DEEM Data Definitions

Use these Digital Employee Experience Management (DEEM) desktop telemetry data definitions and lists of available data fields to help you analyze DEEM specific widgets in dashboards and in the DEEM Solutions area in Workspace ONE Intelligence for your Windows and macOS devices.

Variances between Windows and macOS

The events and data fields listed in the tables vary slightly between the Windows and macOS platforms.

What Category identifies DEEM data?

When working in Dashboard widgets in Workspace ONE Intelligence, look for the Employee Experience category.

Events

Event Category Event Name
Apps Application Start
Application Change
Application Crash
Application Hang
Application Foreground
Application Exit
Asset Info NA
Device Performance Performance Counters
Devices Boot
Shutdown
System Crash
Unexpected Shutdown
Display Screen Saver On
Screen Saver Off
Sleep
Wake
Network net_event_l2_connected
net_event_l2_disconnected
net_event_l2_reconfigured
net_event_l2_statistics
Network Adapters NA
OS Updates Patch Install
Patch Uninstall
Services Service Installed
Service Removed
Service Start
Service Stop
Service Group Start
Service Group Stop
User Actions Lock
Logon
Logout
Unlock

Common fields

Data Field Notes
Device Make NA
Device Model NA
Device Name NA
Device Serial Number NA
Event Name Example: Application Crash, Boot, System Crash
Event Status A few events have Request and Complete status.

Use Request to see details when an event is started.

Use Complete to see details when event is completed.
OS Major version NA
OS Minor Version NA
OS Name Version The friendly name of the OS.

Example: Microsoft Windows Enterprise.
OS Version Example: 10.0.16299
Platform Example: Windows or macOS
User NA

Apps

Data Field Definition
Activation Time The activation time for application focus.
Application End Time The time when the application stops.
Application Install Path The installation path of the application.
Application Name The name of the executable file of the application.
This field is present for legacy applications.
Duration in Milliseconds This field provides the total time an application was in the foreground in an application Foreground Event. Use the Sum operator to know the total time of application usage.
Exception Code Exception code in an application crash event.
Exception Offset The offset of the crash module in the application. This field is applicable to Application Crash events.
Module The module name within an application.
Module Path The module installation path.
Module Version The module version.
This version can be different than the application version.
Package Name The friendly name of the application.
Object Type The type of the application. Values can be Application, Driver, and Service.
Package Publisher The application publisher name.
Package Version The application version.
Up Time in Milliseconds The time the application is active, from when it starts to stops.

Asset information

Data Field Definition
BIOS Timestamp Indicates that the asset's BIOS updated data at a specific timestamp.
BIOS Version Indicates the version of the asset's BIOS.
Physical Memory Bytes Indicates the total physical memory of the asset in bytes.
Processor Lists the asset's brand of processor, and it lists the vendor and the model.
System Type Indicates the asset's system processor architecture type (for example x86 or ARM).
Time Zone Indicates the time zone the asset is set to.

