Appendix B - Mobile Security Syslogs

This appendix describes the structure of the Syslog event sent by Mobile Security.

Sample Mobile Security event:

May 15 11:24:26 dashboard-eu2-alerts HarmonyMobile: URL: dashboard-url.locsec.net, Product: Harmony Mobile, AttackVector: Application, DeviceAlert Event: Application, Product: Harmony Mobile, Threat Factors: Backup Tool, EventType: Installed, Signature: app_hash\: 781938e38fea1ee520b8ebe2da5d5cdd28bfee5c51bcd8d4a36e4b063a676ddf, RiskLevel: CRITICAL, DeviceID: 339, Client: Harmony Mobile Protect, Device Client Version: 4.3.0.9307, DeviceOwner: testUser, DeviceEmail: email@example.com, DeviceNumber: , DevicePolicy: Global, DeviceGroups: ALL|hm-integrations-g, DeviceSerialNumber: None, DeviceType: Android_work, DeviceOSLevel: 14, DeviceModel: samsung / SM-S911B, DeviceRiskLevel: 1.0, Event ID: 78, Event Timestamp: 1747297460000, Event Client Timestamp: 1747297457000, Device Tracking ID: 5292f8dffd6b92f87a24fa32337fefbf200fe65e5c09fb2d48583c4cb89f2f99, Host Type: Mobile, APP name: Smart Switch, APP package: com.sec.android.easyMover, APP Threat summary: None, APP SHA256: 781938e38fea1ee520b8ebe2da5d5cdd28bfee5c51bcd8d4a36e4b063a676ddf, App version: 3.7.62.1/376201130, App repackaged: False, APP Developer: None, APP Developer Certificate: None, System APP: None, APP Link: None, Network bssid: None, Device Location: None, Network Certificate: None, NetworkArpPoisoning: None, sms_urls: None, Sender: None, Location: None, ssid: None, Devicerootedjailbroken: False, Network Resource: None#015

Syslog event format for IBM QRadar SIEM:

May 15 11:24:26 HarmonyMobile dashboard-eu2-alerts: URL: dashboard-url.locsec.net, Product: Harmony Mobile, AttackVector: Application, DeviceAlert Event: Application, Product: Harmony Mobile, Threat Factors: Backup Tool, EventType: Installed, Signature: app_hash\: 781938e38fea1ee520b8ebe2da5d5cdd28bfee5c51bcd8d4a36e4b063a676ddf, RiskLevel: CRITICAL, DeviceID: 339, Client: Harmony Mobile Protect, Device Client Version: 4.3.0.9307, DeviceOwner: testUser, DeviceEmail: email@example.com, DeviceNumber: , DevicePolicy: Global, DeviceGroups: ALL|hm-integrations-g, DeviceSerialNumber: None, DeviceType: Android_work, DeviceOSLevel: 14, DeviceModel: samsung / SM-S911B, DeviceRiskLevel: 1.0, Event ID: 78, Event Timestamp: 1747297460000, Event Client Timestamp: 1747297457000, Device Tracking ID: 5292f8dffd6b92f87a24fa32337fefbf200fe65e5c09fb2d48583c4cb89f2f99, Host Type: Mobile, APP name: Smart Switch, APP package: com.sec.android.easyMover, APP Threat summary: None, APP SHA256: 781938e38fea1ee520b8ebe2da5d5cdd28bfee5c51bcd8d4a36e4b063a676ddf, App version: 3.7.62.1/376201130, App repackaged: False, APP Developer: None, APP Developer Certificate: None, System APP: None, APP Link: None, Network bssid: None, Device Location: None, Network Certificate: None, NetworkArpPoisoning: None, sms_urls: None, Sender: None, Location: None, ssid: None, Devicerootedjailbroken: False, Network Resource: None#015