Discover

The unique identifier of the document

Example: abc1ynoBFvyEXmgZVq23

The index that the document belongs to

Example: abs_5b9a578b-592c-49de-812e-bac78f1234e

The relevance of a document to the Elasticsearch query

Not populated at this time

The document's mapping type

This field is always _doc

The unique ID associated with this Absolute account

Example: be8eb674-xxxx-11d4-8835-00c04f72c2df

The version number of the Secure Endpoint Agent installed on the device

Example: 8.0.978.0

The version number of the Absolute Persistence software embedded in the firmware of the Windows device

Example: 957

The operating condition of the Secure Endpoint Agent

Possible values:

• active: the agent has connected to the Monitoring Center.

• inactive: the agent has started its first connection to the Absolute Monitoring Center and agent activation is in progress and when activation is completed, the status is updated to Active

  disabled: the agent is either flagged for removal or removed from the device

Indicates whether the component manager コンポーネントマネージャー (CTES とも呼ばれる) はコアエージェントに加えてインストールされ、デバイスの操作の開始やデバイスデータの収集を行うエージェントコンポーネントを管理します。ほとんどのエージェントコンポーネントは、ハードウェアポリシーやインストール済みアプリケーションポリシーなどのポリシーによって制御されます。コンポーネントマネージャーは通常、Absolute モニタリングセンターに少なくとも 15 分ごとに接続し、デバイスのデータを送信して指示を受け取ります。 is enabled on the device

• true: the component manager is enabled

• false: the component manager is disabled

The version number of the component manager installed on the device

Example: 1.0.0.2612

The date and time when data was last received from the component manager

Example: Sep 7, 2021 @ 12:35:23.097

The date and time when the component manager was last updated on the device

Example: Sep 7, 2021 @ 12:35:23.097

The status of the component manager installed on the Windows device

Example: OK

The status code for the status of the component manager installed on the Windows device

Example: 0

A comma separated list of the device groups assigned to the device

Example: Encrypted Devices, Off-Domain

The name assigned to the device

Example: LPTP_TJordan

The serial number of the device

Example: GHIJSQ2

The unique identifier of the device

This isn't the same as Identifier in the console

Example: 1234a1bc-7654-4734-de7f-d11ce59095b1

The type of document

• aur: Application Usage

  • app-instance

  • exe-instance

• avp: Anti-Malware

• cdc: Custom Data collection

• dur: Device Usage

• edd: Data Discovery

  • edd-file-scan

  • edd-match-summary

• esp: Full-Disk Encryption

• evtd: Event Changes

• hdc: Hardware

  • general

• rar: Application Resilience

• sng: Installed Applications

  • app-info

  • app-list

• wma: Web Usage

The date and time when the event occurred

Example: Sep 8, 2021 @ 08:13:17.724

The unique ESN (Absolute Identifier) assigned to the agent installed on the device

Example: 1L0XXXXB2JAA3KSB0006

The date and time when the device's Hardware policy was last activated or updated on the device

Example: Aug 24, 2021 @ 05:46:46.903

Last known local IP address of the device

Example: 172.12.23.34

The name of the Windows domain to which the device belongs

Example: WORKGROUP

Last known public IP address of the device

Example: 172.45.67.89

The date and time when the document was created

Example: Sep 8, 2021 @ 08:08:44.304

The date and time when the agent initially connected to the Absolute Monitoring Center

Example: Jun 23, 2020 @ 13:24:12.137

The date and time when the operating system was last restarted

Example: Aug 25, 2021 @ 12:45:59.500

The date and time when the device last connected to the Absolute Monitoring Center

Example: Sep 8, 2021 @ 08:00:02.893

Indicates whether the device was reported as stolen

• true: the device has been reported stolen

• false: the device hasn't been reported stolen or has been reported found

The capacity (in milliwatt-hours) of the battery

Example: 1,000

The estimated percentage of the full charge that remains

Example: 99

The amount of time (in minutes) it will take to deplete the remaining battery using the present load conditions

Returns 71,582,788 when the device is hooked to external power and the battery is not being depleted

Example: 45

The total expected life (in minutes) of the fully charged battery

Example: 10,000

The maximum time (in minutes) to fully charge the battery

Example: 240

The Asset Tag of the device, as reported in the BIOS

Example: No Asset Tag

The name of the BIOS language

Example: enUS

The manufacturer of the BIOS

Example: Dell Inc.

