Endpoint monitor
- Splunk
- OpenSearch
Event store: monitor.endpoint.info
This documentation provides a detailed description of all the fields collected from the endpoint monitor, split into logical categories for easy reference.
`getIndexConfidentialData` source="monitor.endpoint.info"
🖥 Hardware Information
| Field | Description | Data Type | Unit | Example |
|---|---|---|---|---|
manufacturer | Manufacturer name | String | - | Dell Inc. |
model | Device model | String | - | XPS 9320 |
product_name | Product name | String | - | XPS 9320 |
product_uuid | Unique identifier for the device | String | - | 4C4C4544-0038-4410-804D-B5C04F4B5233 |
bios[].caption | BIOS caption/version | String | - | 2.30.0 |
bios[].release_date | BIOS release date | Integer | Epoch | 1776902400 |
cpu_model | CPU model | String | - | 12th Gen Intel Core i7-1260P |
cpu_clock_frequency | CPU base frequency | Integer | MHz | 2100 |
cpu_cores | Number of physical cores | Integer | Count | 12 |
cpu_logical_processors | Number of logical processors | Integer | Count | 16 |
memory_mb | Installed system memory | Integer | MB | 16384 |
🛠 Operating System (OS)
| Field | Description | Data Type | Example |
|---|---|---|---|
os | Operating system name | String | Windows 11 Pro |
os_version | OS version | String | 22600.8893 |
os_codename | OS build codename | String | 25H2 |
os_install_date | Install date | Integer | 0 (epoch) |
last_boottime | Last boot time | Integer | 1785133343000 |
release_id | OS release ID | String | 2009 |
🌐 Network Information
| Field | Description | Data Type | Example |
|---|---|---|---|
connection_type | Current connection type | String | WiFi |
internal_ip | Internal IP address | String | 192.168.86.76 |
public_ip | Public IP address | String | 185.50.194.180 |
internal_mac_address | Primary MAC address | String | 04:cf:4b:fc:0f:e4 |
network_interfaces[] | List of network interfaces | Object | Detailed list of NICs |
🔋 Power & Battery
| Field | Description | Data Type | Unit | Example |
|---|---|---|---|---|
battery_count | Number of detected batteries | Integer | Count | 1 |
battery_device_name | Battery device name | String | - | DELL NXRKW24 |
battery_estimated_charge_remaining | Estimated remaining charge | Integer | % | 94 |
battery_estimated_runtime_sec | Estimated runtime | Integer | Seconds | 137 |
power_energy_saver_mode | Is energy saver mode enabled? | Boolean | - | 0 |
🔐 Security & TPM
| Field | Description | Data Type | Example |
|---|---|---|---|
secure_boot_enabled | Secure Boot feature | Boolean | 1 |
secureboot.confidence_level | Secure Boot trust level | String | High Confidence |
tpm[].manufacturer_id_txt | TPM manufacturer | String | STM |
tpm[].spec_version | TPM specification version | String | 2.0 |
📦 Storage (Pagefiles)
| Field | Description | Data Type | Example |
|---|---|---|---|
pagefiles[].drive | Drive letter for pagefile | String | C:\ |
pagefiles[].allocated_base_size | Base allocated size | Integer | 16000 |
pagefiles[].peak_usage | Peak usage in MB | Integer | 2433 |
🔍 Virtualization Details
| Field | Description | Data Type | Example |
|---|---|---|---|
is_virtual_machine | Is device a VM? | Boolean | false |
virtual_machine_info.hypervisor | Hypervisor name | String | (empty) |
🎵 Multimedia (Sound & Video Devices)
| Field | Description | Example |
|---|---|---|
sound_devices[].name | Sound device name | Intel® Smart Sound Technology |
video_devices[].caption | Video device description | Intel(R) Iris(R) Xe Graphics |
✅ Additional Metadata
| Field | Description | Example |
|---|---|---|
lookup_key | Internal system ID key | b8513a96a1841bd64ede23 |
host | Splunk host identifier | b8513a96… |
type | Device type | laptop |
vendor | Vendor name | Microsoft |
version | Agent or client version | 2026.04.17 |
KVStore: ux_nodes
KVStore ux_nodes is updated every 5 minutes via input script update_kvstore.py
Datamodel: UXM_Endpoint Endpoint
| Field | Metric Store | Description | Data Type | Unit | Example | Available on platforms |
|---|---|---|---|---|---|---|
| version | Version of UXM Desktop agent | String | 2021.09.28 | Windows, Linux, MacOS | ||
| domain | String | testdomain.com | ||||
| hostname | String | DKTESTPC1 | Windows, Linux, MacOS | |||
| type | laptop, desktop, robot | String | laptop | |||
| cpu_cores | Number | 2 | Windows, Linux, MacOS | |||
| cpu_sockets | Number | 1 | Windows, Linux, MacOS | |||
| cpu_logical_processors | Number | 4 | Windows, Linux, MacOS | |||
| cpu_generation | String | Intel64 Family 6 Model 142 Stepping 9 | Windows | |||
| cpu_model | String | Intel Core i5 7200U, Intel Xeon | Windows, Linux, MacOS | |||
| cpu_clock_frequency | String | MHz | 2500 | Windows, Linux, MacOS | ||
| cpu_load | Move: Send at interval | Float | % | 55.4% | ||
| memory_mb | Number | MB | 24000 MB | |||
| manufacturer | String | Dell Inc. | Windows | |||
| model | String | Latitude 5480 | Windows | |||
| os | String | Windows 10 Pro, Ubuntu 18.04, Mac OS X Big sur | Windows, Linux, Mac OS | |||
| os_version | String | Windows 7:, Windows 10: 19042, Windows 11: 22000+, Linux (Kernel version): 5.4.0-1053-gcp, Mac OS X: 11.2.1 | Windows, Linux, Mac OS | |||
