home

Mobile Endpoint Security

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Device Event Fields

In addition to the Common Fields, Event Actor Fields and Event Target Fields listed above, DEVICE events include changeType and updatedDetails fields, as well as a details block. They may also include a parentDetails block and an info block, if available:

"type": "DEVICE",
"id": "1583",
"eventTime": "2017-07-26T12:35:37.000Z",
"changeType":"UPDATED"
"actor": {...},
"details": {
  "type": "DEVICE_STATUS",
  "activationStatus": "ACTIVATED",
  "securityStatus": "SECURE",
  "protectionStatus": "PROTECTED"
},
"updatedDetails": ["activationStatus","securityStatus","protectionStatus"],
"parentDetails": {
  "type": "DEVICE_STATUS",
  "activationStatus": "ACTIVATED",
  "securityStatus": "SECURE",`
  "protectionStatus": "PROTECTED"
},
"info":"",
"target": {...}
Note:

NOTE: Some device status fields are omitted depending on the state of other fields, e.g., securityStatus is present only if protectionStatus=PROTECTED and activationStatus=ACTIVATED, otherwise it is omitted.

FieldTypeDescription
changeType
StringThe type of change. One of CREATED, UPDATED, DELETED.
updatedDetails
enum arrayWhich status field(s) changed in value. Can be one or more of activationStatus, securityStatus, protectionStatus.
details
JSONThe current device state.
  details:type
StringAlways DEVICE_STATUS.
  details:activationStatus
enumThe activation status of the device. One of ACTIVATED, DEACTIVATED, PENDING, DELETED.
  details:securityStatus
enumThe security status of the device. One of SECURE, THREAT_LOW, THREAT_MEDIUM, THREAT_HIGH.
  details:protectionStatus
enumThe protection status of the device. One of PROTECTED, DISCONNECTED, UNINSTALLED.
parentDetails
JSONFor dual enrollment devices, each profile is reported as a separate device. The parentDetails summarize the status of the parent device entry that represents the combined states of its profiles.
  parentDetails:type
enumAlways DEVICE_STATUS.
  parentDetails:activationStatus
enumThe activation status of the parent device.
  parentDetails:securityStatus
enumThe security status of the parent device.
  parentDetails:protectionStatus
enumThe protection status of the parent device.
info
JSONAdditional information, if available.
  info:deviceGroupIds
UUID arrayAn array of MES Console Device Group IDs that the device belongs to.
  info:previousDeviceGroupIds
UUID arrayAn array of MES Console Device Group IDs that the device previously belonged to.