home

Mobile Endpoint Security

Lookout Product Documentation

Find answers about using and optimizing Lookout products.

Device event common fields

These fields exist in the details of Lookout device events where event.type=DEVICE.

Lookout event field Type LEEF field Description
event.details.

activationStatus AND event.details.

securityStatus
enum
cat

Device Category is generated based on the activationStatus and securityStatus of the device.

One of

DELETED, DEACTIVATED, PENDING, ACTIVATED_SECURE, ACTIVATED_THREAT_LOW, ACTIVATED_THREAT_MEDIUM, ACTIVATED_THREAT_HIGH, SECURE, THREAT_LOW, THREAT_MEDIUM, THREAT_HIGH, DEVICE_STATUS
event.details.type
String
lookoutEventType
Always DEVICE_STATUS
event.details.activationStatus
enum
lookoutActivationStatus
Device activation status. One of ACTIVATED, DEACTIVATED, PENDING, DELETED.
event.details.protectionStatus
enum
lookoutProtectionStatus
Device protection status. One of PROTECTED, DISCONNECTED.
event.details.securityStatus
enum
lookoutSecurityStatus
Device security status. One of SECURE, THREAT_LOW, THREAT_MEDIUM, THREAT_HIGH.
event.details.updatedDetails
Array
lookoutUpdatedDetails
Indicates which status change(s) triggered the event. Can be any combination of activationStatus, protectionStatus, securityStatus