Query Operators and Search Fields

16 min

This chapter describes the query operators and search fields that you can use with the query parameter.

Valid Query Operators

The query parameter supports the following operators:

Priority	Operator	Operation
1	=	Equals and case-insensitive string comparison
2	>	Is greater than
3	>=	Is greater than or equal to
4	<	Is less than
5	<=	Is less than or equal to
6	"contains"	Case-insensitive substring matching
7	"starts with"	Case-insensitive prefix matching
8	!=	Not Equals
9	"does not contain"	Case-insensitive substring exclusion
10	"is empty"	Is empty
11	"is not empty"	Is not empty

Valid Search Fields

The device search fields include:

those that are common to all

Android-only

iOS-only

Windows-Phone-only

user-related, including LDAP.

Common Device Search Fields

Field name format:

"common.<field_name>"

Field	Data Type	Sample Data	Description
apns_capable	boolean	e43f9c41484baf6601b2e80f7390fe195df5
background_status	string		Background Status:0=Enabled, 1=Denied by User, 2=Disabled by Policy, 3=Device not supported, 4=OS not supported, 5=Unknown
battery_level	long	15 99
battery_level	long	15 99
blocked_reasons	array of strings	2
blocked	boolean	2
cellular_technology	string	GSM
client_id	long	1073741831
client_name	string	com.mobileiron
client_build_date	date	Aug 29 2013 13:02:18
client_version	string	5.7.0.1.17R
client_version	string	5.7.0.1.17R
comment	string
noncompliance_reasons	array of strings	3
compliant	boolean	3
creation_date	date
current_country_code	string	US
current_country_name	string	United States
current_operator_name	string	AT&T
current_phone_number	string	PDA
data_protection_enabled	boolean
data_protection_reasons	array of strings
device_admin_enabled	boolean
device_is_compromised	boolean
device_space_ids	array of long values
device_space_name	string
device_space_path	string
display_size	string	1184X768 768x1280
display_size	string	1184X768 768x1280
eas_last_sync_time	date
ethernet_mac	string	10DDB1F23C06
home_country_code	string	FR
home_country_name	string	France
home_operator_name	string	France Telecom
home_phone_number	string	PDA
id	long	5
imei	string


imsi	string
ip_address	string	169.254.80.80, fe80::7091:fe10:7d67:ed67 172.16.2.123
ip_address	string	169.254.80.80, fe80::7091:fe10:7d67:ed67 172.16.2.123
language	string	English
language_id	long
lang_country_id	long	5
last_connected_at	date	Internal business logic is used to determine which timestamp gets indexed.
locale	string	en-US es-US
locale	string	en-US es-US
location_last_captured_at	date	1383608236206
location	geo_point	37.396003 -122.056255
location	geo_point	37.396003 -122.056255
manufacturer	string	Apple
memory_capacity	long	832.44M 3220754432
memory_capacity	long	832.44M 3220754432
memory_free	long	326.89M 1802539008
memory_free	long	326.89M 1802539008
mdm_managed	boolean	t
mdm_tos_accepted	boolean	true
mdm_to_accepted_date	date	1418672009316
model	string	iPad, 4th gen
model_name	string	Virtual Machine
model_name	string	Virtual Machine
os_version	string	iPhone OS 6.1.3 (10B329) 17 8.0.10327.77 6.1.3



owner	string	f
pending_device_passcode	string	123456
pending_device_passcode_expiration_time	date
platform_name	string	iOS 7.1
platform	string	I
processor_architecture	string	ARM armeabi-v7a 5 Intel64 Family 6 Model 58 Stepping 9



quarantined_action	long
quarantined_reasons	array of strings	32768
quarantined	boolean	32768
registration_date	date	1390244908000
registration_imsi	string	310260000000000
registration_uuid	string	c36f759717140acf AB7C0056-C1BE-4096-B630-A54376DEDA4F	This is from the miclient, a randomly generated UUID to identify registration information for this miclient.

Android-Only Device Search Fields

Field name format:

"android.<field_name>"

Field	Data Type	Sample Data	Description
admin_activated	boolean	TRUE
attestation	string	true
afw_capable	boolean	true
brand	string	google
c2dmToken	string	APA91bF0OvND3ubyu...
codename	string	REL
device	string	mako
device_roaming_flag	string	off
gcmToken	boolean	non null=true, null=false
incremental	string	573038	The firmware version on the device.
knox_version	string
manufacturer_os_version	string
mdm_enabled	boolean	TRUE
media_card_capacity	long	5803.04M
media_card_free	long	5562.67M
multi_mdm	boolean	FALSE	Indicates that there is more than one device administrator on the device.
os_build_number	string	JDQ39
os_update_status	string	OK	Indicates whether an OS update is available. Values include: Unavailable, Available, Unsupported. Status of ROM update for devices that support it.
platform_flags	string	0x3	A flag that identifies device capabilities.
samsung_dm	string
secure_apps_encryption_enabled	boolean	"Ready"
secure_apps_encryption_mode	string
secure_apps_enabled	boolean	"not enabled"	Indicates whether secure apps are enabled on the device.
security_detail	string	"0"	A bitmask, 32 bit hex number, representing all detected threads that have compromised the device.
usb_debugging	boolean	off
zebra_ota_capable	boolean	true	Indicates whether the device is Zebra LifeGuard OTA capable.