Device performance

Data Field Definition
Battery Status Charge Rate The rate at which the battery is charging.
Battery Status Discharge Rate The rate at which the battery is discharging.
Battery Status Remaining Capacity The amount of remaining battery capacity.
GPU 0 Name The name of GPU #0.
GPU 0 Usage The usage as a percentage of GPU #0.
GPU 1 Name The name of GPU #1.
GPU 1 Usage The usage as a percentage of GPU #1.
GPU 2 Name The name of GPU #2.
GPU 2 Usage The usage as a percentage of GPU #2.
Logicaldisk Free Space (Megabytes) The hard disk free space in megabytes.
Memory Cache Faults per sec The memory cache faults per seconds. Cache Faults is a type of Page Fault.
Memory Committed Bytes in use The ratio of Memory\\Committed Bytes to the Memory\\Commit Limit.
Memory Page Faults per sec The total page faults including soft and hard.
Memory Page Reads per sec The rate at which the disk was read to resolve hard page faults.
Memory Page Writes per sec The rate at which page data is written to the disk.
Memory Pages per sec The rate at which pages are read or written to the disk to resolve hard faults.
Memory Transition Faults per sec This field provides the rate at which page faults are resolved by recovering the pages shared by other processes.
Memory Usage Percentage The overall memory usage as a percentage of the device.
Network Interface Packets Outbound Errors The number of outbound packets that did not transmit because of errors.
Network Interface Packets Received Errors The number of inbound packets that contained errors.
Paging File Usage The percentage value of page file usages.
Physical Disk Avg Disk Bytes Queue Length The average number of IO requests in the queue waiting to be sent to the storage system.
Physical Disk Avg Disk Bytes Read The average number of bytes transferred to the disk during read operations.
Physical Disk Avg Disk Bytes Transfer Average number of bytes transferred to the disk during read/write operations.
Physical Disk Avg Disk Bytes Write The average number of bytes transferred to the disk during write operations.
Physical Disk Avg Disk Read per sec The rate at which bytes are read to the disk during read operations.
Physical Disk Avg Disk Read Queue Length The average number of read IO requests in the queue waiting to be sent to the storage system.
Physical Disk Avg Disk Transfer per sec The rate at which of bytes transferred to the disk during IO operations.
Physical Disk Avg Disk Write per sec The rate at which bytes are written to the disk during write operations.
Physical Disk Avg Disk Write Queue Length The average number of write IO requests in the queue waiting to be sent to the storage system.
Processor Total Interrupt Time The percentage time the processor spends in receiving and servicing hardware interruptions during sample intervals. A high percentage of interruptions can indicate a problem with a hardware device.
Processor Total Interrupts per sec The total interruptions per second.
Processor Total Privileged Time The percentage of time that the processor is spent executing in Kernel (or Privileged) mode.
Processor Total Processor Time The percentage of elapsed time that the processor spends executing non-idle threads.
Processor Total User Time The percentage of time that the processor spends executing in User mode.
Thermal Zone Information Throttle Reason The reasons why the thermal zone is limiting.
Thermal Zone Information Zone Temperature The CPU core temperature in Kelvin units.

Devices

Data Field Notes
Boot Drive Load in Milliseconds NA
Boot End Time NA
Crash Address Memory address of the system crash
Crash Parameters List BugCheck description of parameters
Crash Path Windows dump file location
Crashdump Type Windows Crash Dump Type
Duration in Milliseconds Boot and Shutdown duration
Error BugCheck code
Exception Code NA
Kernel load in Milliseconds NA
Load Degradation Time in Milliseconds NA
Logon Load Duration in Milliseconds NA
Logon Waiting Duration in Milliseconds NA
Main Path Load Duration in Milliseconds NA
Module Crashed module in a system crash event
PNP Load Duration in Milliseconds NA
Performance Degradation Indicates that boot or shutdown was degraded
Preshutdown in Milliseconds NA
Process Crashed process in a system crash

Display

Data Field Notes
Domain NA
Duration in Milliseconds Wake or sleep duration in milliseconds
User NA

Network

Data Field Definition
Dot11 Auth Type Lists the authentication type used to establish a connection.
Dot11 Available Modes Lists modes supported by an adapter. What displays in this list depends on the adapter’s configuration settings.

Possible values are 802.11 + and a/b/g/n/ac/ad/ax.
Dot11 BSS Available Modes Lists the available 802.11 modes on the access point that the adapter is connected to.
Dot11 BSS IPv4address Lists the IPv4 address of the access point that the adapter is connected to.
Dot11 BSS WiFi Generation Lists the latest WiFi generation supported by the access point that the adapter is connected to.
Dot11 BSS WPS Enabled Lists the WiFi protected setup (WPS) activated on an access point that the adapter is connected to.
Dot11 BSS WPS Modes Lists the WiFi protected setup modes activated on the access point that the adapter is connected to.
Dot11 BSSID Lists the MAC address of an access point.
Dot11 Channel Lists the WiFi channel used by a connection.
Dot11 Encryption Lists the encryption algorithm used by this connection.

Possible values:
None
WEP-RC4-40
WEP-RC4-104
WEP-RC4-ANY
TKIP-RC4
WPA-USE-GROUP
CCMP-AES-128
CCMP-AES-256
BIP-CMAC-128
BIP-CMAC-256
BIP-GMAC-128
BIP-GMAC-256
GCMP-AES-128
GCMP-AES-256
IHV
Dot11 Frequency Lists the values as 2.4 or 5 GHz.
Dot11 Mode Lists the 802.11 mode.