The date and time when the Windows BIOS was released

Example: Oct 20, 2020 @ 17:00:00.000

The serial number assigned to the BIOS

Example: 5CG6162G6Z

The major version number of the BIOS software

Example: 3

The minor version number of the BIOS software

Example: 1

The version number of the BIOS software, as reported by the System Management BIOS (SMBIOS)

Example: 3.1

The version of the BIOS, as reported by the SMBIOS

Example: DELL - 1072009 1.16.0

The manufacturer of the BIOS

+

The version of the BIOS, as reported by the SMBIOS

+

The release date of the Windows BIOS, in <dd/mm/yyyy> format

Example: Dell Inc. 1.16.0, 10/21/2020

Uses a script to indicate whether the device has more than one hardware BIOS

• true: the device contains more than one hardware BIOS

• false: the device doesn't contain more than one hardware BIOS

The asset identifier populated by the Google Administrator

Maps to the Asset ID field in the Google Admin console

Example: CHR_TJordan

The address or location of the device

Maps to the Location field in the Google Admin console

Example: Vancouver BC

Initially populated with the user who first enrolled the device but the Google Administrator can edit this field

Maps to the User field in the Google Admin console

Example: [email protected]

The date when the Chromebook device will no longer receive the automatic Chromebook updates that enhance both the device and its software

Maps to the Auto-update expiration field in the Google Admin console

Example: Jun 1, 2026 @ 00:00:00.000

The boot mode of the Chromebook

Maps to the Boot mode field in the Google Admin console

Possible values are:

• Verified: the device is running a valid version of the Chrome OS operating system.
• Dev: the device is running in developer mode, which gives device users access to a "root" shell. Google can't verify the operating system in this mode. For more information, refer to the Chromebook developer documentation

The enterprise device identifier that uniquely identifies the Chromebook

Maps to the Device ID field in the Google Admin console

Example: 1a23456b-cd94-4ef7-8336-78708104ab89

Shows the status of the Chromebook extension on the device

Possible values are:

• PENDING: your Google account has been added to the Secure Endpoint Console and the devices organizational unit (OU) has been selected but the extension hasn't deployed to the device yet

• INSTALLED: your Google account has been added to the Secure Endpoint Console and an authorized user has logged in to the Chromebook

• INACTIVE: the device has been unenrolled from the Secure Endpoint Console

The date and time when the Google account last synced with the Absolute Monitoring Center

Example: Sep 6, 2021 @ 22:29:42.580

The date and time when the device last synced with the Absolute Monitoring Center

Example: Sep 7, 2021 @ 04:00:32.815

Special information about the device

Maps to the Notes field in the Google Admin console

Example: RM456

The full path of the OU that the Chromebook belongs to

Maps to the Organizational unit field in the Google Admin console

Example: SD123

Shows the build number and channel of the device's Chrome OS operating system

Maps to the Platform version field in the Google Admin console

Example: 13505.73.0 (Official Build) stable-channel octopus

Shows the status of the Chromebook in the Google Admin console

Maps to the Status field in the Google Admin console

Example: ACTIVE

The number of logical processors for the current instance of the processor

Example: 2

The manufacturer for the current instance of the processor

The name of the CPU

Example: Intel(R) Xeon(R) Platinum 8171M CPU @ 2.60GHz

The number of cores for the current instance of the processor

Example: 2

A comma separated list of the field names of the Custom Defined fields

Example: Asset#, Department

A comma separated list of the names of the Custom Defined fields

Example: Asset Number, Department

A comma separated list of the data types for the Custom Defined fields

Example: Text, Dropdown

A comma separated list of the unique identifiers assigned to the Custom Defined fields

Example: IaLDZbcdQyqoPs5N1EFGH, IaLDZbcdQyqoPs5N1ABCD

The Device Freeze conditions set for the device

Can have multiple values is there are multiple Freeze requests on the device

Example: FreezeConditionOfflineSet

A comma separated list of the displays' manufacturers

Example: Intel, Apple

A comma separated list of the displays' names

Example: Intel Iris Graphics 6100, Color LDC

A comma separated list of the number of colors the displays support in their current resolution

Example: 4,294,967,296, 4,294,967,296

A comma separated list of the Windows Plug and Play device identifiers

Example: DISPLAY\CMN15C2\4&955A4AC&0&UID256

A comma separated list of the frequency (in hertz) at which the video controllers refresh the image for the displays

Example: 0, 60

Indicates whether the Geolocation Tracking policy is enabled

true: the Geolocation Tracking policy is enabled

false: the Geolocation Tracking policy is disabled

The estimated accuracy (in meters) of the technology used to locate the device

Example: 23,182

The version number of the GEO component デバイスの地理的な位置を検出する Secure Endpoint Agent の軽量ソフトウェアコンポーネントです。GEO コンポーネントは、ジオロケーション追跡ポリシーによって制御されます。 of the Secure Endpoint Agent installed on the device

