3.1 Tables

3.1.1 ANALYSIS.FILE_SCAN_ENTRIES

Table 3-1 File Scan Summary Entries Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_time

datetime2(3)

timestamp without time zone

Time when file content was scanned

fullpath

nvarchar(max)

text

Full UNC path to the file

fullpath_hash

binary(20)

bytea

SHA-1 hash of lowercase fullpath

content_hash

binary(32)

bytea

SHA-2 hash of file content

size

bigint

bigint

File size

modify_time

datetime2(2)

timestamp without time zone

Last write time of file

classification

nvarchar(64)

varchar(64)

Classification name

category

nvarchar(64)

varchar(64)

Category name

search_pattern_name

nvarchar(64)

varchar(64)

Search pattern name

search_pattern_string

nvarchar(1024)

varchar(1024)

Search pattern string

match_count

int

int

Number of matches for Search Pattern on this path

match_confidence

int

int

  • 1 = Low
  • 2 = Medium
  • 3 = High

job_id

int

int

File content scan job ID

job_definition

nvarchar(64)

varchar(64)

Job definition name

status_code

int

int

Processing status code for this file entry

3.1.2 MS365.DRIVE_ITEM_TYPES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

item_type

int

int

  • 0 = unknown
  • 1 = file
  • 2 = folder
  • 3 = remote_item

item_type_name

nvarchar(32)

varchar(32)

item type description

3.1.3 MS365.DRIVE_ITEMS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_id

bigint

bigint

Reference to primary key in ms365.drive_scans

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

ms365_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated drive

ms365_parent_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for parent path

created_by

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated identity

create_time

datetime2(3)

timestamp

Create time for entry

item_type

int

int

  • 0 = unknown
  • 1 = file
  • 2 = folder
  • 3 = remote item

file_hash

varbinary(64)

bytea

Files only - QuickXorHash of entry

See: https://docs.microsoft.com/en-us/graph/api/resources/hashes?view=graph-rest-1.0

child_count

bigint

bigint

Folders only – number of child entries in the folder (only includes one level deep, not recursive)

modified_by

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated identity

modify_time

datetime2(3)

timestamp

Last modified time

name

nvarchar(256)

varchar(256)

Name of entry

file_extension

nvarchar(32)

varchar(32)

File name extension

size

bigint

bigint

Size in bytes

web_url

nvarchar(max)

text

Full path to item

web_url_hash

varbinary(32)

bytea

sha-256 hash of web_url

3.1.4 MS365.DRIVE_SCANS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

drive_id

bigint

bigint

Reference to primary key in ms365.drives

scan_status

int

int

  • 0 = Queued
  • 1 = In progress
  • 2 = Completed
  • 3 = Failed
  • 99 = Canceled

scan_state

int

int

  • 0 = Pending
  • 1 = Current
  • 99 = Marked for cleanup

delegated_time

datetime2(3)

timestamp

Time at which scan was requested

start_time

datetime2(3)

timestamp

Time when scan started

stop_time

datetime2(3)

timestamp

Time when scan stopped

scan_progress_data

nvarchar(max)

text

JSON data with scan progress details

agent_name

nvarchar(256)

varchar(256)

Name of Agent365 server performing the scan

3.1.5 MS365.DRIVE_SCANS_HISTORY

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

scan_id

bigint

bigint

Reference to primary key in ms365.drive_scans

start_time

datetime2(3)

timestamp

Drive scan start time

stop_time

datetime2(3)

timestamp

Drive scan stop time

drive_id

bigint

bigint

Reference to primary key in ms365.drives

drive_name

nvarchar(256)

varchar(256)

Drive name

web_url

nvarchar(max)

text

Full path to drive

ms365_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

scan_progress_status

nvarchar(max)

text

JSON data with scan progress details

agent_name

nvarchar(256)

varchar(256)

