Pradeo MTD
Overview
Pradeo Mobile Threat Defense (MTD) is a comprehensive security solution designed to protect mobile devices from various threats such as malware, phishing, and network attacks. This setup guide explains how to forward and collect the detections and activity logs of your Pradeo MTD to Sekoia.io.
- Vendor: Pradeo
- Supported environment: SaaS
- Detection based on: Alert
- Supported application or feature:
- Detections
- Audit Events
Specification
Prerequisites
- Permissions:
- Administrator access to the Pradeo Security console
Step-by-Step Configuration Procedure
Instruction on Sekoia
Configure Your Intake
This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.
- Go to the Sekoia Intake page.
- Click on the
+ New Intakebutton at the top right of the page. - Search for your Intake by the product name in the search bar.
- Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
- Click on
Create.
Note
For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.
Instructions on the 3rd Party Solution
This setup guide will show you how to forward events from Pradeo Security to Sekoia.io.
Set up the Integration in Pradeo Security Console
- Log in to the Pradeo Security platform.
- From the main dashboard, select
Integrationoption. - Click
SIEM Integrations. - Select
Sekoiaas your preferred SIEM system. - Copy the intake key in the appropriate input.
- Select
DetectionsandAudit logsas event types. - Select the desired fields to export.
- Save your configuration.
Raw Events Samples
In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.
{
"id": "jyFgy57XQGm0oEk6V_6tdA",
"creationDate": "2024-07-23T13:28:32.594Z",
"source": "admin",
"category": null,
"type": "MessageCreated",
"content": {
"message": {
"id": "u7GTsigSS1CWtS_y80zpgw",
"title": "test",
"content": "envoye a 15:28",
"creationDate": "2024-07-23T13:28:32.578Z"
}
},
"user": {
"id": "gA0jK6lCSBWZ3-ZMR9IoFw",
"email": "alan.smithee@pradeo.com",
"firstName": "Alan",
"lastName": "Smithee",
"jobTitle": null,
"phoneNumber": null,
"language": "English",
"isDeactivated": false,
"isFirstConnection": true,
"toNotify": false,
"lastConnectionDate": "2024-07-23T14:56:26.000Z",
"creationDate": "2024-07-03T12:24:48.924Z",
"lastModificationDate": "2024-07-23T14:56:26.000Z"
},
"device": null,
"company": {
"id": "bufQJXK_RNamdgiPmXzpFg",
"name": "Mobile boat",
"creationDate": "2024-07-03T10:01:02.043Z",
"lastModificationDate": "2024-07-04T07:19:50.000Z",
"deletedAt": null
}
}
{
"id": "8bnDz9zBI0S25lsXD22nxg",
"creationDate": "2024-07-02T07:02:15.721Z",
"source": "device",
"category": null,
"type": "ApplicationCreated",
"content": {
"application": {
"id": "6DN0jTLmX8-958o-fa3pnQ",
"version": "1.10.2",
"md5": "673937eab709d3e3999b25bc564902c4",
"sha1": "639f1ebc03aac79374e70123d15bd00fc68d37af",
"sha256": "8ddb8f0098f6159fba0a56444fe67634adb7903770eaa646ef202f8d8f32d3df",
"name": "Sonic 2",
"versionCode": "217",
"size": 83816851,
"package": {
"id": "N4N-N9ByVrKDs-WCpxSj6Q",
"package": "com.sega.sonic2.runner",
"system": "Android"
}
}
}
}
{
"id": "1234567890",
"creationDate": "2024-11-27T04:10:33.460Z",
"source": "system",
"category": null,
"type": "DeviceApplicationComplianceUpdated",
"content": {
"deviceApplicationCompliance": {
"id": "abcdef123456",
"status": "Disapproved",
"computed": true,
"creationDate": "2024-11-27T04:04:26.482Z",
"lastModificationDate": "2024-11-27T04:10:33.000Z",
"deviceApplication": {
"id": "123456789ABCDEF",
"application": {
"id": "azertyuiop",
"package": {
"id": "1234abcd",
"package": "com.app.test",
"system": "Android"
},
"version": "491.0.0.58.78",
"md5": "0fccfdefc882c4be6d2a938001184e08",
"sha1": "749c94cd972726ef2b3ccda7e718a2034cc9f6ac",
"sha256": "278fde8924687bf22285d2b4415779d96ba967530cae43272029ec53ecc2eee8",
"name": "App",
"versionCode": "457215664",
"size": "64262264"
},
"device": {
"id": "device_id01",
"serialNumber": "unknown",
"imei": null,
"name": "John",
"email": null,
"singleEnrollmentKey": "xxxxxXXXXxxXxxx",
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "10.0.0",
"declaredOperatingSystemSecurityPatchDate": "2020-09-01T00:00:00.000Z",
"declaredModel": "MODEL 01",
"enrollmentStatus": {
"id": "enrollid_12",
"lastConnection": "2024-11-27T04:07:32.000Z",
"coupled": true
},
"emmDeviceInfo": null
},
"installedAt": "2024-08-07T13:40:35.000Z",
"uninstalledAt": null,
"native": false
},
"matchedResponseRules": [
{
"id": "matched_response_id",
"matchConditions": [
{
"type": "threatLevelIs",
"value": "Red"
}
],
"notifyAdministrator": false,
"onDeviceNotification": false,
"action": "Disapproved",
"responseRuleset": {
"id": "yMXqFSTMT8uDn1ijwCmEGA",
"name": "FallBack",
"active": true,
"type": "FallBack",
"priority": 0
},
"priority": 0
}
]
}
},
"user": null,
"device": null,
"company": {
"id": "ROhGBpGHSi2gpVagfb4FhQ",
"name": "LAB",
"creationDate": "2024-04-15T15:31:33.395Z",
"lastModificationDate": "2024-08-07T13:23:42.000Z",
"deletedAt": null
}
}
{
"id": "_czh5ptATAa0TDv8cCR75g",
"creationDate": "2024-07-02T12:20:01.795Z",
"source": "system",
"category": null,
"type": "DetectionPolicyUpdated",
"content": {
"detectionPolicy": {
"id": "R-cZz0iUSyujQ954d3qytw",
"name": "iO Si Senor",
"creationDate": "2023-11-13T17:58:03.000Z",
"lastModificationDate": "2024-05-27T08:14:01.531Z",
"company": {
"id": "JmidYbyCRpegHOjnpK4uag",
"name": "Pradeo",
"creationDate": "2023-09-11T13:15:14.000Z",
"lastModificationDate": "2024-04-19T10:03:30.000Z",
"deletedAt": null
},
"inheritable": false,
"dataRules": [],
"featureRules": [],
"communicationRules": [],
"systemStatusLevels": [],
"networkStatusLevels": [],
"deviceGroups": [],
"handledCompanies": [],
"version": 1
}
}
}
{
"id": "testId",
"creationDate": "2025-08-01T09:26:30.112Z",
"source": "system",
"category": null,
"type": "DeviceApplicationComplianceUpdated",
"user": null,
"device": null,
"company": {
"id": "_testOther",
"name": "soc-sns-security",
"creationDate": "2025-04-15T15:48:02.092Z",
"lastModificationDate": "2025-08-01T09:25:35.000Z",
"deletedAt": null
},
"integration": null,
"content": {
"deviceApplicationCompliance": {
"id": "werwerwer",
"status": "Approved",
"computed": true,
"creationDate": "2025-08-01T09:16:21.440Z",
"lastModificationDate": "2025-08-01T09:26:30.000Z",
"deviceApplication": {
"id": "_testDevAppId",
"application": {
"id": "appId",
"package": {
"id": "W_id_random",
"package": "com.android.settings",
"system": "Android"
},
"version": "15",
"md5": "0000000000000000000",
"sha1": "111111111111111111111111",
"sha256": "3333333333333333333333333333",
"name": "Param\u00e8tres",
"versionCode": "35",
"size": "111376995"
},
"device": {
"id": "devId1",
"serialNumber": "unknown",
"imei": null,
"name": "TTT",
"email": null,
"byod": false,
"lockPassword": null,
"knoxVersion": "38",
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "15.0.0",
"declaredOperatingSystemSecurityPatchDate": "2025-06-01T00:00:00.000Z",
"declaredModel": "SM-A556B",
"enrollmentStatus": {
"id": "testId00000000",
"lastConnection": "2025-08-01T09:25:11.000Z",
"coupled": true,
"versionCode": null
},
"emmDeviceInfo": null
},
"installedAt": "2022-01-01T00:00:00.000Z",
"uninstalledAt": null,
"native": true
},
"matchedResponseRules": [
{
"id": "otherId111111111",
"matchConditions": [
{
"type": "nativeStatusIs",
"value": "native"
}
],
"notifyAdministrator": false,
"onDeviceNotification": false,
"action": "Approved",
"responseRuleset": {
"id": "rulesetId",
"name": "GloballyEnforced",
"active": true,
"type": "GloballyEnforced",
"priority": 0
},
"priority": 0
},
{
"id": "tttttttttt",
"matchConditions": [
{
"type": "threatLevelIs",
"value": "Red"
}
],
"notifyAdministrator": false,
"onDeviceNotification": false,
"action": "Disapproved",
"responseRuleset": {
"id": "dddddddddddddd",
"name": "FallBack",
"active": true,
"type": "FallBack",
"priority": 0
},
"priority": 0
}
]
}
}
}
{
"id": "XjR27UNPT7ixTAV6M4YBEA",
"creationDate": "2024-07-01T17:24:54.784Z",
"source": "system",
"category": null,
"type": "DeviceComplianceUpdated",
"content": {
"deviceCompliance": {
"id": "tw0T69jkS1SOdBc-QFat8A",
"status": "Approved",
"computed": true,
"creationDate": "2024-07-01T17:01:20.075Z",
"lastModificationDate": "2024-07-01T17:02:02.000Z",
"device": {
"id": "kfvsh37xT2GUUlQHBZSIZw",
"serialNumber": null,
"imei": "356568109376877",
"name": "remy iPhone iOS 17.5.1 N736",
"email": null,
"singleEnrollmentKey": "00008030-0006404C2EE1802E",
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": null,
"declaredOperatingSystemVersion": null,
"declaredOperatingSystemSecurityPatchDate": null,
"declaredModel": null,
"group": {
"id": "NndTZCHjSMyUKP3XlCBosQ",
"name": "R&D",
"createdAt": "2024-04-18T12:31:32.000Z",
"emmGroupInfo": null,
"detectionPolicy": {
"id": "JIiW6eyUWoe9COTVCR4rww",
"name": "Standard",
"type": "Application and device threat",
"creationDate": "2024-01-21T22:47:37.034Z",
"lastModificationDate": "2024-01-21T22:47:37.034Z",
"inheritable": true,
"version": 1
}
},
"enrollmentStatus": {
"id": "FchrtdT-QT-xknMShye0eQ",
"lastConnection": null,
"coupled": false
},
"emmDeviceInfo": {
"id": "2vZdUKtuRCWHl4TDp8uTaw",
"externalId": "00008030-0006404C2EE1802E",
"emm": "airwatch"
}
},
"matchedResponseRules": []
}
}
}
{
"id": "QFtxnwWFCERsCvYI599bSv",
"creationDate": "2024-07-01T14:28:11.000Z",
"source": "system",
"category": "null",
"type": "DeviceCorrelationUpdated",
"content": {
"deviceCorrelation": {
"id": "4NofE0plT6enE7TDGZKpkA",
"creationDate": "2024-07-05T13:05:05.659Z",
"lastModificationDate": "2024-07-05T13:06:23.000Z",
"device": {
"id": "iowEjn9PR2WlrIIBR2_FPQ",
"serialNumber": "unknown",
"imei": "xxxxx",
"name": "Test device",
"email": "test@pradeo.dev",
"singleEnrollmentKey": "YbXeA#e}M((0T-fjpJj)-&ob!@ligF.g|jloU]c,{o9LN2Z_",
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "13",
"declaredOperatingSystemSecurityPatchDate": "2023-08-01T00:00:00.000Z",
"declaredModel": "SM-A536B",
"enrollmentStatus": {
"id": "hFju3jy1QZONn51xC5hMfg",
"lastConnection": "2024-07-05T14:58:48.000Z",
"coupled": true
},
"emmDeviceInfo": {
"id": "aAjHIhCd30aqyF7lfYu3RA",
"externalId": "xxxxx",
"emm": "unknown"
}
},
"detectionPolicy": {
"id": "JIiW6eyUWoe9COTVCR4rww",
"name": "Standard",
"type": "Application and device threat",
"creationDate": "2024-07-03T09:27:16.400Z",
"lastModificationDate": "2024-07-03T09:27:16.400Z",
"inheritable": true,
"version": 1
},
"applicationThreatLevel": "Red",
"systemThreatLevel": "Red",
"networkThreatLevel": "Green",
"matchedSystemStatusLevels": [
{
"id": "-Beyvn0rTOmgqC1rs3XaEw",
"systemStatusLevel": {
"id": "oYdBmpvDT0aUz1dCzRGYDw",
"level": "Orange",
"deviceSystemStatus": {
"id": "92Xbb2HhW02s85yh33nHfg",
"name": "SystemNotUpToDate"
}
},
"deviceSystemStatusRecord": {
"id": "57jwjBD9SLCnfh5bSWmzSA",
"value": 0
}
},
{
"id": "1YiiEuuATR2rB7nKinFU5g",
"systemStatusLevel": {
"id": "SX5zOVZoTWOn7oRTv8cNdw",
"level": "Orange",
"deviceSystemStatus": {
"id": "EmL050CAW-65ogu3GRSAsg",
"name": "ApplicationInstalledFromUnknownSource"
}
},
"deviceSystemStatusRecord": {
"id": "zrUxC90pTFOdDtfWlq_Mow",
"value": 1
}
},
{
"id": "5vljuTwJQhSFWGOD3EF-aQ",
"systemStatusLevel": {
"id": "_ukzZc57QouY7kudIIrEsw",
"level": "Orange",
"deviceSystemStatus": {
"id": "s6wK_SInU42K_g2bGsPbhg",
"name": "SELinuxPermissive"
}
},
"deviceSystemStatusRecord": {
"id": "_qLcu7a_TTatBWvbWRy8cA",
"value": 3
}
},
{
