Appendix C - Mobile Security ArcSight

This appendix describes the structure of the ArcSight event sent by Mobile Security.

Sample Mobile Security event:

<CEF:0|Check Point|SMB|4.0.2.9119|BACKUP_TOOL|Application|3|act=Installed alert_details=app_hash: 9061187fbd6aa0cf978bfe9928158cf41c53c70a884f9d8b279a52e232fa3a9a app_name=Google Photos app_package=com.google.photos bssid=None cat=Alert cnt=1234 cs1=IPhone cs1Label=DeviceType cs2=+44 7469 376815 cs2Label=Phone cs3=15.6.1 cs3Label=OSLevel cs4=iPhone / iPhone 11 cs4Label=DeviceDetails cs5=None cs5Label=NetworkCertificate cs6=0.6 cs6Label=Current Device Risk deviceDirection=None deviceExternalId=971225 deviceInboundInterface=False device_client_version=4.0.2.9119 duid=AAA23C40-6577-4321-8B74-25454123457D duser= user@example.com dvchost=example-tenant.locsec.net externalId= F112343S-4123-4b69-90ff-0234DFHGHFY9 fileHash=9061187fbd6aa0cf978bfe9928158cf41c53c70a884f9d8b279a52e232fa3a9a fileId=6.4.469058872 filePermission=False fileType=The application accesses the device data. It can backup sensitive information from the device. App Category - Photography This app might access and share your device unique identifier. This might be used to track location, gather user behaviour and present targeted advertisement msg=app_hash: 9061187fbd6aa0cf978bfe9928158cf41c53c70a884f9d8b279a52e232fa3a9a resource=None rt=1662318312000 sender=None sms_urls=None ssid=None start=1662318312000 suid=None suser=Jhon's iPhone uuid=None