Name of Agent365 server that performed the scan

scan_status

int

int2 = Completed

  • 0 = Queued
  • 1 = In progress
  • 2 = Completed
  • 3 = Failed
  • 99 = Canceled

scan_state

int

int

  • 0 = Pending
  • 1 = Current
  • 99 = Marked for cleanup

result_string

nvarchar(max)

text

Success or error message

3.1.6 MS365.DRIVES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants table

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

name

nvarchar(256)

varchar(256)

Drive name

ms365_owner_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

quota

nvarchar(256)

varchar(256)

JSON data including quota details

web_url

nvarchar(max)

text

Full web path to drive

drive_type

nvarchar(64)

varchar(64)

Known values in MS GraphAPI include

  • business

  • documentLibrary

See: https://docs.microsoft.com/en-us/graph/api/resources/drive?view=graph-rest-1.0

3.1.7 MS365.GROUP_DRIVES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_group_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated group

ms365_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated drive

3.1.8 MS365.GROUP_MEMBER_TYPES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

member_type

int

int

  • 0 = direct
  • 1 = transitive

member_type_name

nvarchar(32)

varchar(32)

Member type description

3.1.9 MS365.GROUP_MEMBERS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_group_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated group

ms365_member_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated member

member_type

int

int

  • 0 = direct
  • 1 = transitive

3.1.10 MS365.GROUP_SITES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_group_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated group

ms365_site_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated SharePoint site

3.1.11 MS365.GROUPS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

display_name

nvarchar(256)

varchar(256)

Friendly name of group

group_types

nvarchar(64)

varchar(64)

One or more of the following from MS GraphAPI:

  • Unified

  • DynamicMembership

  • [empty string]

See: https://docs.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0

onprem_sid

varbinary(68)

bytea

On-premises Security Identifier (SID)

onprem_dnsdomain

nvarchar(256)

varchar(256)

On-premises DNS domain

onprem_netbios

nvarchar(256)

varchar(256)

On-premises NetBIOS domain

onprem_samaccount

nvarchar(256)

varchar(256)

On-premises SAM Account Name

3.1.12 MS365.IDENTITY_TYPES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

identity_type

int

int

  • 0 = unknown
  • 1 = user
  • 2 = group
  • 3 = device
  • 4 = application

identity_type_name

nvarchar(32)

varchar(32)

Identity type description

3.1.13 MS365.JOBS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

int

int

Primary key

tenant_id

int

int

Reference to primary key in ms365.tenants

start_time

datetime2(3)

timestamp

Time job started

stop_time

datetime2(3)

timestamp

Time job stopped

job_status

int

int

  • 0 = Queued
  • 1 = In progress
  • 2 = Completed
  • 3 = Failed
  • 99 = Canceled

job_progress_data

nvarchar(max)

text

JSON data with job progress details

agent_name

nvarchar(256)

varchar(256)

Agent365 server performing the scan

3.1.14 MS365.JOBS_HISTORY

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

int

int

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

tenant_name

nvarchar(256)

varchar(256)

Associated *.onmicrosoft.com tenant name

start_time

datetime2(3)

timestamp

Time when job started

stop_time

datetime2(3)

timestamp

Time when job stopped

job_status

int

int

  • 0 = Queued
  • 1 = In progress
  • 2 = Completed
  • 3 = Failed
  • 99 = Canceled

result_string

nvarchar(1024)

varchar(1024)

Success or failure message

job_progress_data

nvarchar(max)

text

JSON data with job progress details

agent_name

nvarchar(256)

varchar(256)

Agent365 server performing the scan

3.1.15 MS365.PERMISSIONS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_id

bigint

bigint

Reference to primary key in ms365.drive_scans

drive_item_id

bigint

bigint

Reference to primary key in ms365.drive_items

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

expire_time

datetime2(3)

timestamp

Timestamp when link expires

is_inherited

bit

boolean

  • true = inherited
  • false = not inherited

has_password

bit

boolean

This currently applies only to Anonymous sharing links

grantedto_id_type

nvarchar(64)

varchar(64)