"id": "6HGN94xFQPm6f6UXr5jPdw",
"systemStatusLevel": {
"id": "gSIPIL0kSk62XlQuoelXDQ",
"level": "Green",
"deviceSystemStatus": {
"id": "FjkqaultWs-HBFWzHq3C8Q",
"name": "AccessibilityOption"
}
},
"deviceSystemStatusRecord": {
"id": "QMyc35a8TI27t5SFtvs_0A",
"value": 1
}
},
{
"id": "bH-NDdsATluwj6VZn-ZBzA",
"systemStatusLevel": {
"id": "Nbnd9EGxQMuqkF0KXysA4A",
"level": "Red",
"deviceSystemStatus": {
"id": "iEqcWkTpW8yARFKCv8MBYQ",
"name": "CustomHosts"
}
},
"deviceSystemStatusRecord": {
"id": "5ft9cwvGTI-Cnee1u-F9Aw",
"value": 0
}
},
{
"id": "d9CKeAvCT9Sb3vP06MOq4Q",
"systemStatusLevel": {
"id": "jWr0_EQpSj2z_JrkD2WOyQ",
"level": "Red",
"deviceSystemStatus": {
"id": "sMLlZzy8WFKDp8xev58LpA",
"name": "DebugMode"
}
},
"deviceSystemStatusRecord": {
"id": "aZUmMZ3cTNG3RfYhjpd8tQ",
"value": 1
}
},
{
"id": "juI58xKrSrK16Rk787RsnA",
"systemStatusLevel": {
"id": "hgwHAMvZTImT151inM8vYg",
"level": "Red",
"deviceSystemStatus": {
"id": "UzAgUIoDXLioT8Xca4q9UA",
"name": "DeviceNotEncrypted"
}
},
"deviceSystemStatusRecord": {
"id": "yyQGNf7sT_KVRGUFdtnygw",
"value": 0
}
},
{
"id": "VnfcT_lgRHurAfaGjym-rA",
"systemStatusLevel": {
"id": "lB0d6wk8TJWpmJ-96Fi02Q",
"level": "Orange",
"deviceSystemStatus": {
"id": "AV84fYHQXbyKjXZ52iuHLg",
"name": "DeveloperMode"
}
},
"deviceSystemStatusRecord": {
"id": "-drVU9tpS1qugsU-1d0EDA",
"value": 1
}
},
{
"id": "w0rOFu5STim869zy6aHs3w",
"systemStatusLevel": {
"id": "oRJbjuE2Sl2P8exMrFQTHw",
"level": "Red",
"deviceSystemStatus": {
"id": "cAwR35npXkmkg7IF3KnCgg",
"name": "Root"
}
},
"deviceSystemStatusRecord": {
"id": "mM3q-uXmR1-TJflwC-C72w",
"value": 0
}
}
],
"matchedNetworkStatusLevels": [
{
"id": "6_WYPd5hRp2ZKteAx_KUhw",
"networkStatusLevel": {
"id": "YgTHvrQqQUyIZTysaK_heQ",
"level": "Green",
"deviceNetworkStatus": {
"id": "hbaZqAT-VSG-6BWCL2ec0w",
"name": "ARPPoisoning"
}
},
"deviceNetworkStatusRecord": {
"id": "6EByUpV4R9qcggk9mQGylA",
"value": 3
}
},
{
"id": "8-WULaesQQSEbVyYk7_WAQ",
"networkStatusLevel": {
"id": "uHvq4MBERPuVAk3luwphrg",
"level": "Green",
"deviceNetworkStatus": {
"id": "WgEwwyksUIS2T5AFjKtGvg",
"name": "Bluetooth"
}
},
"deviceNetworkStatusRecord": {
"id": "n5gtT-ORQImbp3dql_SlHw",
"value": 0
}
},
{
"id": "alN6SbtoTk-39N9H7IEzrg",
"networkStatusLevel": {
"id": "y0CHemAGROCpswd5vu7BGQ",
"level": "Orange",
"deviceNetworkStatus": {
"id": "pwxiTO7iW0inGsISgmFxMQ",
"name": "NFC"
}
},
"deviceNetworkStatusRecord": {
"id": "06Hv_Fw-TC-ZRGbkoIWSkg",
"value": 0
}
},
{
"id": "D0piRvT4QbutQljPMalXsQ",
"networkStatusLevel": {
"id": "GO7UOVytQX-78Tzk5IOvjg",
"level": "Red",
"deviceNetworkStatus": {
"id": "fPrbn1lHXwuQAhrRgMvSTg",
"name": "RogueCellTower"
}
},
"deviceNetworkStatusRecord": {
"id": "bAeDvPxoTJ-5hLGUKHgpWw",
"value": 0
}
},
{
"id": "DZi_-u7HRl-zN_jP-MAlSw",
"networkStatusLevel": {
"id": "myxc8oiYTAWZEEwHvwbIEQ",
"level": "Orange",
"deviceNetworkStatus": {
"id": "5H_waBpbX6-W5Zg0SDQhIA",
"name": "ConnectionToUntrustedHotspots"
}
},
"deviceNetworkStatusRecord": {
"id": "xev8ikm5SX-s4zNVzbd9Cw",
"value": 0
}
},
{
"id": "gkrrmUKsSeiEvqgUr5IfUg",
"networkStatusLevel": {
"id": "G-pFFmnsSWe-LXZEkSqhBA",
"level": "Green",
"deviceNetworkStatus": {
"id": "YWXiVq4SUnimRuDEzzDb_w",
"name": "RogueAccessPoint"
}
},
"deviceNetworkStatusRecord": {
"id": "naAO765rRtyHscwBD3RrZg",
"value": 0
}
},
{
"id": "kj2F5qhIQzGMdPerO-Y3Lw",
"networkStatusLevel": {
"id": "O43t_Zq2SkeM6TZiFmM8jQ",
"level": "Red",
"deviceNetworkStatus": {
"id": "TSss4UX3XweuFnLLGSbR1w",
"name": "ManInTheMiddle"
}
},
"deviceNetworkStatusRecord": {
"id": "6y2ToOEXQmCyI2kHhxd7Eg",
"value": 0
}
},
{
"id": "TSfDjjttS-GYG_NS4rSKPg",
"networkStatusLevel": {
"id": "i0GslqZcR4K3k6k1S6EWHQ",
"level": "Green",
"deviceNetworkStatus": {
"id": "f4nzGKc5UF-0Ow_uz0_jHQ",
"name": "GPS"
}
},
"deviceNetworkStatusRecord": {
"id": "YNJfP2b7QdW3ULYB_CbIGw",
"value": 1
}
},
{
"id": "zeCc8trcQciYY4rLZce54w",
"networkStatusLevel": {
"id": "13GU2c4vTxC2QylhQtWpPg",
"level": "Orange",
"deviceNetworkStatus": {
"id": "WRrA_3G0WZOdV52312piYA",
"name": "VPN"
}
},
"deviceNetworkStatusRecord": {
"id": "08ZvMtm5TNOHTTkXujWD2w",
"value": 0
}
}
],
"status": "done"
}
}
}
{
"id": "QFtxnwWFCERsCvYI599bSv",
"creationDate": "2024-07-01T14:28:11.000Z",
"source": "admin",
"category": "Network",
"type": "DeviceDetection",
"content": {
"id": "android:p-2MTZU_S1jQsqz9Ommy_A",
"last_name": "m",
"first_name": "m",
"email": "",
"metric": "match_bluetooth",
"type": "BlueTooth activation",
"status": "END"
}
}
{
"id": "---tmfIPM0q8uo0bGtreRA",
"creationDate": "2024-07-05T08:58:43.325Z",
"source": "device",
"category": null,
"type": "DeviceStatusHistoryUpdated",
"content": {
"deviceId": "3DGAsW2pRhKZLArNUGBo4Q",
"event": {
"kind": "RogueCellTower",
"value": 2
}
},
"user": null,
"device": {
"id": "3DGAsW2pRhKZLArNUGBo4Q",
"serialNumber": "unknown",
"imei": null,
"name": null,
"email": null,
"singleEnrollmentKey": "{sa?LW]p:gWoGR}),ishy@)7XPoMI-)LH&n)g5v{aY{Wqi4b",
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "13",
"declaredOperatingSystemSecurityPatchDate": "2023-11-05T00:00:00.000Z",
"declaredModel": "EB2103",
"enrollmentStatus": {
"id": "etw6fGIcQtyKQDB3hbpXUQ",
"lastConnection": "2024-07-05T13:05:05.000Z",
"coupled": false
},
"emmDeviceInfo": null
},
"company": {
"id": "bufQJXK_RNamdgiPmXzpFg",
"name": "Mobile boat",
"creationDate": "2024-07-03T10:01:02.043Z",
"lastModificationDate": "2024-07-04T07:19:50.000Z",
"deletedAt": null
}
}
{
"id": "SQU4ZdbZSxqEIi1ioYP6mw",
"creationDate": "2024-07-01T14:28:20.233Z",
"source": "system",
"category": null,
"type": "DeviceNetworkStatusRecordUpdated",
"content": {
"deviceNetworkStatusRecord": {
"id": "7tUjB6riQGqo2Tqz4AmVPw",
"device": {
"id": "R96VSXfLT4i1UDNKioactw",
"serialNumber": "unknown",
"imei": null,
"name": "m m",
"email": null,
"singleEnrollmentKey": null,
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": null,
"declaredOperatingSystemVersion": null,
"declaredOperatingSystemSecurityPatchDate": null,
"declaredModel": null,
"company": {
"id": "JmidYbyCRpegHOjnpK4uag",
"name": "Pradeo",
"creationDate": "2023-09-11T13:15:14.000Z",
"lastModificationDate": "2024-04-19T10:03:30.000Z",
"deletedAt": null
},
"enrollmentStatus": {
"id": "2GxYOm6GR8qXdDRMrCjJwQ",
"lastConnection": "2024-07-01T09:54:07.000Z",
"coupled": true
},
"emmDeviceInfo": null,
"configuration": {
"id": "XXWAKzLmTIydNDbSbpLuWw",
"advancedMode": false,
"notificationPermission": "Undefined",
"geolocationPermission": "Undefined",
"callPermission": "Undefined",
"knoxPermission": "Undefined",
"vpnPermission": "Undefined",
"bluetoothPermission": "Undefined",
"deviceAdminPermission": "Undefined",
"overlayPermission": "Undefined",
"usageStatisticsPermission": "Undefined",
"accessibilityPermission": "Undefined",
"ignoreBatteryOptimizationPermission": "Undefined"
}
},
"deviceNetworkStatus": {
"id": "WgEwwyksUIS2T5AFjKtGvg",
"name": "Bluetooth"
},
"value": 0
}
}
}
{
"id": "Chp2bFsQTEGAJd67m_Na2w",
"creationDate": "2024-07-01T14:28:20.139Z",
"source": "system",
"category": null,
"type": "DeviceStatusHistoryUpdated",
"content": {
"deviceId": "R96VSXfLT4i1UDNKioactw",
"event": {
"id": "Aw9PSSUpT0idoAdhaiACbg",
"device": {
"id": "R96VSXfLT4i1UDNKioactw",
"serialNumber": "unknown",
"imei": null,
"name": "m m",
"email": null,
"singleEnrollmentKey": null,
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": null,
"declaredOperatingSystemVersion": null,
"declaredOperatingSystemSecurityPatchDate": null,
"declaredModel": null,
"company": {
"id": "JmidYbyCRpegHOjnpK4uag",
"name": "Pradeo",
"creationDate": "2023-09-11T13:15:14.000Z",
"lastModificationDate": "2024-04-19T10:03:30.000Z",
"deletedAt": null
},
"enrollmentStatus": {
"id": "2GxYOm6GR8qXdDRMrCjJwQ",
"lastConnection": "2024-07-01T09:54:07.000Z",
"coupled": true
},
"emmDeviceInfo": null
},
"kind": "Bluetooth",
"value": 0,
"eventDate": "2024-07-01T14:28:20.124Z"
}
}
}
{
"id": "hWjVNq-WRiefU1vqfrbeyQ",
"creationDate": "2024-06-27T11:24:13.592Z",
"source": "system",
"category": null,
"type": "DeviceSystemStatusRecordUpdated",
"content": {
"deviceSystemStatusRecord": {
"id": "2jA8-gQ6TCuGIgR9EMcbYQ",
"device": {
"id": "EeFFJKtPS0Gl52z5uzijKg",
"serialNumber": null,
"imei": null,
"name": " cs Ivanti EID2",
"email": null,
"singleEnrollmentKey": null,
"byod": true,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": null,
"declaredOperatingSystemVersion": null,
"declaredOperatingSystemSecurityPatchDate": null,
"declaredModel": null,
"company": {
"id": "JmidYbyCRpegHOjnpK4uag",
"name": "Pradeo",
"creationDate": "2023-09-11T13:15:14.000Z",
"lastModificationDate": "2024-04-19T10:03:30.000Z",
"deletedAt": null
},
"enrollmentStatus": {
"id": "ZWxQtoMWTKegjcvMinHaZg",
"lastConnection": "2024-06-21T12:07:57.000Z",
"coupled": true
},
"emmDeviceInfo": null,
"configuration": {
"id": "4oQgfWybS46D2huT1ggWLA",
"advancedMode": false,
"notificationPermission": "Undefined",
"geolocationPermission": "Undefined",
"callPermission": "Undefined",
"knoxPermission": "Undefined",
"vpnPermission": "Undefined",
"bluetoothPermission": "Undefined",
"deviceAdminPermission": "Undefined",
"overlayPermission": "Undefined",
"usageStatisticsPermission": "Undefined",
"accessibilityPermission": "Undefined",
"ignoreBatteryOptimizationPermission": "Undefined"
}
},
"deviceSystemStatus": {
"id": "AV84fYHQXbyKjXZ52iuHLg",
"name": "DeveloperMode"
},
"value": 1
}
}
}
{
"id": "1111111111111111111111",
"device": {
"id": "2222222222222222222222",
"serialNumber": null,
"imei": null,
"name": "DOE John",
"email": "john.doe@company.fr",
"singleEnrollmentKey": null,
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "16",
"declaredOperatingSystemSecurityPatchDate": "2025-09-01T00:00:00.000Z",
"declaredModel": null,
"company": {
"id": "3333333333333333333333",
"name": "Company Name",
"creationDate": "2024-05-15T09:36:12.260Z",
"lastModificationDate": "2024-12-06T13:45:54.000Z",
"deletedAt": null,
"assignedCommercialLicense": {
"id": "4444444444444444444444",
"name": "Company Name Commercial Licence",
"kind": "Classic",
"features": [
"mast",
"mtd",
"threatIntelligence"
],
"enrollmentsLimit": 900,
"trial": false,
"creationDate": "2024-06-28T09:24:04.571Z",
"lastModificationDate": "2026-06-17T09:05:33.000Z",
"expirationDate": "2027-04-30T22:00:00.000Z"
}
},
"operatingSystem": {
"id": "5555555555555555555555",
"name": "Android",
"version": "15",
"developedBy": "google",
"product": "Android15",
"releaseDate": "2024-09-03T00:00:00.000Z",
"softwareBuildNumber": "35",
"securityPatchDate": "1970-01-01T00:00:00.000Z"
},
"enrollmentStatus": {
"id": "6666666666666666666666",
"lastConnection": null,
"coupled": false,
"versionCode": null
},
"emmDeviceInfo": {
"id": "7777777777777777777777",
"externalId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
"integration": {
"id": "8888888888888888888888",
"emm": "intune",
"name": null,
"creationDate": "2024-10-16T09:29:00.714Z",
"lastModificationDate": "2025-08-12T09:40:20.000Z",
"active": true,
"jobs": "cleanGroups,updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices",
"settings": null,
"options": {
"testDevices": [],
"synchronizableGroupMarks": [
"[SYNC_GRP_PRADEO]"
],
"deviceHealth": {
"synchronizableGroupRules": [
{
"global": true,
"manage": true,
"basedOn": [
"eachStatus"
]
}
]
},
"managementGroups": {
"applyTo": {
"user": true,
"device": true
},
"synchronizableGroupRules": [
{
"global": true,
