trails Field Names
This table contains the audit trails field names and sample values imported into the index micloudaudittrails.
|
Key Name |
Sample Key Value |
|
entityDeleted |
false |
|
id |
02926943-67bc-4b0c-b619-9d8ad4ab48d6 |
|
tenantUuid |
243caa7b-d860-4c55-86f7-fdbd3aac0d9b |
|
createdAt |
1664779754369 |
|
expiresAt |
1666075754369 |
|
publishedAt |
1664779754369 |
|
actorId |
10052 |
|
actorName |
|
|
actorUid |
|
|
actorRoles |
|
|
entityGroup |
App Management |
|
entityAuditId |
app managementios_management_flags1147 |
|
entityType |
IOS_MANAGEMENT_FLAGS |
|
entityId |
1147 |
|
entityName |
Apple Application Management configuration settings. |
|
actionType |
Create |
|
beforeActionState (If the audit trails event exceeds 50,000 characters of data, then the app truncates this field in the response.) |
{id:123...} |
|
afterActionState (If the audit trails event exceeds 50,000 characters of data, then the app truncates this field in the response.) |
{id:123...} |
|
input |
{} |
|
output (If the audit trails event exceeds 50,000 characters of data, then the app truncates this field in the response.) |
{} |
|
resultStatus |
SUCCESS |
|
publisherId |
POLARIS |
|
details |
AppName: Amazon Kindle, Platform: iOS, Dist summary: 1 User Group |
|
lastLoginAt |
1664853695950 |
|
deviceOwner |
|
Reference Common Information Model (CIM) Field Aliases
The following field aliases map fields to Splunk’s CIM (Common Information Model) fields.
miclouddevices: FIELDALIAS-CIM_inventory
|
Field |
CIM Field |
|
displayName |
name |
|
deviceModel |
vendor_product |
|
platformVersion |
version |
|
displayName |
user |
|
uid |
user_id |
|
platformType |
os |
|
serialNumber |
serial |
|
wifiMacAddress |
mac |
|
ios_SerialNumber |
serial |
|
prettyModel |
family |
|
registrationState |
status |
|
timestamp |
time |