| os_codename | Friendly code name of the installed OS build. | String | Windows 10: 20H2, Linux Ubuntu: bionic, Mac OS X: Big Sur | Windows, Linux, Mac OS | ||
| product_identifying_number | Serial number or service code | String | 2C703M2 | Windows | ||
| product_name | String | Latitude 5480 | Windows | |||
| product_uuid | String | 4C4C4544-0043-3710-8030-B2C04F334D00 | Windows | |||
| last_boottime | Number | Timestamp | Windows | |||
| battery_wear_level | Float | % | 80% | Windows | ||
| batteries | Number | 1 | Windows | |||
| powerplan | Active power plan | String | Dell | Windows | ||
| powerplan_description | Active power plan description (Localised language) | String | Automatically balances performance with energy consumption on capable hardware. | Windows | ||
| powerplan_instance_id | Active power plan instance ID | String | 49ef8fc0-bb7f-488e-b6a0-f1fc77ec649b | Windows | ||
| windows_stability_index | Number | Windows |
Event store: Installed programs monitor.endpoint.programs_installed
Datamodel: UXM_Desktop Programs_Installed
Index: getIndexSessionData
Source type: monitor.endpoint.programs_installed
Dashboards visualizing data: Endpoint Details
Collected via Endpoint monitor
Collected: On start and daily
The monitor collects information about software installed on the endpoint from:
- Windows Registry – Traditional desktop applications registered as installed programs.
- Microsoft Store – Applications installed through the Microsoft Store.
- Browser Extensions – Extensions installed in supported browsers.
| Field | Display name | Description | Data Type | Unit | Example | Available on platforms |
|---|---|---|---|---|---|---|
| host | Endpoint node application is installed on, lookup hostname and info via ux_nodes_lookup. | String | 5d05ad82d053082a69343a52 | All | ||
| source | String | agent.programs.installed | All | |||
| sourcetype | String | uxm:json | All | |||
| timestamp_utc | UTC Timestamp from when data was collected. (Also stored in Splunk _time field) | 2019-12-19T10:08:27 | All | |||
| guid | GUID | String | Google Chrome | Windows | ||
| install_date | Install Date | 20210203 | Windows | |||
| install_source | Install Source | String | Windows | |||
| install_location | Install Location | String | C:\Program Files\Google\Chrome\Application | Windows | ||
| is_64_bit | Is 64 bit | 0 = Installed under Wow6432, 1 = Is 64 bit | String | 0 | Windows | |
| language | Language | String | 0 | Windows | ||
| major | Major | Windows | ||||
| major_version_parsed | Major version (Normalized) | Windows | ||||
| minor | Minor | Windows | ||||
| name | Name | String | Google Chrome | Windows, Linux, MacOS | ||
| name_parsed | Name (Normalized) | String | Google Chrome | Windows, Linux, MacOS | ||
| publisher | Publisher | String | Google LLC | Windows | ||
| version | Version | String | 88.0.4324.146 | Windows, Linux, MacOS | ||
| windows_installer | Is Windows Installer | Number | 0 | Windows |
The tables below document the fields that are currently exposed using standard Elastic Common Schema (ECS) and OpenTelemetry attribute names.
uxmapp_confidential - (event.module: endpoint, event.module: endpoint)
GET uxmapp_confidential-*/_search
{
//"_source": ["agent.name","agent.id","host.name","device.model","os.name"],
"query": {
"match_all": {}
}
}
Host field details
| Field | Type | Description | Example |
|---|---|---|---|
| host.domain | keyword | Name of the domain of which the host is a member.For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. example: CONTOSO | extended |
| host.hostname | keyword | Hostname of the host.It normally contains what the hostname command returns on the host machine. | core |
| host.id | keyword | Unique host id.As hostname is not always unique, use values that are meaningful in your environment.Example: The current usage of beat.name.  host.id | core |
| host.ip | ip | Host ip addresses.type: ipNote: This field should contain an array of values. host.ip | core |
| host.mac | keyword | Host MAC addresses. The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. Note: This field should contain an array of values, example: ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] host.mac | core |
| host.name | keyword | Name of the host. It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. host.name | core |
Device field details
| Field | Type | Description | Example | Platforms |
|---|---|---|---|---|
| device.manufacturer | keyword | The vendor name of the device manufacturer. device.manufacturer | Samsung | |
| device.model.identifier | keyword | The machine readable identifier of the device model. device.model.identifier | SM-G920F | |
| device.model.name | keyword | The human readable marketing name of the device model. device.model.name | Samsung Galaxy S6 | |
| device.serial_number | keyword | This field is beta and subject to change. The unique serial number serves as a distinct identifier for each device, aiding in inventory management and device authentication. | DJGAQS4CW5 |