Example: 1.0.0.2612

The city where the device is located

Example: Vancouver

The ISO code for the country where the device is located

Example: CAN

The name of the country where the device is location

Example: Canada

The date and time when the device's geolocation information was last updated

Example: Sep 8, 2021 @ 09:41:30.429

The technology used to get the location

Possible values:

• GPS_TYPE

• IP_RESOLUTION

• OS_LOCATION_API_TYPE

• WIFI_TYPE

The estimated latitude and longitude (in degrees) where the device is located

Example: { "coordinates": [ -123.14094449999997, 49.257493 ], "type": "Point" }

The description of the disk drive

Example: Disk drive

The name of the manufacturer of the disk drive

Example: (Standard disk drives)

The type of media used or accessed by this device

Example: Fixed hard disk media

The name of the disk drive

Example: \\.\PHYSICALDRIVE0

The number of partitions on the physical disk drive that are recognized by the operating system

Example: 2

The size (in bytes) of the physical disk drive

Example: 256,052,966,400

A comma separated list of the unique identifiers of the physical memory devices

Example: Physical Memory 0, Physical Memory 1

A comma separated list of the names of the manufacturers of the physical memory devices

Example: SK Hynix, SK Hynix

A comma separated list of the total capacity (in bytes) of the physical memory devices

Example: 8,589,934,592, 8,589,934,592

The dynamic host configuration protocol (DHCP)

Example: 172.20.8.11

A comma separated list of the network adapters' associated IPv4 addresses

Example: 192.168.1.2, 172.20.12.78

A comma separated list of the network adapters' associated IPv6 addresses

Example: fe80::3d47:4393:b4f0:9bf5, fe80::d0d2:9f52:ff82:1234

A comma separated list of the network adapters' media access control (MAC) addresses

Example: A0:1D:48:15:23:46, 00:12:3D:45:21:4F

A comma separated list of the network adapters' manufacturers

Example: Intel, Cisco Systems

A comma separated list of the network adapters' names

Example: Intel(R) Dual Band Wireless-AC 8265, Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

The service set identifier (SSID), usually refers to the Wi-Fi network name

Example: ABCCompanyGuest

A comma separated list of the network adapters' product type according to the manufacturer

Example: Intel(R) Dual Band Wireless-AC 8265, Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64

A comma separated list of the network adapters' service names

Example: e1i65x64, VMnetAdapter

The architecture of the OS

Example: 64-bit

The build and the Update Build Revision (UBR) of the OS

Example: 19043.1202

The latest service pack installed on the device

Example: Service Pack 1

The edition of the OS

Example: Professional

The build number of the OS

Example: 10943

The date and time when the OS was installed

Example: Feb 1, 2021 @ 13:41:07.000

Indicates whether the OS has reached the end of life for support from the manufacturer

• true: the OS has reached end of life support from the manufacturer

• false: the OS hasn't reached end of life support from the manufacturer

The major version number of the OS

Example: 10

The name of the manufacturer of the OS

Example: Microsoft Corporation

The minor version number of the OS

Example: 0

The name of the OS

Example: Microsoft Windows 10 Pro

The date that the OS patch identified in os.buildnUbr became available

Example: Jun 7, 2021 @ 17:00:00.000

The product key of the OS

Example: TY4CG-JDJH7-XX0XX-DY4X9-ABCD1

The release number of the OS on a Windows device

Example: 2009

The Update Build Revision (UBR) of the OS

Example: 1202

The version of the OS

Example: 10.0.19043

The directory of the OS on a Windows device

Example: C:\windows

The date and time the device was moved into the policy group

Example: Aug 12, 2021 @ 12:17:54.157

A comma separated list of the names of the printer drivers

Example: Microsoft XPS Document Writer, EPSON EP-805A Series

A comma separated list of the name of the printers

Example: Microsoft XPS Document Writer, EPSON EP-805A Series

A comma separated list of the ports used to transmit data to the printer

Example: XPSPort:, PORTPROMPT:

A comma separated list of the names of the servers that control the printers

Example: PRINTSERVER1

Indicates whether a strong supervisor password is required

• true: a strong supervisor password is required

• false: a strong supervisor password isn't required

Indicates whether Remote Supervisor Password (RSVP) is supported on the device

• true: the device supports RSVP

• false: the device doesn't support RSVP

The status of the Manage Supervisor Password request

The amount (in bytes) of physical memory currently unused and available

Example: 4,793,049,088

The amount (in bytes) of unused virtual memory

Example: 981,204,992

The chassis type from the System Enclose or Chassis structure in the SMBIOS information

