Skip to content

Device

The Device object represents an addressable computer system or host, which is typically connected to a computer network and participates in the transmission or processing of data within the computer network.

  • Extends: endpoint

Attributes

Section titled “Attributes”

type_id

The device type ID.

container

The information describing an instance of a container. A container is a prepackaged, portable system image that runs isolated on an existing system using a container runtime like containerd.

hostname

  • Type: hostname_t
  • Requirement: recommended

The device hostname.

instance_uid

  • Type: string_t
  • Requirement: recommended

The unique identifier of a VM instance.

interface_name

  • Type: string_t
  • Requirement: recommended

The name of the network interface (e.g. eth2).

interface_uid

  • Type: string_t
  • Requirement: recommended

The unique identifier of the network interface.

namespace_pid

  • Type: integer_t
  • Requirement: recommended

If running under a process namespace (such as in a container), the process identifier within that process namespace.

owner

  • Type: user
  • Requirement: recommended

The identity of the service or user account that owns the endpoint or was last logged into it.

region

  • Type: string_t
  • Requirement: recommended

The region where the virtual machine is located. For example, an AWS Region.

type

  • Type: string_t
  • Requirement: recommended

The device type. For example: unknown, server, desktop, laptop, tablet, mobile, virtual, browser, or other.

uid

  • Type: string_t
  • Requirement: recommended

The unique identifier of the device. For example the Windows TargetSID or AWS EC2 ARN.

vendor_name

  • Type: string_t
  • Requirement: recommended

The vendor for the device. For example Dell or Lenovo.

agent_list

  • Type: agent
  • Requirement: optional

A list of agent objects associated with a device, endpoint, or resource.

autoscale_uid

  • Type: string_t
  • Requirement: optional

The unique identifier of the cloud autoscale configuration.

boot_time

  • Type: timestamp_t
  • Requirement: optional

The time the system was booted.

boot_time_dt

  • Type: datetime_t
  • Requirement: optional

The time the system was booted.

created_time

  • Type: timestamp_t
  • Requirement: optional

The time when the device was known to have been created.

created_time_dt

  • Type: datetime_t
  • Requirement: optional

The time when the device was known to have been created.

desc

  • Type: string_t
  • Requirement: optional

The description of the device, ordinarily as reported by the operating system.

domain

  • Type: string_t
  • Requirement: optional

The network domain where the device resides. For example: work.example.com.

first_seen_time

  • Type: timestamp_t
  • Requirement: optional

The initial discovery time of the device.

first_seen_time_dt

  • Type: datetime_t
  • Requirement: optional

The initial discovery time of the device.

groups

  • Type: group
  • Requirement: optional

The group names to which the device belongs. For example: ["Windows Laptops", "Engineering"].

hw_info

The endpoint hardware information.

hypervisor

  • Type: string_t
  • Requirement: optional

The name of the hypervisor running on the device. For example, Xen, VMware, Hyper-V, VirtualBox, etc.

image

  • Type: image
  • Requirement: optional

The image used as a template to run the virtual machine.

imei

  • Type: string_t
  • Requirement: optional

The International Mobile Equipment Identity that is associated with the device.

imei_list

  • Type: string_t
  • Requirement: optional

The International Mobile Equipment Identity values that are associated with the device.

ip

  • Type: ip_t
  • Requirement: optional

The device IP address, in either IPv4 or IPv6 format.

is_compliant

  • Type: boolean_t
  • Requirement: optional

The event occurred on a compliant device.

is_managed

  • Type: boolean_t
  • Requirement: optional

The event occurred on a managed device.

is_personal

  • Type: boolean_t
  • Requirement: optional

The event occurred on a personal device.

is_trusted

  • Type: boolean_t
  • Requirement: optional

The event occurred on a trusted device.

last_seen_time

  • Type: timestamp_t
  • Requirement: optional

The most recent discovery time of the device.

last_seen_time_dt

  • Type: datetime_t
  • Requirement: optional

The most recent discovery time of the device.

location

The geographical location of the device.

mac

  • Type: mac_t
  • Requirement: optional

The Media Access Control (MAC) address of the endpoint.

model

  • Type: string_t
  • Requirement: optional

The model of the device. For example ThinkPad X1 Carbon.

modified_time

  • Type: timestamp_t
  • Requirement: optional

The time when the device was last known to have been modified.

modified_time_dt

  • Type: datetime_t
  • Requirement: optional

The time when the device was last known to have been modified.

name

  • Type: string_t
  • Requirement: optional

The alternate device name, ordinarily as assigned by an administrator.

Note: The Name could be any other string that helps to identify the device, such as a phone number; for example 310-555-1234.

network_interfaces

The network interfaces that are associated with the device, one for each unique MAC address/IP address/hostname/name combination.

Note: The first element of the array is the network information that pertains to the event.

org

Organization and org unit related to the device.

os

  • Type: os
  • Requirement: optional

The endpoint operating system.

os_machine_uuid

  • Type: uuid_t
  • Requirement: optional

The operating system assigned Machine ID. In Windows, this is the value stored at the registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid. In Linux, this is stored in the file: /etc/machine-id.

risk_level

  • Type: string_t
  • Requirement: optional

The risk level, normalized to the caption of the risk_level_id value.

risk_level_id

  • Type: integer_t
  • Requirement: optional
  • Values:
    • 0 - Info
    • 1 - Low
    • 2 - Medium
    • 3 - High
    • 4 - Critical
    • 99 - Other: The risk level is not mapped. See the risk_level attribute, which contains a data source specific value.

The normalized risk level id.

risk_score

  • Type: integer_t
  • Requirement: optional

The risk score as reported by the event source.

subnet

  • Type: subnet_t
  • Requirement: optional

The subnet mask.

subnet_uid

  • Type: string_t
  • Requirement: optional

The unique identifier of a virtual subnet.

uid_alt

  • Type: string_t
  • Requirement: optional

An alternate unique identifier of the device if any. For example the ActiveDirectory DN.

vlan_uid

  • Type: string_t
  • Requirement: optional

The Virtual LAN identifier.

vpc_uid

  • Type: string_t
  • Requirement: optional

The unique identifier of the Virtual Private Cloud (VPC).

zone

  • Type: string_t
  • Requirement: optional

The network zone or LAN segment.

Constraints

Section titled “Constraints”

At least one of: ip, uid, name, hostname, instance_uid, interface_uid, interface_name

Used By

Section titled “Used By”