iOS and OS X Device Search Fields

Field name format:

"ios.<field_name>"

Field	Data Type	Sample Data	Description
Activation Lock Bypass Code	string	JX17H-R0A7Z-E06R-X923-VUF8-81F3
Activation Lock Is Enabled	boolean	false
apnsToken	string	e43f9c41484baf6601b2e80f7390fe195df5...
BluetoothMAC	string	A88808C93459
BuildVersion	string	5.1
CarrierSettingsVersion	string	11.0
Current MCC	string	310
Current MNC	string	410
DataRoamingEnabled	boolean	false
data_protection	string
DeviceName	string	Rui's iPad
forceEncryptedBackup	boolean	TRUE
HardwareEncryptionCaps	long	3	Hardware encryption capabilities, bitfield:bit 0: block-level encryption, bit 1: file-level encryption.
help_desk_enabled	boolean
iCloud Backup Is Enabled	boolean	true
iOSBackgroundStatus	string	0	A value the client returns, indicating its status. Possible values are: 0=Enabled, 1=Denied by User, 2=Disabled by Policy, 3=Device not supported, 4=OS not supported, 5=Unknown.
ip_address	string	172.16.2.123
iPhone ICCID	string
iPhone PRODUCT	string	iPad3,4
iPhone UDID	string	b37aea9c3883e5a0ddfadab5d82d7ea2d4...
iPhone VERSION	string	10B329
iPhone MAC_ADDRESS_EN0	string	4CECE5D3A198
iPhone UserLongName	string	John Smith
iPhone UserShortName	string	John
iPhone UserID	string	BF3DDF91-3CB7-40A5-B2F4-2F0E77167113
IsDEPEnrolledDevice	boolean	true
IsDeviceLocatorServiceEnabled	boolean	true	Returns MDM data when sending a request for device information on devices running iOS 7 through the most recently released version as supported by Ivanti, Inc.
IsDoNotDisturbInEffect	boolean	true
iTunes Store Account Hash	string	EPMtjvzUBKKvhUJA9VOyvrQXkJI=
iTunesStoreAccountIsActive	boolean	false	Indicates whether the device user is logged into an active Apple App Store account on devices running iOS 7 and OS X 10.9 through the most recently released versions as supported by Ivanti, Inc.
it_policy_result	long	1
Last iCloud Backup Date	string	2014-07-25 11:58:38 PM
ModemFirmwareVersion	string	04.11.08
ProductName	string	iPad3,4
PasscodePresent	boolean	FALSE	Indicates whether an MDM passcode is present (TRUE or FALSE).
PasscodeIsCompliantWithProfiles	boolean	TRUE	Indicates whether the passcode of the MDM data user is compliant with the passcode profile (TRUE or FALSE).
PasscodeIsCompliant	boolean	TRUE
Personal Hotspot Enabled	boolean	false
security_reason_code	string	0x40000000
Supervised	boolean	FALSE
signal_strength	long	31
SIM MCC	string	310
SIM MNC	string	410
Subscriber Carrier Network	string	AT&T
Voice Roaming Enabled	boolean	N/A false true


vpn_ip_address	string
Wakeup Status	integer	0

Windows Phone and Surface Device Search Fields

Field name format:

"windows_phone.<field_name>"

Field	Data Type	Sample Data	Description
dm_client_version	double	1.3
network_adapter	string	Hyper-V Virtual Ethernet Adapter #2
processor_type	string	Intel(R) Ivanti EPMM(TM) i5-3570 CPU @ 3.40GHz
wns_channel_url	string	https://bn1.notify.windows.com/?token=AgYAAAC1r8nFA5Uhc
wp_cert_renew_timestamp	date	0	Optional. The time in OMA DM (Open Mobile Alliance Device Management) standard time format. This node and the SignedCertRenewTimeStamp node are designed to reduce the risk of the certificate being used by another phone. The phone records the time that the new certificate was created. Supported operation is Get.
wp_ent_dm_id	long	0	Optional. Character string that contains the device ID. This node and the nodes CertRenewTimeStamp and SignedCertRenewTimeStamp can be used by the mobile device management server to verify client identity, so as to update the registration record after the phone certificate is renewed. The phone signs the EntDMID with the old client certificate during the certificate renewal process, and saves the signature locally. Supported operation is Get.
wp_exchange_id	string	37D9EC65D7F9CC35AF5B8B944256361A
wp_firmware_version	string	3045.0000.1328.2046
wp_hardware_version	string	1.0.0.0
wp_local_time	date	2013-10-22T20:08:07.0000258-04:00
wp_processor_type	long	0
wp_signed_ent_dm_id	long	0
wp_management_service_address	string
wp_mpns_notification_uri	string
wp_os_platform	string
wp_radio_swv	string
wp_publisher_device_id	string
wp_ent_device_name	string