Values correspond to ChassisTypes in theWin32_SystemEnclosure WMI class

Example: 1

The name of the Windows domain to which this device belongs

Example: WORKGROUP

The language identifier used by the operating system

Example: English (United States)

The manufacturer of the device

Example: Dell

The product name from the manufacturer

Example: OPTIPLEX 9020

The name assigned to the device

Example: LPTP_TJordan

The directory of the operating system

Example: C:\WINDOWS\system32

The status of the System Integrity Protection on the Mac device

Example: enabled

The time zone represented when daylight savings time is in effect

Example: Pacific Daylight Time

The total amount (in bytes) of physical memory

Example: 16,776,679,424

The total amount (in bytes) of virtual memory

Example: 14,624,084

A comma separated list of the names of the manufacturers of the USB devices

Example: Generic USB xHCI Host Controller, Generic USB xHCI Host Controller

A comma separated list of the names of the USB controllers

Example: Intel(R) USB 3.0 eXtensible Host Controller - 1.0 (Microsoft), Intel(R) USB 3.0 eXtensible Host Controller - 1.0 (Microsoft)

The unique username of the user that was logged in to the device at the time of the most recent Secure Endpoint Agent call

If there was no user logged in during the last agent call, the last detected username is used

May also include the device name

Example: LPTP_TJordan\tjordan

The unique username of the user that was logged in to the device at the time of the most recent Secure Endpoint Agent call

If no user was logged in during the most recent agent call, no data shows

May also include the device name

Example: tjordan

The average amount of memory (in bytes) dedicated to the application during the 24-hour interval

Example: 1,108,314,794

A comma separated list of the application's categories

Not all applications have data in this field

Example: Productivity

The number of seconds that the CPU dedicated to the application in the 24-hour interval

Example: 180

A comma separated list of the executables in the application

Example: outlook.exe, onenotem.exe, excel.exe, winword.exe

The hash of the application

Example: BED49E6E49BF27D0F70E706A31309319

The number of minutes that the application was in focus in the 24-hour interval

Example: 56

The date and time the application was last installed

Example: Apr 22, 2021 @ 08:22:49.727

The location the application was last installed in

Example: C:\Program Files\Microsoft Office

The major version of the application

Example: 16

The minor version of the application

Example: 0

The number of minutes that the application was in use in the 24-hour interval

Example: 60

The name of the application

Example: Microsoft 365 Apps for enterprise

Indicates whether the application comes installed on the OS

• true: the application comes installed on the OS

• false: the application doesn't come installed on the OS

The publisher of the application

Example: Microsoft

The application's version

Example: 16.0.13901.20400

A numeric flag to indicate whether the application was used inside of office hours

0: The application wasn't used inside of office hours

1: The application was used inside of office hours

The number of minutes the device was used inside of office hours in the 24-hour interval

Example: 96

The number of minutes the device was used after office hours in the 24-hour interval

Example: 96

A comma separated list of the application's categories

Not all applications have data in this field

Example: Productivity

The hashed value of the application

Example: BED49E6E49BF27D0F70E706A31309319

The date and time the application was last installed

Example: Oct 3, 2019 @ 17:00:00.000

The location the application was last installed in

Example: C:\Program Files\Microsoft Office

The major version of the application

Example: 16

The minor version of the application

Example: 0

The name of the application

Example: Microsoft 365 Apps for enterprise

Indicates whether the application comes installed on the OS

• true: the application comes installed on the OS

• false: the application doesn't come installed on the OS

The publisher of the application

Example: Microsoft

The application's version

Example: 16.0.13901.20400

The average amount of memory (in bytes) dedicated to the executable during the 24-hour interval

Example: 308,771,566

The number of seconds the executable was in use in the 24-hour interval

Example: 16

The number of minutes that the executable was in focus in the 24-hour interval

Example: 0

The number of minutes the executable was in use in the 24-hour interval

Example: 60

The name of the executable

Example: excel.exe

Indicates whether the executable comes installed on the OS

• true: the executable comes installed on the OS

• false: the executable doesn't come installed on the OS

A numeric flag to indicate whether the application was used inside of office hours

0: the application wasn't used inside of office hours

1: the application was used inside of office hours

The number of minutes the device was used inside of office hours in the 24-hour interval

Example: 96

The number of minutes the device was used after office hours in the 24-hour interval

Example: 96

The event associated with the device usage

Possible values:

• Logon
• Unlock

The hour of the day during which the event occurred. Possible values are between 0 and 23.