"managementGroups": []
}
]
}
}
},
"metadata": {
"deviceOwnershipCriteria": "managedDeviceOwnerType = company"
},
"lastSynchronizationDate": "2026-07-08T09:30:24.000Z"
},
"commercialLicense": {
"id": "4444444444444444444444",
"name": "Company Name Commercial Licence",
"kind": "Classic",
"features": [
"mast",
"mtd",
"threatIntelligence"
],
"enrollmentsLimit": 900,
"trial": false,
"creationDate": "2024-06-28T09:24:04.571Z",
"lastModificationDate": "2026-06-17T09:05:33.000Z",
"expirationDate": "2027-04-30T22:00:00.000Z"
}
}
}
{
"id": "aaaaaaaaaaaaaaaaaaaaaa",
"device": {
"id": "bbbbbbbbbbbbbbbbbbbbbb",
"serialNumber": null,
"imei": null,
"name": "DOE (950345) samsung SM-12345 Android 14.0 LZHB",
"email": "John.DOE@domain.eu",
"singleEnrollmentKey": null,
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemVersion": "14.0.0",
"declaredOperatingSystemSecurityPatchDate": "2026-05-05T00:00:00.000",
"declaredModel": null,
"company": {
"id": "company_id",
"name": "Company name",
"creationDate": "2024-10-14T14:00:32.750Z",
"lastModificationDate": "2024-11-27T08:50:18.000Z",
"deletedAt": null,
"assignedCommercialLicense": {
"id": "cccccccccccccccccccccc",
"name": "Company name",
"kind": "Classic",
"features": [
"mast",
"mtd",
"threatIntelligence"
],
"enrollmentsLimit": 4000,
"trial": false,
"creationDate": "2024-11-27T08:50:18.324Z",
"lastModificationDate": "2026-06-17T09:05:36.000Z",
"expirationDate": "2027-12-31T22:59:59.000Z"
}
},
"operatingSystem": {
"id": "dddddddddddddddddddddd",
"name": "Android",
"version": "14.0.0",
"developedBy": "google",
"product": "",
"releaseDate": null,
"softwareBuildNumber": null,
"securityPatchDate": null
},
"enrollmentStatus": {
"id": "eeeeeeeeeeeeeeeeeeeeee",
"lastConnection": null,
"coupled": false,
"versionCode": null
},
"emmDeviceInfo": {
"id": "ffffffffffffffffffffff",
"externalId": "11111111111111111111111111111111111111111",
"integration": {
"id": "gggggggggggggggggggggg",
"emm": "airwatch",
"name": null,
"creationDate": "2024-10-28T14:29:15.060Z",
"lastModificationDate": "2025-11-19T09:33:09.000Z",
"active": true,
"jobs": "updateGroups,cleanGroups,updateTags,updateDevices,cleanDevices,updateApplications",
"settings": null,
"options": {
"purge": {
"onlyEnrolledOnPradeo": {
"delete": null,
"unenroll": null
},
"unEnrolled": {
"delete": 1,
"unenroll": null
},
"deviceWipePending": {
"delete": 1,
"unenroll": null
},
"enterpriseWipePending": {
"delete": 1,
"unenroll": null
}
},
"timeBetweenPradeoAndAirwatchLastConnections": 48,
"denyLists": {
"android": {
"airwatchAppGroupId": null,
"appGroupDescription": "Risk Management policy for apps with malicious behaviors.",
"appGroupName": "Pradeo SOCSI Blacklist Apps ANDROID"
},
"ios": {
"airwatchAppGroupId": null,
"appGroupDescription": "Risk Management policy for apps with malicious behaviors.",
"appGroupName": "Pradeo SOCSI Blacklist Apps IOS"
},
"policy": null
},
"organizationGroupIdList": [
570,
574,
575,
576,
577,
578,
582,
583,
621,
622,
623,
624,
627,
652,
681,
683,
689,
636,
644,
645,
651,
687,
638,
648,
649,
653,
659,
677,
686,
657,
658,
660,
661,
663,
664,
666,
668,
671,
672,
674,
678,
676,
679,
680,
682,
685,
690,
691,
646,
654,
688,
694,
695,
696,
697
],
"organizationGroupIdListBehavior": "including",
"tags": [
{
"global": true,
"tags": [
"MK93Ny35VUy8BIHO-wDFaA",
"NXf8WWZTWCSwYl3LNtf5EQ",
"2so1P8_sX5KqAovl0Yn65w",
"UpDJ-nSTWD6ehbnuomNOwg",
"QLXVzz20U9KXu4NZxYxTaA",
"0Pcfqh2PUme9CyugFJdkeA",
"7MZTXCptVYCGYnU-iWyHUg",
"QokCjWrgTE6aStvRDmdHkg",
"ePefaMWsQMaEr_R9eUHFUg",
"SfgdfJUCRSajQkyqhjB-4w",
"Tmj6YlQMQSGCrOFxUvp45w"
]
}
],
"testDevices": [],
"synchronizeDenyLists": true,
"fieldsMap": {
"USER_EMAIL": "UserEmailAddress",
"user_name": "DeviceFriendlyName"
}
}
},
"metadata": {
"uuid": "11111111-1111-1111-1111-111111111111",
"secured": true,
"enrollmentStatus": "Enrolled",
"deviceOwnershipCriteria": "Ownership = C"
},
"lastSynchronizationDate": "2026-07-08T09:30:15.000Z"
},
"commercialLicense": {
"id": "cccccccccccccccccccccc",
"name": "Company name",
"kind": "Classic",
"features": [
"mast",
"mtd",
"threatIntelligence"
],
"enrollmentsLimit": 4000,
"trial": false,
"creationDate": "2024-11-27T08:50:18.324Z",
"lastModificationDate": "2026-06-17T09:05:36.000Z",
"expirationDate": "2027-12-31T22:59:59.000Z"
}
}
}
{
"id": "00000000-0000-0000-0000-000000000000",
"deviceCorrelation": {
"id": "11111111-1111-1111-1111-111111111111",
"creationDate": "2026-03-30T08:30:17.351Z",
"lastModificationDate": "2026-04-16T16:34:52.000Z",
"device": {
"id": "22222222-2222-2222-2222-222222222222",
"serialNumber": null,
"imei": null,
"name": "John Doe",
"email": "j.doe@example.com",
"byod": true,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "iOS",
"declaredOperatingSystemVersion": "26.5",
"declaredOperatingSystemSecurityPatchDate": "1970-01-01T00:00:00.000Z",
"declaredModel": "iPhone17,1",
"enrollmentStatus": {
"id": "33333333-3333-3333-3333-333333333333",
"lastConnection": "2026-03-30T08:37:34.000Z",
"coupled": true,
"versionCode": null
},
"emmDeviceInfo": {
"id": "44444444-4444-4444-4444-444444444444",
"externalId": "55555555-5555-5555-5555-555555555555",
"integration": {
"id": "66666666-6666-6666-6666-666666666666",
"emm": "intune",
"name": null,
"creationDate": "2025-02-10T16:16:26.783Z",
"lastModificationDate": "2025-07-28T17:09:46.000Z",
"active": true,
"jobs": "updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices",
"settings": null,
"options": {
"testDevices": [],
"synchronizableGroupMarks": [
"[SYNC_GRP_PRADEO]"
],
"deviceHealth": {
"synchronizableGroupRules": [
{
"global": true,
"manage": true,
"basedOn": [
"eachStatus"
]
},
{
"global": false,
"id": "77777777-7777-7777-7777-777777777777",
"basedOn": [
"globalDeviceStatus"
],
"manage": true
},
{
"global": false,
"id": "88888888-8888-8888-8888-888888888888",
"basedOn": [
"globalDeviceStatus",
"pradeoEnrollment"
],
"manage": true
}
]
},
"managementGroups": {
"applyTo": {
"user": true,
"device": true
},
"synchronizableGroupRules": [
{
"global": true,
"managementGroups": []
}
]
}
}
},
"metadata": {
"deviceOwnershipCriteria": "managedDeviceOwnerType = personal",
"lastDeviceStateSent": "3"
},
"lastSynchronizationDate": "2026-07-16T08:00:17.000Z"
}
},
"detectionPolicy": {
"id": "99999999-9999-9999-9999-999999999999",
"name": "Flexible",
"type": "Application and device threat",
"creationDate": "2023-12-04T17:53:57.000Z",
"lastModificationDate": "2025-12-09T09:30:18.000Z",
"inheritable": true,
"version": 4,
"antivirusScanThreshold": 2,
"malwarePredictionStatusLevel": "Orange"
},
"applicationThreatLevel": "Orange",
"systemThreatLevel": "NotYetAvailable",
"networkThreatLevel": "NotYetAvailable",
"matchedSystemStatusLevels": [],
"matchedNetworkStatusLevels": [],
"status": "done"
}
}
{
"id": "00000000-0000-0000-0000-000000000000",
"emmApplication": {
"id": "11111111-1111-1111-1111-111111111111",
"integration": {
"id": "22222222-2222-2222-2222-222222222222",
"company": {
"id": "33333333-3333-3333-3333-333333333333",
"name": "LookUpSpace",
"creationDate": "2025-02-04T08:49:17.170Z",
"lastModificationDate": "2025-03-14T10:16:55.000Z",
"deletedAt": null
},
"emm": "intune",
"name": null,
"creationDate": "2025-02-10T16:16:26.783Z",
"lastModificationDate": "2025-07-28T17:09:46.000Z",
"active": true,
"jobs": "updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices",
"settings": null,
"options": {
"testDevices": [],
"synchronizableGroupMarks": [
"[SYNC_GRP_PRADEO]"
],
"deviceHealth": {
"synchronizableGroupRules": [
{
"global": true,
"manage": true,
"basedOn": [
"eachStatus"
]
},
{
"global": false,
"id": "44444444-4444-4444-4444-444444444444",
"basedOn": [
"globalDeviceStatus"
],
"manage": true
},
{
"global": false,
"id": "55555555-5555-5555-5555-555555555555",
"basedOn": [
"globalDeviceStatus",
"pradeoEnrollment"
],
"manage": true
}
]
},
"managementGroups": {
"applyTo": {
"user": true,
"device": true
},
"synchronizableGroupRules": [
{
"global": true,
"managementGroups": []
}
]
}
}
},
"name": "Etsy",
"package": "com.etsy.etsyforios",
"system": "iOS",
"versionCode": null,
"version": "7.85",
"size": null,
"application": {
"id": "66666666-6666-6666-6666-666666666666",
"package": {
"id": "77777777-7777-7777-7777-777777777777",
"package": "com.etsy.etsyforios",
"system": "iOS"
},
"version": "7.85",
"md5": null,
"sha1": null,
"sha256": null,
"name": "Etsy",
"versionCode": null,
"size": null,
"owners": [
{
"id": "88888888-8888-8888-8888-888888888888",
"name": "LookUpSpace",
"creationDate": "2025-02-04T08:49:17.170Z",
"lastModificationDate": "2025-03-14T10:16:55.000Z",
"deletedAt": null
}
]
},
"matchKind": "matchPackageAndVersion"
}
}
{
"id": "00000000-0000-0000-0000-000000000000",
"deviceApplicationCompliance": {
"id": "11111111-1111-1111-1111-111111111111",
"status": "Approved",
"computed": true,
"creationDate": "2026-07-16T08:00:31.465Z",
"lastModificationDate": "2026-07-16T08:00:32.000Z",
"deviceApplication": {
"id": "22222222-2222-2222-2222-222222222222",
"application": {
"id": "33333333-3333-3333-3333-333333333333",
"package": {
"id": "44444444-4444-4444-4444-444444444444",
"package": "com.example.application",
"system": "iOS"
},
"version": "3.47.0",
"md5": null,
"sha1": null,
"sha256": null,
"name": "Example",
"versionCode": null,
"size": null
},
"device": {
"id": "55555555-5555-5555-5555-555555555555",
"serialNumber": null,
"imei": "357473867852731",
"name": "John Doe",
"email": "j.doe@example.com",
"byod": false,
"lockPassword": null,
"knoxVersion": null,
"declaredOperatingSystem": "iOS",
"declaredOperatingSystemVersion": "26.5.2",
"declaredOperatingSystemSecurityPatchDate": "1970-01-01T00:00:00.000Z",
"declaredModel": "iPhone17,3",
"enrollmentStatus": {
"id": "66666666-6666-6666-6666-666666666666",
"lastConnection": "2026-04-10T14:00:22.000Z",
"coupled": true,
"versionCode": null
},
"emmDeviceInfo": {
"id": "77777777-7777-7777-7777-777777777777",
"externalId": "88888888-8888-8888-8888-888888888888",
"metadata": {
"deviceOwnershipCriteria": "managedDeviceOwnerType = company",
"lastDeviceStateSent": "3"
},
"lastSynchronizationDate": "2026-07-16T08:00:17.000Z"
}
},
"installedAt": "2026-07-16T08:00:31.000Z",
"uninstalledAt": null,
"native": false
},
"matchedResponseRules": []
}
}
Detection section
The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.
Related Built-in Rules
The following Sekoia.io built-in rules match the intake Pradeo MTD. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.
SEKOIA.IO x Pradeo MTD on ATT&CK Navigator
Sekoia.io Activity Logs Rule Deactivation Bulk
Detects a massive rule deactivation observed threw Sekoia.io activity logs.
- Effort: master
Event Categories
The following table lists the data source offered by this integration.
| Data Source | Description |
|---|---|
Anti-virus |
PradeoSecurity analyses applications to prevent malicious actions. |
Network device configuration |
PradeoSecurity analyses device network configuration to prevent malicious actions. |
Data loss prevention |
PradeoSecurity analyses applications to identify data leaks. |
In details, the following table denotes the type of events produced by this integration.
| Name | Values |
|---|---|
| Kind | `` |
| Category | configuration, process |
| Type | change, info |
Transformed Events Samples after Ingestion
This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.