One of:

  • user

  • application

  • device

grantedto_ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated trustee

grantedto_display_name

nvarchar(256)

varchar(256)

Friendly name of trustee

invite_email

nvarchar(256)

varchar(256)

Email address of recipient (trustee)

invite_sentby_ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated sender

invite_sentby_display_name

nvarchar(256)

varchar(256)

Friendly name of sender

invite_signin_required

bit

boolean

  • true = sign-in required
  • false = sign-in not required

link_app_display_name

nvarchar(256)

varchar(256)

Friendly name of application

link_app_ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated application

link_type

nvarchar(32)

varchar(32)

One of:

  • view

  • edit

See: https://docs.microsoft.com/en-us/graph/api/resources/sharinglink?view=graph-rest-1.0

link_scope

nvarchar(32)

varchar(32)

One of the following from MS GraphAPI:

  • anonymous

  • organization

See: https://docs.microsoft.com/en-us/graph/api/resources/sharinglink?view=graph-rest-1.0

link_prevents_download

bit

boolean

true = view only (download not allowed)

roles

nvarchar(128)

varchar(128)

One of the following from MS GraphAPI:

  • read

  • write

  • sp.full control

See: https://docs.microsoft.com/en-us/graph/api/resources/permission?view=graph-rest-1.0

3.1.16 MS365.SHARING_LINK_MEMBERS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

permission_id

bigint

bigint

Reference to primary key in ms365.permissions

scan_id

bigint

bigint

Reference to primary key in ms365.drive_scans

display_name

nvarchar(256)

varchar(256)

Friendly name of member

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated member

3.1.17 MS365.SITE_DRIVES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_site_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated SharePoint site

ms365_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated drive

3.1.18 MS365.SITES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

ms365_parent_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated parent site

display_name

nvarchar(256)

varchar(256)

Friendly name of SharePoint site

name

nvarchar(256)

varchar(256)

Site name

is_root

bit

boolean

  • true = root site (no parent sites)
  • false = child site

web_url

nvarchar(max)

text

Full path to SharePoint site

3.1.19 MS365.TEAM_CHANNELS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

team_id

bigint

bigint

Reference to primary key in ms365.teams

display_name

nvarchar(256)

varchar(256)

Friendly name of channel

web_url

nvarchar(256)

varchar(256)

Full path to channel

ms365_files_folder_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated path

ms365_files_folder_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated path’s drive

3.1.20 MS365.TEAMS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

display_name

nvarchar(256)

varchar(256)

Friendly name of team

visibility

int

int

  • 0 = private
  • 1 = public

web_url

nvarchar(max)

text

Full path to team

3.1.21 MS365.TENANTS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

int

int

Primary key

tenant_name

nvarchar(256)

varchar(256)

Official registered tenant name ending with ‘.onmicrosoft.com’

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

display_name

nvarchar(256)

varchar(256)

Tenant display name

default_name

nvarchar(256)

varchar(256)

Optionally registered DNS name set as the “default” e.g. corp.example.com

3.1.22 MS365.USER_DRIVES

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_user_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated user

ms365_drive_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI for associated drive

3.1.23 MS365.USERS

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

job_id

int

int

Reference to primary key in ms365.jobs

tenant_id

int

int

Reference to primary key in ms365.tenants

last_update

datetime2(3)

timestamp

Last update time for database entry

ms365_id

nvarchar(256)

varchar(256)

Unique id provided by MS GraphAPI

display_name

nvarchar(256)

varchar(256)

Display name – typically First Last name

upn

nvarchar(1024)

varchar(1024)

User Principal Name

given_name

nvarchar(64)

varchar(64)

First name

surname

nvarchar(64)

varchar(64)

Last name

onprem_sid

varbinary(68)

bytea

On-premises Security Identifier (SID)

onprem_dn

nvarchar(max)

text

On-premises distinguished name

onprem_upn

nvarchar(1024)

varchar(1024)

