networkThreatDetails:legacyMitmDetails Fields
Legacy Man-in-the-Middle events are returned as
THREAT events with
type=NETWORK and a
networkThreatDetails:legacyMitmDetails block with the following information:
"details": {
...,
"assessments": [...],
"networkThreatDetails": {
"legacyMitmDetails" {
"type": "ACTIVE_MITM",
"ssid": "home",
"dnsIpAddresses": ["10.18.216.174", "10.18.216.175"],
"mac_address": "ab:dc:ac:8e:35:12"
}
}
}| Field | Type | Description |
|---|---|---|
|
String | Always
ACTIVE_MITM |
|
String | The wireless network ID. |
|
String array | List of IP addresses. |
|
String | The MAC address. |
|
Boolean | (Optional) Indicates if a VPN exists. |
|
String | (Optional) The VPN IP address, if one is present. |
|
String | The proxy IP address. |
|
Integer | The proxy port being used. |
|
String | The proxy protocol being used. |
* Field omitted if privacy controls are enabled.
