Event Target Fields
All events include a
target block that describes the target of the event. It contains the fields below:
"target": {
"type": "DEVICE",
"id": "5a67ee40-eef2-4338-bc4d-e1b10059e8e8",
"externalId": "5f4e5e66-8db9-45cd-88a4-d5a97a5b955a",
"emailAddress": "threat_victim@example.com",
"platform": "IOS"
"mdmConnectorId" : "919b4e29-3d26-459d-8621-3c1ac5e43504",
"mesConnectorId" : "b6ab7321-b550-40ba-a0f8-f58c23fa0cfc",
"customerDeviceId" : "arbitrary_customer_id_value",
"parentDeviceId" : "abcb3611-ffda-ab21-1234-8593be740dd3",
}| Field | Type | Description |
|---|---|---|
|
enum | The type of target. For
THREAT and
DEVICE events this is always
DEVICE. For
AUDIT events this is one of
ADMIN, ENTERPRISE, DEVICE. |
|
GUID | Unique ID that identifies the target. |
|
String | (If
type=DEVICE) The unique external ID for the device, if available. This is typically the MDM or MAM device ID. |
|
String | (If
type=DEVICE) Email address of the device owner. |
|
enum | (If
type=DEVICE) The device platform. One of
ANDROID, IOS, UNKNOWN. |
|
String | (If
type=DEVICE) The device OS version, if available. |
|
String | (If
type=DEVICE) The device manufacturer, if available |
|
String | (If
type=DEVICE) The device model, if available. |
|
integer | (If
type=DEVICE) This value is used internally by Lookout. |
|
String | (If
type=DEVICE) This value is used internally by Lookout. |
|
String | (If
type=DEVICE) This is an optional ID that can be specified when pushing Lookout for Work app config to a device from an MDM. The value is pulled from the
DeviceUniqueIdentifier key-value pair in the app config. |
|
UUID | (If
type=DEVICE) The unique ID of the physical device. This value is not present for all devices. |
|
enum | (If
type=DEVICE) On an Android Enterprise device, the profile that triggered the event. This value is not present for all devices. One of
UNKNOWN_PROFILE_TYPE, PERSONAL, WORK. |
* Field omitted if privacy controls are enabled.