User-Related Device Search Fields

The set of user-related device search fields include:

local user search fields

LDAP search fields

Local User Device Search Fields

Field name format:

"user.<field_name>"

Field	Data Type	Sample Data
email_address	string	[email protected]

LDAP-User Device Search Fields

LDAP-related search fields include:

basic LDAP-related device search fields

groups

Basic LDAP-User Device Search Fields

Field name format:

"user.ldap.<field_name>"

Field	Data Type
attr_dn	string
dn	string
locale	string
principal	string
upn	string

LDAP User-Attributes Device Search Fields

Field name format:

"user.ldap.user_attributes.<field_name>"

Field	Data Type
custom1	string
custom2	string
custom3	string
custom4	string
	string
	string
	string
	string
<dynamically created user-attribute field names>	array of strings

LDAP-Group Device Search Fields

Field name format:

"user.ldap.groups.<field_name>"

Field	Data Type
dn	string
name	string

Value Enumerations

Values for the "platform" Device Search Field

Value
Android
iOS
OS X
Windows
Windows Phone

Values for the "platform_name" Device Search Field

Value
Android
Android 1.6
Android 2.0
Android 2.0.1
Android 2.1
Android 2.2
Android 2.3
Android 3.0
Android 3.1
Android 4.0
Android 4.0.1
Android 4.0.2
Android 4.0.4
Android 4.1
Android 4.2
Android 4.3
Android 4.4
AppleTV
AppleTV 7.0
BlackBerry
iOS
iOS 4.0
iOS 4.1
iOS 4.2
iOS 4.3
iOS 5.0
iOS 5.1
iOS 6.0
iOS 6.1
iOS 7.0
iOS 7.1
OS X
OS X 10.7
OS X 10.8
OS X 10.9
Web App Platform
Windows
Windows 10
Windows 8.1
Windows Phone
Windows Phone 8
Windows Phone 8.1

Values for the "status" Device Search Field

Enum Name	Meaning
ACTIVE	Active
BLOCKED	Blocked
IENROLL_VERIFIED	Enrollment verified
IENROLL_INPROGRESS	Enrolling
IENROLL_COMPLETE	Enrolled
INFECTED	Infected
LOST	Lost
RETIRED	Retired
VERIFIED	Verified
VERIFICATION_PENDING	Pending
EXPIRED	Expired
WIPED	Wiped
WIPE_PENDING	Wipe pending
UNKNOWN	Unknown status

Values for the "owner" Device Search Field

Name	Meaning
COMPANY	Company-owned device
EMPLOYEE	Employee-owned (personal) device

Array Value Enumerations

Values for the "blocked_reasons", "noncompliance_reasons", and "quarantined_reasons" Device Search Fields

Each of the fields that use these values have an associated field to determine whether any reasons were set or not. For example, if a device is blocked, then the "blocked_reasons" field has a list of reasons, and the "blocked" field is 'true'.

Enum Name	Meaning	Hexadecimal Value
ALLOWED_APP_CONTROL	Allowed app control policy is out of compliance	0x004000
APP_CONTROL	App control policy is out of compliance	0x000040
ATTESTATION_FAILED	Attestation failed.	0x010000
AUTO_BLOCK	Device is not registered	0x000100
COMPROMISED	Device state is compromised	0x000001
DATA_PROTECTION	Data Protection is not enabled	0x000008
DEVICE_ADMIN_DEACTIVE	Device administrator is deactivated	0x000800
DEVICE_OUT_OF_CONTACT	Phone is out of contact	0x000020
DISALLOWED_APP_CONTROL	Disallowed app control policy is out of compliance	0x001000
EXCHANGE	Exchange-reported	0x000400
HW_VERSION	Hardware revision is not allowed	0x000004
LOGGED_OUT	User logged out	0x008000
MANUAL	Device is manually blocked	0x000200
OS_VERSION	OS version is less than the supported OS version	0x000002
PER_MAILBOX_LIMIT	Device exceeds per mailbox limit	0x000080
POLICY_OUT_OF_DATE	Policy is out of date	0x000010
REQUIRED_APP_CONTROL	Required app control policy is out of compliance	0x002000
UNKNOWN	Unknown reason	0x400000