Possible values are 802.11 + and a/b/g/n/ac/ad/ax.
Dot11 RSSI Lists the signal strength in decibels-milliwatts (dBm).
Dot11 Security Standard Indicates the security standard used to establish a connection.

Possible values are:
Unknown
Open
WP
WPA Personal
WPA Enterprise
WPA2 Personal
WPA2 Enterprise
WPA3
Personal
WPA3 Enterpriser
IHV
Dot11 Signal Quality Indicates the signal quality, as a percentage, provided by Microsoft Windows.
Dot11 SSID Lists the wireless network name.
Dot11 WiFi Generation Lists the latest WiFi generation supported by the adapter.

Possible values are Wifi-1..6 and 6E.
IPv4 Addresses Lists the IPv4 addresses and subnet lengths. For example, 10.20.30.40/22.
IPv4 DHCP Enabled Indicates that IPv4 DHCP is activated for a connection.
IPv4 DHCP Server Lists the IP address of the IPv4 DHCP server that issued the connection's IP address.
IPv4 DNS Servers Lists the IPv4 DNS servers.
IPv4 Enabled Indicates that IPv4 is activated for a connection.
IPv4 Gateways Lists the IPv4 gateways.
IPv6 Addresses Lists the IPv6 addresses and subnet lengths.
IPv6 DNS Servers List the IPv6 DNS servers.
IPv6 Enabled Indicates that IPv6 is activated for a connection.
IPv6 Gateways Lists the IPv6 gateways.
L2 Avg Recv Bps Indicates the average received bytes per second over a sample period.
L2 Avg Tx Bps Indicates the average transmitted bytes per second over sample period.
L2 Connection Breadcrumb To link events together, the system generates a unique connection GUID for each connection event as indicated by the event net_event_l2_connected.

The system uses the generated GUID in subsequent events (net_event_l2_disconnected, net_event_l2_reconfigured, and net_event_l2_statistics) that are associated with a connection.
L2 Recv Bps Lists the current received link speed in bits per second.
L2 Tx Bps Lists the current transmitted link speed in bits per second.
NIC Description Identifies the network interface card.

net_event_l2_connected
net_event_l2_disconnected
net_event_l2_reconfigured
net_event_l2_statistics
NIC Type Indicates that the network is a wired Ethernet 802.1 or a wireless 802.1.

Possible values are Ethernet and Wireless.
Physical Address Lists the MAC address.

Network adapters

Data Field Definition
Driver Install Date Indicates the date a driver was installed or updated.
Driver Name Lists the installed driver name.
Driver Problem A flag that indicates that the system found an issue with a driver.
Driver Problem Description Lists the problem with a driver.
Driver Provider Lists the author of an installed driver.
Driver Published Date Indicates the date a driver was published.

On Windows, this value is the DriverVer from the INF file.
Driver Version Lists the installed driver version.
NIC Description Describes the unique adapter.
NIC Manufacturer Indicates the manufacturer. An example is Intel.
NIC Model Lists the model name of an adapter.
NIC Type Indicates that the adapter is a wired Ethernet 802.1 or a wireless 802.11.

Possible values are Ethernet and Wireless.
Physical Address List the MAC address of an adapter.

OS updates

Data Field Notes
error install_request
install_success
uninstall
ErrorCode install_failed
guid All install and uninstall events
revision_number install_request
install_success
uninstall
RevisionNumber install_failed
title install_request
install_success
uninstall

Services

Data Field Definition
Duration in Milliseconds Indicates how long the service-start/stop operation runs in milliseconds.
Group Name Lists the service group description.
Image Name Lists the service image path.
Process ID Lists the service process ID.
Service Name Indicates the service long name for the service-installed event. It also indicates the service short name of the service-start/stop event.
Service Path Lists the service image path, which is the same value as the Image Name.
Service Start Type Lists the service start type value. For example, auto start.
Service Type Lists the service type value. For example, user mode service.
Transaction Identifier Lists the transaction ID. This value is the same for the request event and the complete event for the Service Start/Stop ID .
User Lists he domain and username.

User Actions

Data Field Notes
Domain NA
Logon Type Example: Interactive
Result Success or Failure
Session User session ID
User NA
check-circle-line exclamation-circle-line close-line
Scroll to top icon