On-premises User Principal Name

onprem_dnsdomain

nvarchar(256)

varchar(256)

On-premises DNS domain name

onprem_samaccount

nvarchar(256)

varchar(256)

On-premises SAM Account Name

onprem_immutable_id

nvarchar(256)

varchar(256)

Unique id mapping synced on-prem user to associated MS365 user

account_enabled

bit

boolean

Account is enabled

user_type

nvarchar(64)

varchar(64)

Known values from MS GraphAPI include:

  • Member

  • Guest

See: https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0

creation_type

nvarchar(64)

varchar(64)

Known values from MS GraphAPI include:

  • [null]

  • Invitation

  • LocalAccount

  • EmailVerified

See: https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0

3.1.24 SRS.AD_MEMBERSHIPS

Table 3-2 Active Directory Memberships Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

group_id

integer

integer

 

member_id

integer

integer

 

3.1.25 SRS.AD_OBJECTS

Table 3-3 Active Directory Objects Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

integer

integer

Primary key

name

nvarchar(256)

varchar(256)

SAM Account Name

fdn

nvarchar(512)

varchar(512)

Full distinguished object name

domain

nvarchar(256)

varchar(256)

Domain name

guid

binary(16)

bytea

Globally Unique Identifier

sid

varbinary(68)

bytea

Security Identifier

object_type

integer

integar

  • 0 = Unknown / Other
  • 1 = User
  • 2 = Group
  • 3 = Computer

identity_system_id

integer

integer

Reference to primary key of identity systems table

3.1.26 SRS.IDENTITY_SYSTEMS

Table 3-4 Identity Systems Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

integer

integer

Primary key

type

integer

integer

  • 0 = Unknown
  • 1 = Active Directory
  • 2 = eDirectory
  • 3 = Windows Local

name

nvarchar(256)

varchar(256)

  • Identity system name
  • eDirectory - Tree name
  • Active Directory – Forest FDN

domain

nvarchar(256)

varchar(256)

Active Directory domain

proxy_account

nvarchar(256)

varchar(256)

 

is_primary

bit

boolean

  • 0 = Not the primary identity system
  • 1 = Primary identity system for authentication

is_managed

bit

boolean

  • 0 = Not managed (member server, built-in domain, etc.)
  • 1 = Managed, configured system

last_modified

datetime2(0)

timestamp without timezone

 

3.1.27 SRS.NTFS_ACES

Table 3-5 NTFS ACEs Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_data_id

bigint

bigint

Reference to scan_data table

flags

smallint

smallint

  • 0x1 = Object Inherit
  • 0x2 = Container Inherit
  • 0x4 = No Propagate
  • 0x8 = Inherit Only
  • 0x10 = Inherited
  • 0x40 = Successful Access
  • 0x80 = Failed Access

ace_type

smallint

smallint

  • 0 = Access Allowed
  • 1 = Access Denied
  • 2 = System Audit
  • 9 = Allowed Callback
  • 10 = Denied Callback
  • 13 = System Audit Callback
  • 17 = System Mandatory Label

access_mask

integer

integer

  • 0x1 = Read Data / List Directory
  • 0x2 = Write Data / Create File
  • 0x4 = Append Data / Create Subdirectory
  • 0x8 = Read Extended Attributes
  • 0x10 = Write Extended Attributes
  • 0x20 = File Execute / Traverse
  • 0x40 = Delete Child
  • 0x80 = Read Attributes
  • 0x100 = Write Attributes
  • 0x10000 = Delete
  • 0x20000 = Read Permissions
  • 0x40000 = Change Permissions0x80000 = Change Owner
  • 0x100000 = Synchronize
  • 0x1000000 = Access System Security
  • 0x10000000 = Generic All
  • 0x20000000 = Generic Execute
  • 0x40000000 = Generic Write
  • 0x80000000 = Generic Read

sid

varbinary(68)

bytea

Trustee SID

index_on_disk

smallint

smallint

Discovered order of this ACE for the associated entry as read from the file system