{
"message": "{\"id\":\"jyFgy57XQGm0oEk6V_6tdA\",\"creationDate\":\"2024-07-23T13:28:32.594Z\",\"source\":\"admin\",\"category\":null,\"type\":\"MessageCreated\",\"content\":{\"message\":{\"id\":\"u7GTsigSS1CWtS_y80zpgw\",\"title\":\"test\",\"content\":\"envoye a 15:28\",\"creationDate\":\"2024-07-23T13:28:32.578Z\"}},\"user\":{\"id\":\"gA0jK6lCSBWZ3-ZMR9IoFw\",\"email\":\"alan.smithee@pradeo.com\",\"firstName\":\"Alan\",\"lastName\":\"Smithee\",\"jobTitle\":null,\"phoneNumber\":null,\"language\":\"English\",\"isDeactivated\":false,\"isFirstConnection\":true,\"toNotify\":false,\"lastConnectionDate\":\"2024-07-23T14:56:26.000Z\",\"creationDate\":\"2024-07-03T12:24:48.924Z\",\"lastModificationDate\":\"2024-07-23T14:56:26.000Z\"},\"device\":null,\"company\":{\"id\":\"bufQJXK_RNamdgiPmXzpFg\",\"name\":\"Mobile boat\",\"creationDate\":\"2024-07-03T10:01:02.043Z\",\"lastModificationDate\":\"2024-07-04T07:19:50.000Z\",\"deletedAt\":null}}",
"event": {
"action": "MessageCreated"
},
"@timestamp": "2024-07-23T13:28:32.594000Z",
"pradeo": {
"metadata": {
"creationDate": "2024-07-23T13:28:32.594000Z",
"id": "jyFgy57XQGm0oEk6V_6tdA",
"source": "admin",
"type": "MessageCreated"
}
},
"user": {
"email": "alan.smithee@pradeo.com",
"full_name": "Alan Smithee",
"id": "gA0jK6lCSBWZ3-ZMR9IoFw"
}
}
{
"message": "{\"id\":\"8bnDz9zBI0S25lsXD22nxg\",\"creationDate\":\"2024-07-02T07:02:15.721Z\",\"source\":\"device\",\"category\":null,\"type\":\"ApplicationCreated\",\"content\":{\"application\":{\"id\":\"6DN0jTLmX8-958o-fa3pnQ\",\"version\":\"1.10.2\",\"md5\":\"673937eab709d3e3999b25bc564902c4\",\"sha1\":\"639f1ebc03aac79374e70123d15bd00fc68d37af\",\"sha256\":\"8ddb8f0098f6159fba0a56444fe67634adb7903770eaa646ef202f8d8f32d3df\",\"name\":\"Sonic 2\",\"versionCode\":\"217\",\"size\":83816851,\"package\":{\"id\":\"N4N-N9ByVrKDs-WCpxSj6Q\",\"package\":\"com.sega.sonic2.runner\",\"system\":\"Android\"}}}}",
"event": {
"action": "ApplicationCreated"
},
"@timestamp": "2024-07-02T07:02:15.721000Z",
"pradeo": {
"metadata": {
"creationDate": "2024-07-02T07:02:15.721000Z",
"id": "8bnDz9zBI0S25lsXD22nxg",
"source": "device",
"type": "ApplicationCreated"
}
}
}
{
"message": "{\n \"id\": \"1234567890\",\n \"creationDate\": \"2024-11-27T04:10:33.460Z\",\n \"source\": \"system\",\n \"category\": null,\n \"type\": \"DeviceApplicationComplianceUpdated\",\n \"content\": {\n \"deviceApplicationCompliance\": {\n \"id\": \"abcdef123456\",\n \"status\": \"Disapproved\",\n \"computed\": true,\n \"creationDate\": \"2024-11-27T04:04:26.482Z\",\n \"lastModificationDate\": \"2024-11-27T04:10:33.000Z\",\n \"deviceApplication\": {\n \"id\": \"123456789ABCDEF\",\n \"application\": {\n \"id\": \"azertyuiop\",\n \"package\": {\n \"id\": \"1234abcd\",\n \"package\": \"com.app.test\",\n \"system\": \"Android\"\n },\n \"version\": \"491.0.0.58.78\",\n \"md5\": \"0fccfdefc882c4be6d2a938001184e08\",\n \"sha1\": \"749c94cd972726ef2b3ccda7e718a2034cc9f6ac\",\n \"sha256\": \"278fde8924687bf22285d2b4415779d96ba967530cae43272029ec53ecc2eee8\",\n \"name\": \"App\",\n \"versionCode\": \"457215664\",\n \"size\": \"64262264\"\n },\n \"device\": {\n \"id\": \"device_id01\",\n \"serialNumber\": \"unknown\",\n \"imei\": null,\n \"name\": \"John\",\n \"email\": null,\n \"singleEnrollmentKey\": \"xxxxxXXXXxxXxxx\",\n \"byod\": false,\n \"lockPassword\": null,\n \"knoxVersion\": null,\n \"declaredOperatingSystem\": \"Android\",\n \"declaredOperatingSystemVersion\": \"10.0.0\",\n \"declaredOperatingSystemSecurityPatchDate\": \"2020-09-01T00:00:00.000Z\",\n \"declaredModel\": \"MODEL 01\",\n \"enrollmentStatus\": {\n \"id\": \"enrollid_12\",\n \"lastConnection\": \"2024-11-27T04:07:32.000Z\",\n \"coupled\": true\n },\n \"emmDeviceInfo\": null\n },\n \"installedAt\": \"2024-08-07T13:40:35.000Z\",\n \"uninstalledAt\": null,\n \"native\": false\n },\n \"matchedResponseRules\": [\n {\n \"id\": \"matched_response_id\",\n \"matchConditions\": [\n {\n \"type\": \"threatLevelIs\",\n \"value\": \"Red\"\n }\n ],\n \"notifyAdministrator\": false,\n \"onDeviceNotification\": false,\n \"action\": \"Disapproved\",\n \"responseRuleset\": {\n \"id\": \"yMXqFSTMT8uDn1ijwCmEGA\",\n \"name\": \"FallBack\",\n \"active\": true,\n \"type\": \"FallBack\",\n \"priority\": 0\n },\n \"priority\": 0\n }\n ]\n }\n },\n \"user\": null,\n \"device\": null,\n \"company\": {\n \"id\": \"ROhGBpGHSi2gpVagfb4FhQ\",\n \"name\": \"LAB\",\n \"creationDate\": \"2024-04-15T15:31:33.395Z\",\n \"lastModificationDate\": \"2024-08-07T13:23:42.000Z\",\n \"deletedAt\": null\n }\n}",
"event": {
"action": "DeviceApplicationComplianceUpdated",
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2024-11-27T04:10:33.460000Z",
"pradeo": {
"application": {
"id": "azertyuiop",
"md5": "0fccfdefc882c4be6d2a938001184e08",
"name": "App",
"package": "com.app.test",
"sha1": "749c94cd972726ef2b3ccda7e718a2034cc9f6ac",
"sha256": "278fde8924687bf22285d2b4415779d96ba967530cae43272029ec53ecc2eee8",
"system": "Android",
"version": "491.0.0.58.78",
"versionCode": "457215664"
},
"detection": {
"status": "Disapproved"
},
"device": {
"byod": false,
"coupled": true,
"declaredModel": "MODEL 01",
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2020-09-01T00:00:00Z",
"declaredOperatingSystemVersion": "10.0.0",
"id": "device_id01",
"lastConnection": "2024-11-27T04:07:32Z",
"name": "John",
"serialNumber": "unknown"
},
"metadata": {
"creationDate": "2024-11-27T04:10:33.460000Z",
"id": "1234567890",
"source": "system",
"type": "DeviceApplicationComplianceUpdated"
}
}
}
{
"message": "{\"id\":\"_czh5ptATAa0TDv8cCR75g\",\"creationDate\":\"2024-07-02T12:20:01.795Z\",\"source\":\"system\",\"category\":null,\"type\":\"DetectionPolicyUpdated\",\"content\":{\"detectionPolicy\":{\"id\":\"R-cZz0iUSyujQ954d3qytw\",\"name\":\"iO Si Senor\",\"creationDate\":\"2023-11-13T17:58:03.000Z\",\"lastModificationDate\":\"2024-05-27T08:14:01.531Z\",\"company\":{\"id\":\"JmidYbyCRpegHOjnpK4uag\",\"name\":\"Pradeo\",\"creationDate\":\"2023-09-11T13:15:14.000Z\",\"lastModificationDate\":\"2024-04-19T10:03:30.000Z\",\"deletedAt\":null},\"inheritable\":false,\"dataRules\":[],\"featureRules\":[],\"communicationRules\":[],\"systemStatusLevels\":[],\"networkStatusLevels\":[],\"deviceGroups\":[],\"handledCompanies\":[],\"version\":1}}}",
"event": {
"action": "DetectionPolicyUpdated"
},
"@timestamp": "2024-07-02T12:20:01.795000Z",
"pradeo": {
"metadata": {
"creationDate": "2024-07-02T12:20:01.795000Z",
"id": "_czh5ptATAa0TDv8cCR75g",
"source": "system",
"type": "DetectionPolicyUpdated"
}
}
}
{
"message": "{\"id\":\"testId\",\"creationDate\":\"2025-08-01T09:26:30.112Z\",\"source\":\"system\",\"category\":null,\"type\":\"DeviceApplicationComplianceUpdated\",\"user\":null,\"device\":null,\"company\":{\"id\":\"_testOther\",\"name\":\"soc-sns-security\",\"creationDate\":\"2025-04-15T15:48:02.092Z\",\"lastModificationDate\":\"2025-08-01T09:25:35.000Z\",\"deletedAt\":null},\"integration\":null,\"content\":{\"deviceApplicationCompliance\":{\"id\":\"werwerwer\",\"status\":\"Approved\",\"computed\":true,\"creationDate\":\"2025-08-01T09:16:21.440Z\",\"lastModificationDate\":\"2025-08-01T09:26:30.000Z\",\"deviceApplication\":{\"id\":\"_testDevAppId\",\"application\":{\"id\":\"appId\",\"package\":{\"id\":\"W_id_random\",\"package\":\"com.android.settings\",\"system\":\"Android\"},\"version\":\"15\",\"md5\":\"0000000000000000000\",\"sha1\":\"111111111111111111111111\",\"sha256\":\"3333333333333333333333333333\",\"name\":\"Param\u00e8tres\",\"versionCode\":\"35\",\"size\":\"111376995\"},\"device\":{\"id\":\"devId1\",\"serialNumber\":\"unknown\",\"imei\":null,\"name\":\"TTT\",\"email\":null,\"byod\":false,\"lockPassword\":null,\"knoxVersion\":\"38\",\"declaredOperatingSystem\":\"Android\",\"declaredOperatingSystemVersion\":\"15.0.0\",\"declaredOperatingSystemSecurityPatchDate\":\"2025-06-01T00:00:00.000Z\",\"declaredModel\":\"SM-A556B\",\"enrollmentStatus\":{\"id\":\"testId00000000\",\"lastConnection\":\"2025-08-01T09:25:11.000Z\",\"coupled\":true,\"versionCode\":null},\"emmDeviceInfo\":null},\"installedAt\":\"2022-01-01T00:00:00.000Z\",\"uninstalledAt\":null,\"native\":true},\"matchedResponseRules\":[{\"id\":\"otherId111111111\",\"matchConditions\":[{\"type\":\"nativeStatusIs\",\"value\":\"native\"}],\"notifyAdministrator\":false,\"onDeviceNotification\":false,\"action\":\"Approved\",\"responseRuleset\":{\"id\":\"rulesetId\",\"name\":\"GloballyEnforced\",\"active\":true,\"type\":\"GloballyEnforced\",\"priority\":0},\"priority\":0},{\"id\":\"tttttttttt\",\"matchConditions\":[{\"type\":\"threatLevelIs\",\"value\":\"Red\"}],\"notifyAdministrator\":false,\"onDeviceNotification\":false,\"action\":\"Disapproved\",\"responseRuleset\":{\"id\":\"dddddddddddddd\",\"name\":\"FallBack\",\"active\":true,\"type\":\"FallBack\",\"priority\":0},\"priority\":0}]}}}",
"event": {
"action": "DeviceApplicationComplianceUpdated",
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2025-08-01T09:26:30.112000Z",
"pradeo": {
"application": {
"id": "appId",
"md5": "0000000000000000000",
"name": "Param\u00e8tres",
"package": "com.android.settings",
"sha1": "111111111111111111111111",
"sha256": "3333333333333333333333333333",
"system": "Android",
"version": "15",
"versionCode": "35"
},
"detection": {
"status": "Approved"
},
"device": {
"byod": false,
"coupled": true,
"declaredModel": "SM-A556B",
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2025-06-01T00:00:00Z",
"declaredOperatingSystemVersion": "15.0.0",
"id": "devId1",
"lastConnection": "2025-08-01T09:25:11Z",
"name": "TTT",
"serialNumber": "unknown"
},
"metadata": {
"creationDate": "2025-08-01T09:26:30.112000Z",
"id": "testId",
"source": "system",
"type": "DeviceApplicationComplianceUpdated"
}
}
}
{
"message": "{\"id\":\"XjR27UNPT7ixTAV6M4YBEA\",\"creationDate\":\"2024-07-01T17:24:54.784Z\",\"source\":\"system\",\"category\":null,\"type\":\"DeviceComplianceUpdated\",\"content\":{\"deviceCompliance\":{\"id\":\"tw0T69jkS1SOdBc-QFat8A\",\"status\":\"Approved\",\"computed\":true,\"creationDate\":\"2024-07-01T17:01:20.075Z\",\"lastModificationDate\":\"2024-07-01T17:02:02.000Z\",\"device\":{\"id\":\"kfvsh37xT2GUUlQHBZSIZw\",\"serialNumber\":null,\"imei\":\"356568109376877\",\"name\":\"remy iPhone iOS 17.5.1 N736\",\"email\":null,\"singleEnrollmentKey\":\"00008030-0006404C2EE1802E\",\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":null,\"declaredOperatingSystemVersion\":null,\"declaredOperatingSystemSecurityPatchDate\":null,\"declaredModel\":null,\"group\":{\"id\":\"NndTZCHjSMyUKP3XlCBosQ\",\"name\":\"R&D\",\"createdAt\":\"2024-04-18T12:31:32.000Z\",\"emmGroupInfo\":null,\"detectionPolicy\":{\"id\":\"JIiW6eyUWoe9COTVCR4rww\",\"name\":\"Standard\",\"type\":\"Application and device threat\",\"creationDate\":\"2024-01-21T22:47:37.034Z\",\"lastModificationDate\":\"2024-01-21T22:47:37.034Z\",\"inheritable\":true,\"version\":1}},\"enrollmentStatus\":{\"id\":\"FchrtdT-QT-xknMShye0eQ\",\"lastConnection\":null,\"coupled\":false},\"emmDeviceInfo\":{\"id\":\"2vZdUKtuRCWHl4TDp8uTaw\",\"externalId\":\"00008030-0006404C2EE1802E\",\"emm\":\"airwatch\"}},\"matchedResponseRules\":[]}}}",