The date and time when the event occurred

Example: Sep 8, 2021 @ 08:13:17.724

A numeric flag to indicate whether the event occurred inside of office hours

0: the event occurred outside of work hours

1: the event occurred inside work hour

The date and time when a device's Secure Endpoint Agent last checked in successfully to the Absolute Monitoring Center.

Example: Jul 19, 2021 @ 04:22:06.275

The daily usage of a device, averaged over the 30 days prior to the most recent agent check-in and expressed in minutes

Example: 96

A numeric flag to indicate whether the event occurred inside of office hours

0: the event occurred outside of work hours

1: the event occurred inside work hour

The number of minutes the device was used inside of work hours

Example: 96

The number of minutes the device was used outside of work hours

Example: 96

The Credit Card Numbers Match Score calculated for the device

Example: 3

The Match Score for custom EDD rules

Example: 5

The names of the custom EDD rules

The Encrypted or Password Protected Match Score calculated for the device

Example: 0

The GDPR Personal Data Match Score calculated for the device

Example: 0

The date and time when the device was scanned using the scan configurations set in the Endpoint Data Discovery policy

Example: Jul 19, 2021 @ 09:31:04.000

The Personal Financial Information Match Score calculated for the device

Example: 21

The Personal Health Information Match Score calculation for the device

Example: 46

The policy group name for the EDD policy

Example: Global Policy Group

The potential estimated cost to your organization, in US dollars, of a data breach of the at-risk files detected on the device

Estimated Cost Exposure (USD) is based on a methodology presented in the Verizon 2015 Data Breach Investigations Report and is intended to serve as a guideline only. The actual cost of a data breach within your organization will vary. For more information about the methodology, go to the Verizon website and see the section, "Impact: 'In the Beginning, There Was Record Count'” (pages 27 to 30) of the 2015 Data Breach Investigations Report.

Example: 24,103.5

The total of all individual EDD rule Risk Score 機密ファイルまたはリスクファイルのコンテンツがデバイス上に存在する場所に応じて、マッチスコアに重み付けが加えられる可能性のある計算された値です。ファイルがクラウドソフトウェアストレージフォルダーに存在し、そのためにクラウドで共有されるリスクがある場合、そのマッチスコアに 2 を乗算することでリスクスコアが導き出されます。ファイルがその他の場所にある場合、そのファイルのリスクスコアはマッチスコアと同じです。s for the device.

Example: 88

The US Social Security Numbers Match Score calculated for the device

Example: 18

The type of content

Example: application/msword

The file's file extension

See File types scanned by the DAR component for specific file types the component can detect and analyze

Example: doc

The hash of the file

Example: 92996251CB2CEAFE2ABD9805663EFF3B

The status of the file's EDD scan results

Possible values:

• Historical

• Matched

• Incoming

• Deleted

The scanned file's name

Example: Credit Score Report.doc

The scanned file's owner

Example: TJordan

The scanned file's path

Example: C:\Users\bsmith\Documents\Local\Credit Score Report.doc

The date and time the file was scanned

Example: Jul 26, 2021 @ 17:00:00.000

The EDD rule for which a match was detected

Example: lexicon_Finance

The resulting match score for the file

Example: 1

The policy group name for the EDD policy

Example: Global Policy Group

A comma separated list of the categories to which the applications belongs

Example: Software Development, Development, Security

A comma separated list of the major versions of the applications

Example: 7, 1, 21

A comma separated list of the minor versions of the applications

Example: 2,105, 0

A comma separated list of the names of the applications

Example: 3D Viewer, Adobe Acrobat Reader DC, Alarms & Clock

The category that an application belongs to

Example: Productivity

The major version of an application

Example: 1

The minor version of an application

Example: 0

The name of an application

Example: Word

The version of an application

Example: 1.0

The date and time when the indicated version of the application was first detected on the device

Example: Mar 31, 2021 @ 06:52:28.735

The date that the application was installed

Example: Nov 11, 2020 @ 16:00:00.000

The location where the application is installed

Example: C:\Users\bobsmith\AppData\Local\Microsoft\Edge\User Data\Default\Web Applications\_crx__hijklmnobiflkdfdgdajcfklmcibbopi

The date and time of the most recent application scan

Example: Jul 27, 2021 @ 10:53:53.391

The original name of the software publisher of the application

Example: Word