canonical_index

smallint

smallint

Preferred order in which ACE should appear for the associated entry

3.1.28 SRS.SCANS

Table 3-6 Scans Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_policy_id

integer

integer

Reference to scan_policies table

triggered_start_time

datetime2(3)

timestamp without time zone

Initial time scan delegation starts

scan_start_time

datetime2(3)

timestamp without time zone

Start time when agent begins physical scan

scan_stop_time

datetime2(3)

timestamp without time zone

Stop time when agent completes physical scan

enum_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to file system object enumeration

enum_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to file system object enumeration

enum_file_count

integer

integer

Agent metrics related to file system object enumeration

enum_directory_count

integer

integer

Agent metrics related to file system object enumeration

enum_link_count

integer

integer

Agent metrics related to file system object enumeration

caching_start_time

datetime2(3)

timestamp without time zone

Metrics related to agent caching

caching_stop_time

datetime2(3)

timestamp without time zone

Metrics related to agent caching

cached_file_count

integer

integer

Metrics related to agent caching

cached_directory_count

integer

integer

Metrics related to agent caching

cached_link_count

integer

integer

Metrics related to agent caching

cache_size

integer

integer

Metrics related to agent caching

cache_size_max

integer

integer

Metrics related to agent caching

metadata_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to filesystem metadata collection

metadata_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to filesystem metadata collection

metadata_file_count

integer

integer

Agent metrics related to filesystem metadata collection

metadata_directory_count

integer

integer

Agent metrics related to filesystem metadata collection

metadata_link_count

integer

integer

Agent metrics related to filesystem metadata collection

accounts_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to security principal collection

accounts_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to security principal collection

accounts_object_count

integer

integer

Agent metrics related to security principal collection

transfer_start_time

datetime2(3)

timestamp without time zone

Related to transfer of scan file from the Agent to the Engine

transfer_stop_time

datetime2(3)

timestamp without time zone

Related to transfer of scan file from the Agent to the Engine

db_start_time

datetime2(3)

timestamp without time zone

Database insert start time*

db_stop_time

datetime2(3)

 

Database insert stop time*

scan_type

integer

integer

  • 0 = None
  • 1 = File System Data
  • 2 = Permissions
  • 4 = Volume Free Space

scan_target_id

integer

integer

Reference to scan_targets table

local_identity_system_id

integer

integer

 

retry_count

integer

integer

Current number of scan attempts

status_code

integer

integer

Internal status code

error_string

nvarchar(1024)

varchar(1024)

 

progress_status

integer

integer

  • -2 = Waiting for retry
  • -1 = Ready for cleanup
  • 0 = Waiting for delegation
  • 1 = Delegated / scan in progress
  • 2 = Scan file transfer in progress
  • 3 = Database update in progress
  • 4 = Current - scan process complete
  • 5 = Database update pending
  • 6 = Previous
  • 7 = Retained

next_retry_time

datetime2(0)

timestamp without time zone

Next scheduled time to retry a failed scan

ntfs_abe_enabled

bit

boolean

Flag indicating that the Windows share has ABE enabled

is_valid

bit

boolean

[Deprecated]

agent_name

nvarchar(256)

varchar(256)

 

* Database insert times do not include security equivalence, group membership, or eDirectory Directory Service trustee processing, all of which runs in the background.

3.1.29 SRS.SCAN_DATA

Table 3-7 Scan Data Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_id

integer

integer

Reference to scans table

path_type

integer

integer

  • 0 = Unknown
  • 1 = File
  • 2 = Directory
  • 3 = File Symbolic Link
  • 4 = Directory Symbolic Link
  • 5 = Junction
  • 6 = Mount Point
  • 7 = Share
  • 8 = Volume
  • 9 = DFS Link
  • 10 = DFS Folder
  • 11 = DFS Root
  • 12 = HSM Stub
  • 13 = Reparse Point Unknown
  • 17 = Single Instance Storage Stub
  • 18 = Named Stream

is_link

bit

boolean

Flag indicating entry is a link (symlink, hardlink, etc.)