"event": {
"action": "DeviceComplianceUpdated",
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2024-07-01T17:24:54.784000Z",
"pradeo": {
"compliance": {
"matchedResponseRules": []
},
"detection": {
"status": "Approved"
},
"device": {
"byod": false,
"coupled": false,
"emm": "airwatch",
"id": "kfvsh37xT2GUUlQHBZSIZw",
"imei": "356568109376877",
"mdmId": "00008030-0006404C2EE1802E",
"name": "remy iPhone iOS 17.5.1 N736"
},
"metadata": {
"creationDate": "2024-07-01T17:24:54.784000Z",
"id": "XjR27UNPT7ixTAV6M4YBEA",
"source": "system",
"type": "DeviceComplianceUpdated"
}
}
}
{
"message": "{\"id\":\"QFtxnwWFCERsCvYI599bSv\",\"creationDate\":\"2024-07-01T14:28:11.000Z\",\"source\":\"system\",\"category\":\"null\",\"type\":\"DeviceCorrelationUpdated\",\"content\":{\"deviceCorrelation\":{\"id\":\"4NofE0plT6enE7TDGZKpkA\",\"creationDate\":\"2024-07-05T13:05:05.659Z\",\"lastModificationDate\":\"2024-07-05T13:06:23.000Z\",\"device\":{\"id\":\"iowEjn9PR2WlrIIBR2_FPQ\",\"serialNumber\":\"unknown\",\"imei\":\"xxxxx\",\"name\":\"Test device\",\"email\":\"test@pradeo.dev\",\"singleEnrollmentKey\":\"YbXeA#e}M((0T-fjpJj)-&ob!@ligF.g|jloU]c,{o9LN2Z_\",\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":\"Android\",\"declaredOperatingSystemVersion\":\"13\",\"declaredOperatingSystemSecurityPatchDate\":\"2023-08-01T00:00:00.000Z\",\"declaredModel\":\"SM-A536B\",\"enrollmentStatus\":{\"id\":\"hFju3jy1QZONn51xC5hMfg\",\"lastConnection\":\"2024-07-05T14:58:48.000Z\",\"coupled\":true},\"emmDeviceInfo\":{\"id\":\"aAjHIhCd30aqyF7lfYu3RA\",\"externalId\":\"xxxxx\",\"emm\":\"unknown\"}},\"detectionPolicy\":{\"id\":\"JIiW6eyUWoe9COTVCR4rww\",\"name\":\"Standard\",\"type\":\"Application and device threat\",\"creationDate\":\"2024-07-03T09:27:16.400Z\",\"lastModificationDate\":\"2024-07-03T09:27:16.400Z\",\"inheritable\":true,\"version\":1},\"applicationThreatLevel\":\"Red\",\"systemThreatLevel\":\"Red\",\"networkThreatLevel\":\"Green\",\"matchedSystemStatusLevels\":[{\"id\":\"-Beyvn0rTOmgqC1rs3XaEw\",\"systemStatusLevel\":{\"id\":\"oYdBmpvDT0aUz1dCzRGYDw\",\"level\":\"Orange\",\"deviceSystemStatus\":{\"id\":\"92Xbb2HhW02s85yh33nHfg\",\"name\":\"SystemNotUpToDate\"}},\"deviceSystemStatusRecord\":{\"id\":\"57jwjBD9SLCnfh5bSWmzSA\",\"value\":0}},{\"id\":\"1YiiEuuATR2rB7nKinFU5g\",\"systemStatusLevel\":{\"id\":\"SX5zOVZoTWOn7oRTv8cNdw\",\"level\":\"Orange\",\"deviceSystemStatus\":{\"id\":\"EmL050CAW-65ogu3GRSAsg\",\"name\":\"ApplicationInstalledFromUnknownSource\"}},\"deviceSystemStatusRecord\":{\"id\":\"zrUxC90pTFOdDtfWlq_Mow\",\"value\":1}},{\"id\":\"5vljuTwJQhSFWGOD3EF-aQ\",\"systemStatusLevel\":{\"id\":\"_ukzZc57QouY7kudIIrEsw\",\"level\":\"Orange\",\"deviceSystemStatus\":{\"id\":\"s6wK_SInU42K_g2bGsPbhg\",\"name\":\"SELinuxPermissive\"}},\"deviceSystemStatusRecord\":{\"id\":\"_qLcu7a_TTatBWvbWRy8cA\",\"value\":3}},{\"id\":\"6HGN94xFQPm6f6UXr5jPdw\",\"systemStatusLevel\":{\"id\":\"gSIPIL0kSk62XlQuoelXDQ\",\"level\":\"Green\",\"deviceSystemStatus\":{\"id\":\"FjkqaultWs-HBFWzHq3C8Q\",\"name\":\"AccessibilityOption\"}},\"deviceSystemStatusRecord\":{\"id\":\"QMyc35a8TI27t5SFtvs_0A\",\"value\":1}},{\"id\":\"bH-NDdsATluwj6VZn-ZBzA\",\"systemStatusLevel\":{\"id\":\"Nbnd9EGxQMuqkF0KXysA4A\",\"level\":\"Red\",\"deviceSystemStatus\":{\"id\":\"iEqcWkTpW8yARFKCv8MBYQ\",\"name\":\"CustomHosts\"}},\"deviceSystemStatusRecord\":{\"id\":\"5ft9cwvGTI-Cnee1u-F9Aw\",\"value\":0}},{\"id\":\"d9CKeAvCT9Sb3vP06MOq4Q\",\"systemStatusLevel\":{\"id\":\"jWr0_EQpSj2z_JrkD2WOyQ\",\"level\":\"Red\",\"deviceSystemStatus\":{\"id\":\"sMLlZzy8WFKDp8xev58LpA\",\"name\":\"DebugMode\"}},\"deviceSystemStatusRecord\":{\"id\":\"aZUmMZ3cTNG3RfYhjpd8tQ\",\"value\":1}},{\"id\":\"juI58xKrSrK16Rk787RsnA\",\"systemStatusLevel\":{\"id\":\"hgwHAMvZTImT151inM8vYg\",\"level\":\"Red\",\"deviceSystemStatus\":{\"id\":\"UzAgUIoDXLioT8Xca4q9UA\",\"name\":\"DeviceNotEncrypted\"}},\"deviceSystemStatusRecord\":{\"id\":\"yyQGNf7sT_KVRGUFdtnygw\",\"value\":0}},{\"id\":\"VnfcT_lgRHurAfaGjym-rA\",\"systemStatusLevel\":{\"id\":\"lB0d6wk8TJWpmJ-96Fi02Q\",\"level\":\"Orange\",\"deviceSystemStatus\":{\"id\":\"AV84fYHQXbyKjXZ52iuHLg\",\"name\":\"DeveloperMode\"}},\"deviceSystemStatusRecord\":{\"id\":\"-drVU9tpS1qugsU-1d0EDA\",\"value\":1}},{\"id\":\"w0rOFu5STim869zy6aHs3w\",\"systemStatusLevel\":{\"id\":\"oRJbjuE2Sl2P8exMrFQTHw\",\"level\":\"Red\",\"deviceSystemStatus\":{\"id\":\"cAwR35npXkmkg7IF3KnCgg\",\"name\":\"Root\"}},\"deviceSystemStatusRecord\":{\"id\":\"mM3q-uXmR1-TJflwC-C72w\",\"value\":0}}],\"matchedNetworkStatusLevels\":[{\"id\":\"6_WYPd5hRp2ZKteAx_KUhw\",\"networkStatusLevel\":{\"id\":\"YgTHvrQqQUyIZTysaK_heQ\",\"level\":\"Green\",\"deviceNetworkStatus\":{\"id\":\"hbaZqAT-VSG-6BWCL2ec0w\",\"name\":\"ARPPoisoning\"}},\"deviceNetworkStatusRecord\":{\"id\":\"6EByUpV4R9qcggk9mQGylA\",\"value\":3}},{\"id\":\"8-WULaesQQSEbVyYk7_WAQ\",\"networkStatusLevel\":{\"id\":\"uHvq4MBERPuVAk3luwphrg\",\"level\":\"Green\",\"deviceNetworkStatus\":{\"id\":\"WgEwwyksUIS2T5AFjKtGvg\",\"name\":\"Bluetooth\"}},\"deviceNetworkStatusRecord\":{\"id\":\"n5gtT-ORQImbp3dql_SlHw\",\"value\":0}},{\"id\":\"alN6SbtoTk-39N9H7IEzrg\",\"networkStatusLevel\":{\"id\":\"y0CHemAGROCpswd5vu7BGQ\",\"level\":\"Orange\",\"deviceNetworkStatus\":{\"id\":\"pwxiTO7iW0inGsISgmFxMQ\",\"name\":\"NFC\"}},\"deviceNetworkStatusRecord\":{\"id\":\"06Hv_Fw-TC-ZRGbkoIWSkg\",\"value\":0}},{\"id\":\"D0piRvT4QbutQljPMalXsQ\",\"networkStatusLevel\":{\"id\":\"GO7UOVytQX-78Tzk5IOvjg\",\"level\":\"Red\",\"deviceNetworkStatus\":{\"id\":\"fPrbn1lHXwuQAhrRgMvSTg\",\"name\":\"RogueCellTower\"}},\"deviceNetworkStatusRecord\":{\"id\":\"bAeDvPxoTJ-5hLGUKHgpWw\",\"value\":0}},{\"id\":\"DZi_-u7HRl-zN_jP-MAlSw\",\"networkStatusLevel\":{\"id\":\"myxc8oiYTAWZEEwHvwbIEQ\",\"level\":\"Orange\",\"deviceNetworkStatus\":{\"id\":\"5H_waBpbX6-W5Zg0SDQhIA\",\"name\":\"ConnectionToUntrustedHotspots\"}},\"deviceNetworkStatusRecord\":{\"id\":\"xev8ikm5SX-s4zNVzbd9Cw\",\"value\":0}},{\"id\":\"gkrrmUKsSeiEvqgUr5IfUg\",\"networkStatusLevel\":{\"id\":\"G-pFFmnsSWe-LXZEkSqhBA\",\"level\":\"Green\",\"deviceNetworkStatus\":{\"id\":\"YWXiVq4SUnimRuDEzzDb_w\",\"name\":\"RogueAccessPoint\"}},\"deviceNetworkStatusRecord\":{\"id\":\"naAO765rRtyHscwBD3RrZg\",\"value\":0}},{\"id\":\"kj2F5qhIQzGMdPerO-Y3Lw\",\"networkStatusLevel\":{\"id\":\"O43t_Zq2SkeM6TZiFmM8jQ\",\"level\":\"Red\",\"deviceNetworkStatus\":{\"id\":\"TSss4UX3XweuFnLLGSbR1w\",\"name\":\"ManInTheMiddle\"}},\"deviceNetworkStatusRecord\":{\"id\":\"6y2ToOEXQmCyI2kHhxd7Eg\",\"value\":0}},{\"id\":\"TSfDjjttS-GYG_NS4rSKPg\",\"networkStatusLevel\":{\"id\":\"i0GslqZcR4K3k6k1S6EWHQ\",\"level\":\"Green\",\"deviceNetworkStatus\":{\"id\":\"f4nzGKc5UF-0Ow_uz0_jHQ\",\"name\":\"GPS\"}},\"deviceNetworkStatusRecord\":{\"id\":\"YNJfP2b7QdW3ULYB_CbIGw\",\"value\":1}},{\"id\":\"zeCc8trcQciYY4rLZce54w\",\"networkStatusLevel\":{\"id\":\"13GU2c4vTxC2QylhQtWpPg\",\"level\":\"Orange\",\"deviceNetworkStatus\":{\"id\":\"WRrA_3G0WZOdV52312piYA\",\"name\":\"VPN\"}},\"deviceNetworkStatusRecord\":{\"id\":\"08ZvMtm5TNOHTTkXujWD2w\",\"value\":0}}],\"status\":\"done\"}}}",
"event": {
"action": "DeviceCorrelationUpdated",
"category": [
"process"
],
"type": [
"info"
]
},
"@timestamp": "2024-07-01T14:28:11Z",
"pradeo": {
"correlation": {
"applicationThreatLevel": "Red",
"matchedNetworkStatusLevels": [
{
"deviceNetworkStatusRecord": {
"id": "6EByUpV4R9qcggk9mQGylA",
"value": 3
},
"id": "6_WYPd5hRp2ZKteAx_KUhw",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "hbaZqAT-VSG-6BWCL2ec0w",
"name": "ARPPoisoning"
},
"id": "YgTHvrQqQUyIZTysaK_heQ",
"level": "Green"
}
},
{
"deviceNetworkStatusRecord": {
"id": "n5gtT-ORQImbp3dql_SlHw",
"value": 0
},
"id": "8-WULaesQQSEbVyYk7_WAQ",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "WgEwwyksUIS2T5AFjKtGvg",
"name": "Bluetooth"
},
"id": "uHvq4MBERPuVAk3luwphrg",
"level": "Green"
}
},
{
"deviceNetworkStatusRecord": {
"id": "06Hv_Fw-TC-ZRGbkoIWSkg",
"value": 0
},
"id": "alN6SbtoTk-39N9H7IEzrg",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "pwxiTO7iW0inGsISgmFxMQ",
"name": "NFC"
},
"id": "y0CHemAGROCpswd5vu7BGQ",
"level": "Orange"
}
},
{
"deviceNetworkStatusRecord": {
"id": "bAeDvPxoTJ-5hLGUKHgpWw",
"value": 0
},
"id": "D0piRvT4QbutQljPMalXsQ",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "fPrbn1lHXwuQAhrRgMvSTg",
"name": "RogueCellTower"
},
"id": "GO7UOVytQX-78Tzk5IOvjg",
"level": "Red"
}
},
{
"deviceNetworkStatusRecord": {
"id": "xev8ikm5SX-s4zNVzbd9Cw",
"value": 0
},
"id": "DZi_-u7HRl-zN_jP-MAlSw",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "5H_waBpbX6-W5Zg0SDQhIA",
"name": "ConnectionToUntrustedHotspots"
},
"id": "myxc8oiYTAWZEEwHvwbIEQ",
"level": "Orange"
}
},
{
"deviceNetworkStatusRecord": {
"id": "naAO765rRtyHscwBD3RrZg",
"value": 0
},
"id": "gkrrmUKsSeiEvqgUr5IfUg",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "YWXiVq4SUnimRuDEzzDb_w",
"name": "RogueAccessPoint"
},
"id": "G-pFFmnsSWe-LXZEkSqhBA",
"level": "Green"
}
},
{
"deviceNetworkStatusRecord": {
"id": "6y2ToOEXQmCyI2kHhxd7Eg",
"value": 0
},
"id": "kj2F5qhIQzGMdPerO-Y3Lw",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "TSss4UX3XweuFnLLGSbR1w",
"name": "ManInTheMiddle"
},
"id": "O43t_Zq2SkeM6TZiFmM8jQ",
"level": "Red"
}
},
{
"deviceNetworkStatusRecord": {
"id": "YNJfP2b7QdW3ULYB_CbIGw",
"value": 1
},
"id": "TSfDjjttS-GYG_NS4rSKPg",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "f4nzGKc5UF-0Ow_uz0_jHQ",
"name": "GPS"
},
"id": "i0GslqZcR4K3k6k1S6EWHQ",
"level": "Green"
}
},
{
"deviceNetworkStatusRecord": {
"id": "08ZvMtm5TNOHTTkXujWD2w",
"value": 0
},
"id": "zeCc8trcQciYY4rLZce54w",
"networkStatusLevel": {
"deviceNetworkStatus": {
"id": "WRrA_3G0WZOdV52312piYA",
"name": "VPN"
},
"id": "13GU2c4vTxC2QylhQtWpPg",
"level": "Orange"
}
}
],
"matchedSystemStatusLevels": [
{
"deviceSystemStatusRecord": {
"id": "57jwjBD9SLCnfh5bSWmzSA",
"value": 0
},
"id": "-Beyvn0rTOmgqC1rs3XaEw",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "92Xbb2HhW02s85yh33nHfg",
"name": "SystemNotUpToDate"
},
"id": "oYdBmpvDT0aUz1dCzRGYDw",
"level": "Orange"
}
},
{
"deviceSystemStatusRecord": {
"id": "zrUxC90pTFOdDtfWlq_Mow",
"value": 1
},
"id": "1YiiEuuATR2rB7nKinFU5g",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "EmL050CAW-65ogu3GRSAsg",
"name": "ApplicationInstalledFromUnknownSource"
},
"id": "SX5zOVZoTWOn7oRTv8cNdw",
"level": "Orange"
}
},
{
"deviceSystemStatusRecord": {
"id": "_qLcu7a_TTatBWvbWRy8cA",
"value": 3
},
"id": "5vljuTwJQhSFWGOD3EF-aQ",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "s6wK_SInU42K_g2bGsPbhg",
"name": "SELinuxPermissive"
},
"id": "_ukzZc57QouY7kudIIrEsw",
"level": "Orange"
}
},
{
"deviceSystemStatusRecord": {
"id": "QMyc35a8TI27t5SFtvs_0A",
"value": 1
},
"id": "6HGN94xFQPm6f6UXr5jPdw",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "FjkqaultWs-HBFWzHq3C8Q",
"name": "AccessibilityOption"
},
"id": "gSIPIL0kSk62XlQuoelXDQ",
"level": "Green"
}
},
{
"deviceSystemStatusRecord": {
"id": "5ft9cwvGTI-Cnee1u-F9Aw",
"value": 0
},
"id": "bH-NDdsATluwj6VZn-ZBzA",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "iEqcWkTpW8yARFKCv8MBYQ",
