networkThreatDetails:mitmDetails Fields

Man-in-the-Middle events are returned as THREAT events with type=NETWORK and a networkThreatDetails:mitmDetails block with the following information:

"details": {
  ...,
  "assessments": [...],
  "networkThreatDetails": {
    "mitmDetails" {
      "type": "MITM",
      "probingResult": {
        "endpoint": "https://protect12.protect.prod.lkt.is",
        "resolved_ip_address": "44.224.106.71"
      },
      "network": {
        "connectionType": "network_connection_type_wifi",
        "name": "network name",
        "wifiBssid": "home",
        "proxyConfiguration": {
          "address": "ip address if using a proxy",
          "port": 1234,
          "protocol": "protocol if using a proxy"
        },
        "dnsIpAddresses": ["10.18.216.174", "10.18.216.175"],
      }
    }
  }
}


Field	Type	Description
`type`	String	Always `MITM`
`probingResult`	JSON	The results of Lookout's network probe.
`probingResult:endpoint`	String	The Lookout network probe endpoint.
`probingResult:resolvedIpAddress`	String	The domain name of the resolved IP address.
`network`	JSON	Wireless network information.
`network:connectionType`	String	The network connection type.
`*network:name`	String	The wireless network name.
`*network:wifiBssid`	String	The wireless network ID.
`network:proxyConfiguration`	JSON	Proxy configuration.
`proxyConfiguration:address`	String	The proxy IP address.
`proxyConfiguration:port`	integer	The proxy port being used.
`proxyConfiguration:protocol`	String	The proxy protocol being used.
`dnsIpAddresses`	String array	List of IP addresses.
`network:vpnConfiguration`	JSON	VPN information, if one exists.
`vpnConfiguration:localAddress`	String	The local IP address of the device within the VPN network.
`vpnConfiguration:remoteAddress`	String	The remote IP address of the device.
`network:accessPointHostName`	String	The wireless network access point host.
`network:connected`	Boolean	Whether the device is connected to the listed network.

* Field omitted if privacy controls are enabled.

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

networkThreatDetails:mitmDetails Fields

lookout-footer