name

nvarchar(256)

varchar(256)

File or directory name

fullpath

nvarchar(max)

text

Full UNC path to the file system entry

fullpath_hash

binary(20)

bytea

SHA-1 hash of lowercase fullpath

filename_extension

nvarchar(32)

varchar(32)

Extensions having more than 32 characters are treated as if they have none

owner_id

varbinary(68)

bytea

Maps to either a GUID or a SID

attributes

integer

integer

  • 0x0 = None
  • 0x1 = Read Only
  • 0x2 = Archive
  • 0x4 = System
  • 0x8 = Hidden
  • 0x10 = Directory
  • 0x20 = Compressed
  • 0x40 = Offline
  • 0x80 = NTFS device
  • 0x100 = NTFS Normal
  • 0x200 = NTFS Temporary
  • 0x400 = NTFS Sparse File
  • 0x800 = NTFS Reparse Point
  • 0x1000 = NTFS Not content indexed
  • 0x2000 = NTFS Encrypted
  • 0x4000 = NTFS Virtual

create_time

datetime2(0)

timestamp without time zone

 

modify_time

datetime2(0)

timestamp without time zone

 

access_time

datetime2(0)

timestamp without time zone

 

size

bigint

bigint

For files, actual size; for directories, accumulative size of all subordinate files

size_on_disk

bigint

bigint

Assumes typical allocation unit size of 4K

size_compressed

bigint

bigint

Only accurate for NTFS file systems

idx

integer

integer

Scan index; unique per scan

parent_idx

integer

integer

Parent index. Used for hierarchical relation processing

path_depth

integer

integer

Entry depth with respect to the scan target’s root path

ns_left

integer

integer

Nested-set Left index – used for hierarchical relation processing

ns_right

integer

integer

Nested-set Right index – used for hierarchical relation processing

status_code

integer

integer

 

3.1.30 SRS.SCAN_DIRECTORY_DATA

Table 3-8 Scan Directory Data Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_data_id

bigint

bigint

Reference to scan_data table

file_count

integer

integer

Count of all files subordinate to this directory

directory_count

integer

integer

Count of all subdirectories

directory_quota

bigint

bigint

Directory quota for this directory

directory_quota_flags

integer

integer

  • 0 = Unknown
  • 1 = Enforced
  • 2 = Disabled
  • 4 = Incomplete
  • 8 = Rebuilding

child_file_count

integer

integer

Count of all immediately subordinate files

child_link_count

integer

integer

Count of all immediately subordinate links

child_directory_count

integer

integer

Count of all immediately subordinate directories

child_size

bigint

bigint

Size of all immediately subordinate files

child_size_on_disk

bigint

bigint

Size on disk of all immediately subordinate files (assumes 4K allocation size)

child_size_compressed

bigint

bigint

Size on disk of all immediately subordinate compressed files (only accurate with NTFS)

child_link_size

bigint

bigint

Size of all immediately subordinate links

3.1.31 SRS.SCAN_HISTORY

Table 3-9 Scan History Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

integer

integer

Primary key

identity_system

nvarchar(256)

text

Identity system associated with this scan target

scan_target

nvarchar(1024)

text

UNC path of scan target

file_size

bigint

bigint

Total aggregate size of all files

file_count

integer

integer

Total count of all files

directory_count

integer

integer

Total count of all directories

scan_policy_name

nvarchar(64)

varchar(64)