"name": "CustomHosts"
},
"id": "Nbnd9EGxQMuqkF0KXysA4A",
"level": "Red"
}
},
{
"deviceSystemStatusRecord": {
"id": "aZUmMZ3cTNG3RfYhjpd8tQ",
"value": 1
},
"id": "d9CKeAvCT9Sb3vP06MOq4Q",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "sMLlZzy8WFKDp8xev58LpA",
"name": "DebugMode"
},
"id": "jWr0_EQpSj2z_JrkD2WOyQ",
"level": "Red"
}
},
{
"deviceSystemStatusRecord": {
"id": "yyQGNf7sT_KVRGUFdtnygw",
"value": 0
},
"id": "juI58xKrSrK16Rk787RsnA",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "UzAgUIoDXLioT8Xca4q9UA",
"name": "DeviceNotEncrypted"
},
"id": "hgwHAMvZTImT151inM8vYg",
"level": "Red"
}
},
{
"deviceSystemStatusRecord": {
"id": "-drVU9tpS1qugsU-1d0EDA",
"value": 1
},
"id": "VnfcT_lgRHurAfaGjym-rA",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "AV84fYHQXbyKjXZ52iuHLg",
"name": "DeveloperMode"
},
"id": "lB0d6wk8TJWpmJ-96Fi02Q",
"level": "Orange"
}
},
{
"deviceSystemStatusRecord": {
"id": "mM3q-uXmR1-TJflwC-C72w",
"value": 0
},
"id": "w0rOFu5STim869zy6aHs3w",
"systemStatusLevel": {
"deviceSystemStatus": {
"id": "cAwR35npXkmkg7IF3KnCgg",
"name": "Root"
},
"id": "oRJbjuE2Sl2P8exMrFQTHw",
"level": "Red"
}
}
],
"networkThreatLevel": "Green",
"systemThreatLevel": "Red"
},
"device": {
"byod": false,
"coupled": true,
"declaredModel": "SM-A536B",
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2023-08-01T00:00:00Z",
"declaredOperatingSystemVersion": "13",
"email": "test@pradeo.dev",
"emm": "unknown",
"id": "iowEjn9PR2WlrIIBR2_FPQ",
"imei": "xxxxx",
"lastConnection": "2024-07-05T14:58:48Z",
"mdmId": "xxxxx",
"name": "Test device",
"serialNumber": "unknown"
},
"metadata": {
"category": "null",
"creationDate": "2024-07-01T14:28:11Z",
"id": "QFtxnwWFCERsCvYI599bSv",
"source": "system",
"type": "DeviceCorrelationUpdated"
},
"policy": {
"id": "JIiW6eyUWoe9COTVCR4rww",
"name": "Standard"
}
}
}
{
"message": "{\"id\":\"QFtxnwWFCERsCvYI599bSv\",\"creationDate\":\"2024-07-01T14:28:11.000Z\",\"source\":\"admin\",\"category\":\"Network\",\"type\":\"DeviceDetection\",\"content\":{\"id\":\"android:p-2MTZU_S1jQsqz9Ommy_A\",\"last_name\":\"m\",\"first_name\":\"m\",\"email\":\"\",\"metric\":\"match_bluetooth\",\"type\":\"BlueTooth activation\",\"status\":\"END\"}}",
"event": {
"action": "DeviceDetection",
"category": [
"process"
],
"type": [
"info"
]
},
"@timestamp": "2024-07-01T14:28:11Z",
"pradeo": {
"detection": {
"status": "match_bluetooth",
"value": "END"
},
"device": {
"id": "android:p-2MTZU_S1jQsqz9Ommy_A"
},
"metadata": {
"category": "Network",
"creationDate": "2024-07-01T14:28:11Z",
"id": "QFtxnwWFCERsCvYI599bSv",
"source": "admin",
"type": "DeviceDetection"
}
}
}
{
"message": "{\"id\":\"---tmfIPM0q8uo0bGtreRA\",\"creationDate\":\"2024-07-05T08:58:43.325Z\",\"source\":\"device\",\"category\":null,\"type\":\"DeviceStatusHistoryUpdated\",\"content\":{\"deviceId\":\"3DGAsW2pRhKZLArNUGBo4Q\",\"event\":{\"kind\":\"RogueCellTower\",\"value\":2}},\"user\":null,\"device\":{\"id\":\"3DGAsW2pRhKZLArNUGBo4Q\",\"serialNumber\":\"unknown\",\"imei\":null,\"name\":null,\"email\":null,\"singleEnrollmentKey\":\"{sa?LW]p:gWoGR}),ishy@)7XPoMI-)LH&n)g5v{aY{Wqi4b\",\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":\"Android\",\"declaredOperatingSystemVersion\":\"13\",\"declaredOperatingSystemSecurityPatchDate\":\"2023-11-05T00:00:00.000Z\",\"declaredModel\":\"EB2103\",\"enrollmentStatus\":{\"id\":\"etw6fGIcQtyKQDB3hbpXUQ\",\"lastConnection\":\"2024-07-05T13:05:05.000Z\",\"coupled\":false},\"emmDeviceInfo\":null},\"company\":{\"id\":\"bufQJXK_RNamdgiPmXzpFg\",\"name\":\"Mobile boat\",\"creationDate\":\"2024-07-03T10:01:02.043Z\",\"lastModificationDate\":\"2024-07-04T07:19:50.000Z\",\"deletedAt\":null}}",
"event": {
"action": "DeviceStatusHistoryUpdated",
"category": [
"process"
],
"type": [
"info"
]
},
"@timestamp": "2024-07-05T08:58:43.325000Z",
"pradeo": {
"detection": {
"status": "RogueCellTower",
"value": 2
},
"device": {
"id": "3DGAsW2pRhKZLArNUGBo4Q"
},
"initiator": {
"byod": false,
"coupled": false,
"declaredModel": "EB2103",
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2023-11-05T00:00:00.000Z",
"declaredOperatingSystemVersion": "13",
"id": "3DGAsW2pRhKZLArNUGBo4Q",
"lastConnection": "2024-07-05T13:05:05Z",
"serialNumber": "unknown"
},
"metadata": {
"creationDate": "2024-07-05T08:58:43.325000Z",
"id": "---tmfIPM0q8uo0bGtreRA",
"source": "device",
"type": "DeviceStatusHistoryUpdated"
}
}
}
{
"message": "{\"id\":\"SQU4ZdbZSxqEIi1ioYP6mw\",\"creationDate\":\"2024-07-01T14:28:20.233Z\",\"source\":\"system\",\"category\":null,\"type\":\"DeviceNetworkStatusRecordUpdated\",\"content\":{\"deviceNetworkStatusRecord\":{\"id\":\"7tUjB6riQGqo2Tqz4AmVPw\",\"device\":{\"id\":\"R96VSXfLT4i1UDNKioactw\",\"serialNumber\":\"unknown\",\"imei\":null,\"name\":\"m m\",\"email\":null,\"singleEnrollmentKey\":null,\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":null,\"declaredOperatingSystemVersion\":null,\"declaredOperatingSystemSecurityPatchDate\":null,\"declaredModel\":null,\"company\":{\"id\":\"JmidYbyCRpegHOjnpK4uag\",\"name\":\"Pradeo\",\"creationDate\":\"2023-09-11T13:15:14.000Z\",\"lastModificationDate\":\"2024-04-19T10:03:30.000Z\",\"deletedAt\":null},\"enrollmentStatus\":{\"id\":\"2GxYOm6GR8qXdDRMrCjJwQ\",\"lastConnection\":\"2024-07-01T09:54:07.000Z\",\"coupled\":true},\"emmDeviceInfo\":null,\"configuration\":{\"id\":\"XXWAKzLmTIydNDbSbpLuWw\",\"advancedMode\":false,\"notificationPermission\":\"Undefined\",\"geolocationPermission\":\"Undefined\",\"callPermission\":\"Undefined\",\"knoxPermission\":\"Undefined\",\"vpnPermission\":\"Undefined\",\"bluetoothPermission\":\"Undefined\",\"deviceAdminPermission\":\"Undefined\",\"overlayPermission\":\"Undefined\",\"usageStatisticsPermission\":\"Undefined\",\"accessibilityPermission\":\"Undefined\",\"ignoreBatteryOptimizationPermission\":\"Undefined\"}},\"deviceNetworkStatus\":{\"id\":\"WgEwwyksUIS2T5AFjKtGvg\",\"name\":\"Bluetooth\"},\"value\":0}}}",
"event": {
"action": "DeviceNetworkStatusRecordUpdated",
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2024-07-01T14:28:20.233000Z",
"pradeo": {
"detection": {
"status": "Bluetooth",
"value": 0
},
"device": {
"byod": false,
"coupled": true,
"id": "R96VSXfLT4i1UDNKioactw",
"lastConnection": "2024-07-01T09:54:07Z",
"name": "m m",
"serialNumber": "unknown"
},
"metadata": {
"creationDate": "2024-07-01T14:28:20.233000Z",
"id": "SQU4ZdbZSxqEIi1ioYP6mw",
"source": "system",
"type": "DeviceNetworkStatusRecordUpdated"
}
}
}
{
"message": "{\"id\":\"Chp2bFsQTEGAJd67m_Na2w\",\"creationDate\":\"2024-07-01T14:28:20.139Z\",\"source\":\"system\",\"category\":null,\"type\":\"DeviceStatusHistoryUpdated\",\"content\":{\"deviceId\":\"R96VSXfLT4i1UDNKioactw\",\"event\":{\"id\":\"Aw9PSSUpT0idoAdhaiACbg\",\"device\":{\"id\":\"R96VSXfLT4i1UDNKioactw\",\"serialNumber\":\"unknown\",\"imei\":null,\"name\":\"m m\",\"email\":null,\"singleEnrollmentKey\":null,\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":null,\"declaredOperatingSystemVersion\":null,\"declaredOperatingSystemSecurityPatchDate\":null,\"declaredModel\":null,\"company\":{\"id\":\"JmidYbyCRpegHOjnpK4uag\",\"name\":\"Pradeo\",\"creationDate\":\"2023-09-11T13:15:14.000Z\",\"lastModificationDate\":\"2024-04-19T10:03:30.000Z\",\"deletedAt\":null},\"enrollmentStatus\":{\"id\":\"2GxYOm6GR8qXdDRMrCjJwQ\",\"lastConnection\":\"2024-07-01T09:54:07.000Z\",\"coupled\":true},\"emmDeviceInfo\":null},\"kind\":\"Bluetooth\",\"value\":0,\"eventDate\":\"2024-07-01T14:28:20.124Z\"}}}",
"event": {
"action": "DeviceStatusHistoryUpdated",
"category": [
"process"
],
"type": [
"info"
]
},
"@timestamp": "2024-07-01T14:28:20.139000Z",
"pradeo": {
"detection": {
"status": "Bluetooth",
"value": 0
},
"device": {
"id": "R96VSXfLT4i1UDNKioactw"
},
"metadata": {
"creationDate": "2024-07-01T14:28:20.139000Z",
"id": "Chp2bFsQTEGAJd67m_Na2w",
"source": "system",
"type": "DeviceStatusHistoryUpdated"
}
}
}
{
"message": "{\"id\":\"hWjVNq-WRiefU1vqfrbeyQ\",\"creationDate\":\"2024-06-27T11:24:13.592Z\",\"source\":\"system\",\"category\":null,\"type\":\"DeviceSystemStatusRecordUpdated\",\"content\":{\"deviceSystemStatusRecord\":{\"id\":\"2jA8-gQ6TCuGIgR9EMcbYQ\",\"device\":{\"id\":\"EeFFJKtPS0Gl52z5uzijKg\",\"serialNumber\":null,\"imei\":null,\"name\":\" cs Ivanti EID2\",\"email\":null,\"singleEnrollmentKey\":null,\"byod\":true,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":null,\"declaredOperatingSystemVersion\":null,\"declaredOperatingSystemSecurityPatchDate\":null,\"declaredModel\":null,\"company\":{\"id\":\"JmidYbyCRpegHOjnpK4uag\",\"name\":\"Pradeo\",\"creationDate\":\"2023-09-11T13:15:14.000Z\",\"lastModificationDate\":\"2024-04-19T10:03:30.000Z\",\"deletedAt\":null},\"enrollmentStatus\":{\"id\":\"ZWxQtoMWTKegjcvMinHaZg\",\"lastConnection\":\"2024-06-21T12:07:57.000Z\",\"coupled\":true},\"emmDeviceInfo\":null,\"configuration\":{\"id\":\"4oQgfWybS46D2huT1ggWLA\",\"advancedMode\":false,\"notificationPermission\":\"Undefined\",\"geolocationPermission\":\"Undefined\",\"callPermission\":\"Undefined\",\"knoxPermission\":\"Undefined\",\"vpnPermission\":\"Undefined\",\"bluetoothPermission\":\"Undefined\",\"deviceAdminPermission\":\"Undefined\",\"overlayPermission\":\"Undefined\",\"usageStatisticsPermission\":\"Undefined\",\"accessibilityPermission\":\"Undefined\",\"ignoreBatteryOptimizationPermission\":\"Undefined\"}},\"deviceSystemStatus\":{\"id\":\"AV84fYHQXbyKjXZ52iuHLg\",\"name\":\"DeveloperMode\"},\"value\":1}}}",
"event": {
"action": "DeviceSystemStatusRecordUpdated",
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2024-06-27T11:24:13.592000Z",
"pradeo": {
"detection": {
"status": "DeveloperMode",
"value": 1
},
"device": {
"byod": true,
"coupled": true,
"id": "EeFFJKtPS0Gl52z5uzijKg",
"lastConnection": "2024-06-21T12:07:57Z",
"name": " cs Ivanti EID2"
},
"metadata": {
"creationDate": "2024-06-27T11:24:13.592000Z",
"id": "hWjVNq-WRiefU1vqfrbeyQ",
"source": "system",
"type": "DeviceSystemStatusRecordUpdated"
}
}
}
{