Scan policy associated with this scan

agent_name

nvarchar(256)

text

 

scan_id

integer

integer

Scan ID

scan_type

integer

integer

  • 0 = None
  • 1 = File System Data
  • 2 = Permissions
  • 4 = Volume Free Space

triggered_start_time

datetime2(3)

timestamp without time zone

Initial time scan delegation starts

scan_start_time

datetime2(3)

timestamp without time zone

Start time when agent begins physical scan

scan_stop_time

datetime2(3)

timestamp without time zone

Stop time when agent completes physical scan

enum_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to file system object enumeration

enum_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to file system object enumeration

enum_file_count

integer

integer

Agent metrics related to file system object enumeration

enum_directory_count

integer

integer

Agent metrics related to file system object enumeration

enum_link_count

integer

integer

Agent metrics related to file system object enumeration

caching_start_time

datetime2(3)

timestamp without time zone

Metrics related to agent caching

caching_stop_time

datetime2(3)

timestamp without time zone

Metrics related to agent caching

cached_file_count

integer

integer

Metrics related to agent caching

cached_directory_count

integer

integer

Metrics related to agent caching

cached_link_count

integer

integer

Metrics related to agent caching

cache_size

integer

integer

Metrics related to agent caching

cache_size_max

integer

integer

Metrics related to agent caching

metadata_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to filesystem metadata collection

metadata_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to filesystem metadata collection

metadata_file_count

integer

integer

Agent metrics related to filesystem metadata collection

metadata_directory_count

integer

integer

Agent metrics related to filesystem metadata collection

metadata_link_count

integer

integer

Agent metrics related to filesystem metadata collection

accounts_start_time

datetime2(3)

timestamp without time zone

Agent metrics related to security principal collection

accounts_stop_time

datetime2(3)

timestamp without time zone

Agent metrics related to security principal collection

accounts_object_count

integer

integer

Agent metrics related to security principal collection

transfer_start_time

datetime2(3)

timestamp without time zone

Related to transfer of scan file from the Agent to the Engine

transfer_stop_time

datetime2(3)

timestamp without time zone

Related to transfer of scan file from the Agent to the Engine

db_start_time

datetime2(3)

timestamp without time zone

Database insert start time*

db_stop_time

datetime2(3)

 

Database insert stop time*

status_code

integer

integer

Internal status code

error_string

nvarchar(1024)

varchar(1024)

 

3.1.32 SRS.SCAN_TARGETS

Table 3-10 Scan Targets Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

network_path

nvarchar(256)

varchar(256)

Root path for scan target

network_path_lower

nvarchar(256)

[ Not applicable ]

Computed column

server

nvarchar(256)

varchar(256)

 

identity_system_id

integer

integer

Reference to identity_systems table

platform

smallint

smallint

  • 0 = Unknown
  • 1 = Windows

filesystem

smallint

smallint

  • 0 = Unknown
  • 1 = NTFS

cost_per_unit

money

money

Not currently used

3.1.33 SRS.SECURITY_DESCRIPTORS

Table 3-11 Security Descriptors Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

bigint

bigint

Primary key

scan_data_id

bigint

bigint

Reference to scan data table

control

integer

integer

Security descriptor control flags

dacl_present

bit

boolean

Indicates presence of DACL entries for this security descriptor

sacl_present

bit

boolean

Indicates presence of SACL entries for this security descriptor

3.1.34 SRS.TREND_VOLUME_FREESPACE

Table 3-12 Trend Volume Freespace Table Definition

Column Name

SQL Server Data Type

PostgreSQL Data Type

Notes

id

integer

integer

Primary key

scan_id

integer

integer

Scan ID

identity_system

nvarchar(256)

text

 

network_path

nvarchar(max)

text

Scan target path

server

nvarchar(256)

text

 

filesystem

integer

integer

  • 0 = Unknown
  • 1 = NTFS

volume_guid

uniqueidentifier

uuid

 

volume_label

nvarchar(256)

text

 

volume_bytes_total

bigint

bigint

 

volume_bytes_free

bigint

bigint

 

volume_bytes_used

bigint

bigint

 

allocation_unit_size

integer

integer

 

allocation_units_total

bigint

bigint

 

allocation_units_free

bigint

bigint

 

allocation_units_used

bigint

bigint

 

status

integer

integer

 

scan_time

datetime2(0)

timestamp without time zone