"message": "{\"id\":\"1111111111111111111111\",\"device\":{\"id\":\"2222222222222222222222\",\"serialNumber\":null,\"imei\":null,\"name\":\"DOE John\",\"email\":\"john.doe@company.fr\",\"singleEnrollmentKey\":null,\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":\"Android\",\"declaredOperatingSystemVersion\":\"16\",\"declaredOperatingSystemSecurityPatchDate\":\"2025-09-01T00:00:00.000Z\",\"declaredModel\":null,\"company\":{\"id\":\"3333333333333333333333\",\"name\":\"Company Name\",\"creationDate\":\"2024-05-15T09:36:12.260Z\",\"lastModificationDate\":\"2024-12-06T13:45:54.000Z\",\"deletedAt\":null,\"assignedCommercialLicense\":{\"id\":\"4444444444444444444444\",\"name\":\"Company Name Commercial Licence\",\"kind\":\"Classic\",\"features\":[\"mast\",\"mtd\",\"threatIntelligence\"],\"enrollmentsLimit\":900,\"trial\":false,\"creationDate\":\"2024-06-28T09:24:04.571Z\",\"lastModificationDate\":\"2026-06-17T09:05:33.000Z\",\"expirationDate\":\"2027-04-30T22:00:00.000Z\"}},\"operatingSystem\":{\"id\":\"5555555555555555555555\",\"name\":\"Android\",\"version\":\"15\",\"developedBy\":\"google\",\"product\":\"Android15\",\"releaseDate\":\"2024-09-03T00:00:00.000Z\",\"softwareBuildNumber\":\"35\",\"securityPatchDate\":\"1970-01-01T00:00:00.000Z\"},\"enrollmentStatus\":{\"id\":\"6666666666666666666666\",\"lastConnection\":null,\"coupled\":false,\"versionCode\":null},\"emmDeviceInfo\":{\"id\":\"7777777777777777777777\",\"externalId\":\"aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa\",\"integration\":{\"id\":\"8888888888888888888888\",\"emm\":\"intune\",\"name\":null,\"creationDate\":\"2024-10-16T09:29:00.714Z\",\"lastModificationDate\":\"2025-08-12T09:40:20.000Z\",\"active\":true,\"jobs\":\"cleanGroups,updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices\",\"settings\":null,\"options\":{\"testDevices\":[],\"synchronizableGroupMarks\":[\"[SYNC_GRP_PRADEO]\"],\"deviceHealth\":{\"synchronizableGroupRules\":[{\"global\":true,\"manage\":true,\"basedOn\":[\"eachStatus\"]}]},\"managementGroups\":{\"applyTo\":{\"user\":true,\"device\":true},\"synchronizableGroupRules\":[{\"global\":true,\"managementGroups\":[]}]}}},\"metadata\":{\"deviceOwnershipCriteria\":\"managedDeviceOwnerType = company\"},\"lastSynchronizationDate\":\"2026-07-08T09:30:24.000Z\"},\"commercialLicense\":{\"id\":\"4444444444444444444444\",\"name\":\"Company Name Commercial Licence\",\"kind\":\"Classic\",\"features\":[\"mast\",\"mtd\",\"threatIntelligence\"],\"enrollmentsLimit\":900,\"trial\":false,\"creationDate\":\"2024-06-28T09:24:04.571Z\",\"lastModificationDate\":\"2026-06-17T09:05:33.000Z\",\"expirationDate\":\"2027-04-30T22:00:00.000Z\"}}}",
"event": {
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2026-07-08T09:30:24Z",
"host": {
"os": {
"name": "Android15",
"type": "android",
"version": "15"
}
},
"pradeo": {
"device": {
"byod": false,
"coupled": false,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2025-09-01T00:00:00Z",
"declaredOperatingSystemVersion": "16",
"email": "john.doe@company.fr",
"emm": "intune",
"id": "2222222222222222222222",
"is_active": true,
"jobs": [
"cleanDevices",
"cleanGroups",
"updateApplications",
"updateDeviceHealth",
"updateDevices",
"updateGroups"
],
"mdmId": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa",
"name": "DOE John"
},
"metadata": {
"creationDate": "2024-10-16T09:29:00.714000Z",
"id": "1111111111111111111111"
}
},
"user": {
"email": "john.doe@company.fr"
}
}
{
"message": "{\"id\":\"aaaaaaaaaaaaaaaaaaaaaa\",\"device\":{\"id\":\"bbbbbbbbbbbbbbbbbbbbbb\",\"serialNumber\":null,\"imei\":null,\"name\":\"DOE (950345) samsung SM-12345 Android 14.0 LZHB\",\"email\":\"John.DOE@domain.eu\",\"singleEnrollmentKey\":null,\"byod\":false,\"lockPassword\":null,\"knoxVersion\":null,\"declaredOperatingSystem\":\"Android\",\"declaredOperatingSystemVersion\":\"14.0.0\",\"declaredOperatingSystemSecurityPatchDate\":\"2026-05-05T00:00:00.000\",\"declaredModel\":null,\"company\":{\"id\":\"company_id\",\"name\":\"Company name\",\"creationDate\":\"2024-10-14T14:00:32.750Z\",\"lastModificationDate\":\"2024-11-27T08:50:18.000Z\",\"deletedAt\":null,\"assignedCommercialLicense\":{\"id\":\"cccccccccccccccccccccc\",\"name\":\"Company name\",\"kind\":\"Classic\",\"features\":[\"mast\",\"mtd\",\"threatIntelligence\"],\"enrollmentsLimit\":4000,\"trial\":false,\"creationDate\":\"2024-11-27T08:50:18.324Z\",\"lastModificationDate\":\"2026-06-17T09:05:36.000Z\",\"expirationDate\":\"2027-12-31T22:59:59.000Z\"}},\"operatingSystem\":{\"id\":\"dddddddddddddddddddddd\",\"name\":\"Android\",\"version\":\"14.0.0\",\"developedBy\":\"google\",\"product\":\"\",\"releaseDate\":null,\"softwareBuildNumber\":null,\"securityPatchDate\":null},\"enrollmentStatus\":{\"id\":\"eeeeeeeeeeeeeeeeeeeeee\",\"lastConnection\":null,\"coupled\":false,\"versionCode\":null},\"emmDeviceInfo\":{\"id\":\"ffffffffffffffffffffff\",\"externalId\":\"11111111111111111111111111111111111111111\",\"integration\":{\"id\":\"gggggggggggggggggggggg\",\"emm\":\"airwatch\",\"name\":null,\"creationDate\":\"2024-10-28T14:29:15.060Z\",\"lastModificationDate\":\"2025-11-19T09:33:09.000Z\",\"active\":true,\"jobs\":\"updateGroups,cleanGroups,updateTags,updateDevices,cleanDevices,updateApplications\",\"settings\":null,\"options\":{\"purge\":{\"onlyEnrolledOnPradeo\":{\"delete\":null,\"unenroll\":null},\"unEnrolled\":{\"delete\":1,\"unenroll\":null},\"deviceWipePending\":{\"delete\":1,\"unenroll\":null},\"enterpriseWipePending\":{\"delete\":1,\"unenroll\":null}},\"timeBetweenPradeoAndAirwatchLastConnections\":48,\"denyLists\":{\"android\":{\"airwatchAppGroupId\":null,\"appGroupDescription\":\"Risk Management policy for apps with malicious behaviors.\",\"appGroupName\":\"Pradeo SOCSI Blacklist Apps ANDROID\"},\"ios\":{\"airwatchAppGroupId\":null,\"appGroupDescription\":\"Risk Management policy for apps with malicious behaviors.\",\"appGroupName\":\"Pradeo SOCSI Blacklist Apps IOS\"},\"policy\":null},\"organizationGroupIdList\":[570,574,575,576,577,578,582,583,621,622,623,624,627,652,681,683,689,636,644,645,651,687,638,648,649,653,659,677,686,657,658,660,661,663,664,666,668,671,672,674,678,676,679,680,682,685,690,691,646,654,688,694,695,696,697],\"organizationGroupIdListBehavior\":\"including\",\"tags\":[{\"global\":true,\"tags\":[\"MK93Ny35VUy8BIHO-wDFaA\",\"NXf8WWZTWCSwYl3LNtf5EQ\",\"2so1P8_sX5KqAovl0Yn65w\",\"UpDJ-nSTWD6ehbnuomNOwg\",\"QLXVzz20U9KXu4NZxYxTaA\",\"0Pcfqh2PUme9CyugFJdkeA\",\"7MZTXCptVYCGYnU-iWyHUg\",\"QokCjWrgTE6aStvRDmdHkg\",\"ePefaMWsQMaEr_R9eUHFUg\",\"SfgdfJUCRSajQkyqhjB-4w\",\"Tmj6YlQMQSGCrOFxUvp45w\"]}],\"testDevices\":[],\"synchronizeDenyLists\":true,\"fieldsMap\":{\"USER_EMAIL\":\"UserEmailAddress\",\"user_name\":\"DeviceFriendlyName\"}}},\"metadata\":{\"uuid\":\"11111111-1111-1111-1111-111111111111\",\"secured\":true,\"enrollmentStatus\":\"Enrolled\",\"deviceOwnershipCriteria\":\"Ownership = C\"},\"lastSynchronizationDate\":\"2026-07-08T09:30:15.000Z\"},\"commercialLicense\":{\"id\":\"cccccccccccccccccccccc\",\"name\":\"Company name\",\"kind\":\"Classic\",\"features\":[\"mast\",\"mtd\",\"threatIntelligence\"],\"enrollmentsLimit\":4000,\"trial\":false,\"creationDate\":\"2024-11-27T08:50:18.324Z\",\"lastModificationDate\":\"2026-06-17T09:05:36.000Z\",\"expirationDate\":\"2027-12-31T22:59:59.000Z\"}}}",
"event": {
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2026-07-08T09:30:15Z",
"host": {
"os": {
"type": "android",
"version": "14.0.0"
}
},
"pradeo": {
"device": {
"byod": false,
"coupled": false,
"declaredOperatingSystem": "Android",
"declaredOperatingSystemSecurityPatchDate": "2026-05-05T00:00:00Z",
"declaredOperatingSystemVersion": "14.0.0",
"email": "John.DOE@domain.eu",
"emm": "airwatch",
"id": "bbbbbbbbbbbbbbbbbbbbbb",
"is_active": true,
"jobs": [
"cleanDevices",
"cleanGroups",
"updateApplications",
"updateDevices",
"updateGroups",
"updateTags"
],
"mdmId": "11111111111111111111111111111111111111111",
"name": "DOE (950345) samsung SM-12345 Android 14.0 LZHB"
},
"metadata": {
"creationDate": "2024-10-28T14:29:15.060000Z",
"id": "aaaaaaaaaaaaaaaaaaaaaa"
}
},
"user": {
"email": "John.DOE@domain.eu"
}
}
{
"message": "{\n \"id\": \"00000000-0000-0000-0000-000000000000\",\n \"deviceCorrelation\": {\n \"id\": \"11111111-1111-1111-1111-111111111111\",\n \"creationDate\": \"2026-03-30T08:30:17.351Z\",\n \"lastModificationDate\": \"2026-04-16T16:34:52.000Z\",\n \"device\": {\n \"id\": \"22222222-2222-2222-2222-222222222222\",\n \"serialNumber\": null,\n \"imei\": null,\n \"name\": \"John Doe\",\n \"email\": \"j.doe@example.com\",\n \"byod\": true,\n \"lockPassword\": null,\n \"knoxVersion\": null,\n \"declaredOperatingSystem\": \"iOS\",\n \"declaredOperatingSystemVersion\": \"26.5\",\n \"declaredOperatingSystemSecurityPatchDate\": \"1970-01-01T00:00:00.000Z\",\n \"declaredModel\": \"iPhone17,1\",\n \"enrollmentStatus\": {\n \"id\": \"33333333-3333-3333-3333-333333333333\",\n \"lastConnection\": \"2026-03-30T08:37:34.000Z\",\n \"coupled\": true,\n \"versionCode\": null\n },\n \"emmDeviceInfo\": {\n \"id\": \"44444444-4444-4444-4444-444444444444\",\n \"externalId\": \"55555555-5555-5555-5555-555555555555\",\n \"integration\": {\n \"id\": \"66666666-6666-6666-6666-666666666666\",\n \"emm\": \"intune\",\n \"name\": null,\n \"creationDate\": \"2025-02-10T16:16:26.783Z\",\n \"lastModificationDate\": \"2025-07-28T17:09:46.000Z\",\n \"active\": true,\n \"jobs\": \"updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices\",\n \"settings\": null,\n \"options\": {\n \"testDevices\": [],\n \"synchronizableGroupMarks\": [\n \"[SYNC_GRP_PRADEO]\"\n ],\n \"deviceHealth\": {\n \"synchronizableGroupRules\": [\n {\n \"global\": true,\n \"manage\": true,\n \"basedOn\": [\n \"eachStatus\"\n ]\n },\n {\n \"global\": false,\n \"id\": \"77777777-7777-7777-7777-777777777777\",\n \"basedOn\": [\n \"globalDeviceStatus\"\n ],\n \"manage\": true\n },\n {\n \"global\": false,\n \"id\": \"88888888-8888-8888-8888-888888888888\",\n \"basedOn\": [\n \"globalDeviceStatus\",\n \"pradeoEnrollment\"\n ],\n \"manage\": true\n }\n ]\n },\n \"managementGroups\": {\n \"applyTo\": {\n \"user\": true,\n \"device\": true\n },\n \"synchronizableGroupRules\": [\n {\n \"global\": true,\n \"managementGroups\": []\n }\n ]\n }\n }\n },\n \"metadata\": {\n \"deviceOwnershipCriteria\": \"managedDeviceOwnerType = personal\",\n \"lastDeviceStateSent\": \"3\"\n },\n \"lastSynchronizationDate\": \"2026-07-16T08:00:17.000Z\"\n }\n },\n \"detectionPolicy\": {\n \"id\": \"99999999-9999-9999-9999-999999999999\",\n \"name\": \"Flexible\",\n \"type\": \"Application and device threat\",\n \"creationDate\": \"2023-12-04T17:53:57.000Z\",\n \"lastModificationDate\": \"2025-12-09T09:30:18.000Z\",\n \"inheritable\": true,\n \"version\": 4,\n \"antivirusScanThreshold\": 2,\n \"malwarePredictionStatusLevel\": \"Orange\"\n },\n \"applicationThreatLevel\": \"Orange\",\n \"systemThreatLevel\": \"NotYetAvailable\",\n \"networkThreatLevel\": \"NotYetAvailable\",\n \"matchedSystemStatusLevels\": [],\n \"matchedNetworkStatusLevels\": [],\n \"status\": \"done\"\n }\n}",
"event": {
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2026-07-16T08:00:17Z",
"pradeo": {
"correlation": {
"applicationThreatLevel": "Orange",
"matchedNetworkStatusLevels": [],
"matchedSystemStatusLevels": [],
"networkThreatLevel": "NotYetAvailable",
"systemThreatLevel": "NotYetAvailable"
},
"device": {
"byod": true,
"coupled": true,
"declaredModel": "iPhone17,1",
"declaredOperatingSystem": "iOS",
"declaredOperatingSystemSecurityPatchDate": "1970-01-01T00:00:00Z",
"declaredOperatingSystemVersion": "26.5",
"email": "j.doe@example.com",
"emm": "intune",
"id": "22222222-2222-2222-2222-222222222222",
"is_active": true,
"jobs": [
"cleanDevices",
"updateApplications",
"updateDeviceHealth",
"updateDevices",
"updateGroups"
],
"lastConnection": "2026-03-30T08:37:34Z",
"mdmId": "55555555-5555-5555-5555-555555555555",
"name": "John Doe"
},
"metadata": {
"creationDate": "2026-03-30T08:30:17.351000Z",
"id": "00000000-0000-0000-0000-000000000000"
},
"policy": {
"id": "99999999-9999-9999-9999-999999999999",
"name": "Flexible"
}
},
"rule": {
"category": "Application and device threat",
"version": "4"
},
"user": {
"email": "j.doe@example.com"
}
}
{
"message": "{\n \"id\": \"00000000-0000-0000-0000-000000000000\",\n \"emmApplication\": {\n \"id\": \"11111111-1111-1111-1111-111111111111\",\n \"integration\": {\n \"id\": \"22222222-2222-2222-2222-222222222222\",\n \"company\": {\n \"id\": \"33333333-3333-3333-3333-333333333333\",\n \"name\": \"LookUpSpace\",\n \"creationDate\": \"2025-02-04T08:49:17.170Z\",\n \"lastModificationDate\": \"2025-03-14T10:16:55.000Z\",\n \"deletedAt\": null\n },\n \"emm\": \"intune\",\n \"name\": null,\n \"creationDate\": \"2025-02-10T16:16:26.783Z\",\n \"lastModificationDate\": \"2025-07-28T17:09:46.000Z\",\n \"active\": true,\n \"jobs\": \"updateGroups,updateDevices,updateApplications,updateDeviceHealth,cleanDevices\",\n \"settings\": null,\n \"options\": {\n \"testDevices\": [],\n \"synchronizableGroupMarks\": [\n \"[SYNC_GRP_PRADEO]\"\n ],\n \"deviceHealth\": {\n \"synchronizableGroupRules\": [\n {\n \"global\": true,\n \"manage\": true,\n \"basedOn\": [\n \"eachStatus\"\n ]\n },\n {\n \"global\": false,\n \"id\": \"44444444-4444-4444-4444-444444444444\",\n \"basedOn\": [\n \"globalDeviceStatus\"\n ],\n \"manage\": true\n },\n {\n \"global\": false,\n \"id\": \"55555555-5555-5555-5555-555555555555\",\n \"basedOn\": [\n \"globalDeviceStatus\",\n \"pradeoEnrollment\"\n ],\n \"manage\": true\n }\n ]\n },\n \"managementGroups\": {\n \"applyTo\": {\n \"user\": true,\n \"device\": true\n },\n \"synchronizableGroupRules\": [\n {\n \"global\": true,\n \"managementGroups\": []\n }\n ]\n }\n }\n },\n \"name\": \"Etsy\",\n \"package\": \"com.etsy.etsyforios\",\n \"system\": \"iOS\",\n \"versionCode\": null,\n \"version\": \"7.85\",\n \"size\": null,\n \"application\": {\n \"id\": \"66666666-6666-6666-6666-666666666666\",\n \"package\": {\n \"id\": \"77777777-7777-7777-7777-777777777777\",\n \"package\": \"com.etsy.etsyforios\",\n \"system\": \"iOS\"\n },\n \"version\": \"7.85\",\n \"md5\": null,\n \"sha1\": null,\n \"sha256\": null,\n \"name\": \"Etsy\",\n \"versionCode\": null,\n \"size\": null,\n \"owners\": [\n {\n \"id\": \"88888888-8888-8888-8888-888888888888\",\n \"name\": \"LookUpSpace\",\n \"creationDate\": \"2025-02-04T08:49:17.170Z\",\n \"lastModificationDate\": \"2025-03-14T10:16:55.000Z\",\n \"deletedAt\": null\n }\n ]\n },\n \"matchKind\": \"matchPackageAndVersion\"\n }\n}",
"event": {
"category": [
"process"
],
"type": [
"info"
]
},
"@timestamp": "2025-07-28T17:09:46Z",
"pradeo": {
"application": {
"id": "11111111-1111-1111-1111-111111111111",
"name": "Etsy",
"package": "com.etsy.etsyforios",
"system": "iOS",
"version": "7.85"
},
"device": {
"emm": "intune",
"is_active": true,
"jobs": [
"cleanDevices",
"updateApplications",
"updateDeviceHealth",
"updateDevices",
"updateGroups"
]
},
"metadata": {
"creationDate": "2025-02-10T16:16:26.783000Z",
"id": "00000000-0000-0000-0000-000000000000"
}
}
}
{
"message": "{\n \"id\": \"00000000-0000-0000-0000-000000000000\",\n \"deviceApplicationCompliance\": {\n \"id\": \"11111111-1111-1111-1111-111111111111\",\n \"status\": \"Approved\",\n \"computed\": true,\n \"creationDate\": \"2026-07-16T08:00:31.465Z\",\n \"lastModificationDate\": \"2026-07-16T08:00:32.000Z\",\n \"deviceApplication\": {\n \"id\": \"22222222-2222-2222-2222-222222222222\",\n \"application\": {\n \"id\": \"33333333-3333-3333-3333-333333333333\",\n \"package\": {\n \"id\": \"44444444-4444-4444-4444-444444444444\",\n \"package\": \"com.example.application\",\n \"system\": \"iOS\"\n },\n \"version\": \"3.47.0\",\n \"md5\": null,\n \"sha1\": null,\n \"sha256\": null,\n \"name\": \"Example\",\n \"versionCode\": null,\n \"size\": null\n },\n \"device\": {\n \"id\": \"55555555-5555-5555-5555-555555555555\",\n \"serialNumber\": null,\n \"imei\": \"357473867852731\",\n \"name\": \"John Doe\",\n \"email\": \"j.doe@example.com\",\n \"byod\": false,\n \"lockPassword\": null,\n \"knoxVersion\": null,\n \"declaredOperatingSystem\": \"iOS\",\n \"declaredOperatingSystemVersion\": \"26.5.2\",\n \"declaredOperatingSystemSecurityPatchDate\": \"1970-01-01T00:00:00.000Z\",\n \"declaredModel\": \"iPhone17,3\",\n \"enrollmentStatus\": {\n \"id\": \"66666666-6666-6666-6666-666666666666\",\n \"lastConnection\": \"2026-04-10T14:00:22.000Z\",\n \"coupled\": true,\n \"versionCode\": null\n },\n \"emmDeviceInfo\": {\n \"id\": \"77777777-7777-7777-7777-777777777777\",\n \"externalId\": \"88888888-8888-8888-8888-888888888888\",\n \"metadata\": {\n \"deviceOwnershipCriteria\": \"managedDeviceOwnerType = company\",\n \"lastDeviceStateSent\": \"3\"\n },\n \"lastSynchronizationDate\": \"2026-07-16T08:00:17.000Z\"\n }\n },\n \"installedAt\": \"2026-07-16T08:00:31.000Z\",\n \"uninstalledAt\": null,\n \"native\": false\n },\n \"matchedResponseRules\": []\n }\n}",
"event": {
"category": [
"process"
],
"type": [
"change"
]
},
"@timestamp": "2026-07-16T08:00:17Z",
"pradeo": {
"application": {
"id": "33333333-3333-3333-3333-333333333333",
"name": "Example",
"package": "com.example.application",
"system": "iOS",
"version": "3.47.0"
},
"compliance": {
"matchedResponseRules": []
},
"detection": {
"status": "Approved"
},
"device": {
"byod": false,
"coupled": true,
"declaredModel": "iPhone17,3",
"declaredOperatingSystem": "iOS",
"declaredOperatingSystemSecurityPatchDate": "1970-01-01T00:00:00Z",
"declaredOperatingSystemVersion": "26.5.2",
"email": "j.doe@example.com",
"id": "55555555-5555-5555-5555-555555555555",
"imei": "357473867852731",
"lastConnection": "2026-04-10T14:00:22Z",
"mdmId": "88888888-8888-8888-8888-888888888888",
"name": "John Doe"
},
"metadata": {
"creationDate": "2026-07-16T08:00:31.465000Z",
"id": "00000000-0000-0000-0000-000000000000"
}
},
"user": {
"email": "j.doe@example.com"
}
}
Extracted Fields
The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.
| Name | Type | Description |
|---|---|---|
@timestamp |
date |
Date/time when the event originated. |
event.action |
keyword |
The action captured by the event. |
event.category |
keyword |
Event category. The second categorization field in the hierarchy. |
event.type |
keyword |
Event type. The third categorization field in the hierarchy. |
host.os.name |
keyword |
Operating system name, without the version. |
host.os.type |
keyword |
Which commercial OS family (one of: linux, macos, unix or windows). |
host.os.version |
keyword |
Operating system version as a raw string. |
pradeo.application.id |
string |
id of the application |
pradeo.application.md5 |
string |
md5 of the application |
pradeo.application.name |
string |
name of the application |
pradeo.application.package |
string |
package of the application |
pradeo.application.sha1 |
string |
sha1 of the application |
pradeo.application.sha256 |
string |
sha256 of the application |
pradeo.application.system |
string |
operating system of the application |
pradeo.application.version |
string |
version of the application |
pradeo.application.versionCode |
integer |
version code of the application |
pradeo.compliance.matchedResponseRules |
string |
compliance matched response rules level of a device or device application |
pradeo.correlation.applicationThreatLevel |
keyword |
application threat level of the device |
pradeo.correlation.matchedNetworkStatusLevels |
string |
matched network status level of a device |
pradeo.correlation.matchedSystemStatusLevels |
string |
matched system status level of a device |
pradeo.correlation.networkThreatLevel |
keyword |
network threat level of the device |
pradeo.correlation.systemThreatLevel |
keyword |
system threat level of the device |
pradeo.detection.status |
keyword |
device status name affected by the event |
pradeo.detection.value |
integer |
device status value affected by the event |
pradeo.device.byod |
boolean |
byod state of the device |
pradeo.device.coupled |
boolean |
coupling status of the device |
pradeo.device.declaredModel |
string |
declared model of the device |
pradeo.device.declaredOperatingSystem |
keyword |
declared operating system of the device |
pradeo.device.declaredOperatingSystemSecurityPatchDate |
datetime |
declared operating system security patch date of the device |
pradeo.device.declaredOperatingSystemVersion |
string |
declared operating system version of the device |
pradeo.device.email |
string |
email of the device |
pradeo.device.emm |
string |
emm of the device |
pradeo.device.id |
string |
id of the device |
pradeo.device.imei |
string |
imei of the device |
pradeo.device.is_active |
boolean |
active state of the device |
pradeo.device.jobs |
array |
jobs of the device |
pradeo.device.lastConnection |
datetime |
last connection date of the device |
pradeo.device.mdmId |
string |
mdm id of the device |
pradeo.device.name |
string |
name of the device |
pradeo.device.serialNumber |
string |
serial mumber of the device |
pradeo.initiator.byod |
boolean |
byod state of the initiator of the action (device) |
pradeo.initiator.coupled |
boolean |
coupling status of the initiator of the action (device) |
pradeo.initiator.declaredModel |
string |
declared model of the initiator of the action (device) |
pradeo.initiator.declaredOperatingSystem |
keyword |
declared operating system of the initiator of the action (device) |
pradeo.initiator.declaredOperatingSystemSecurityPatchDate |
string |
declared operating system security patch date of the initiator of the action (device) |
pradeo.initiator.declaredOperatingSystemVersion |
string |
declared operating system version of the initiator of the action (device) |
pradeo.initiator.email |
string |
email of the initiator of the action (device or admin) |
pradeo.initiator.emm |
keyword |
emm of the initiator of the action (device) |
pradeo.initiator.id |
string |
id of the initiator of the action (device or admin) |
pradeo.initiator.imei |
string |
imei of the initiator of the action (device) |
pradeo.initiator.lastConnection |
datetime |
last connection date of the initiator of the action (device) |
pradeo.initiator.mdmId |
string |
mdm id of the initiator of the action (device) |
pradeo.initiator.name |
string |
name of the initiator of the action (device) |
pradeo.initiator.serialNumber |
string |
serial mumber of the initiator of the action (device) |
pradeo.metadata.category |
keyword |
event category (application, device, system or network) |
pradeo.metadata.creationDate |
datetime |
Cretaion date of the event |
pradeo.metadata.id |
string |
Pradeo unique event id |
pradeo.metadata.source |
keyword |
event origin (system or admin) |
pradeo.metadata.type |
keyword |
type of event (e.g AccountCreated, DeviceCreated, DeviceDetection) |
pradeo.permission.name |
string |
permission name |
pradeo.permission.value |
string |
permission value |
pradeo.policy.id |
string |
policy id used for correlation |
pradeo.policy.name |
string |
policy name used for correlation |
rule.category |
keyword |
Rule category |
rule.version |
keyword |
Rule version |
user.email |
keyword |
User email address. |
user.full_name |
keyword |
User's full name, if available. |
user.id |
keyword |
Unique identifier of the user. |
For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.