5.1 Tables

5.1.1 Tables

ad.domains

Column Name	SQL Server	PostgreSQL	Notes
id	bigint		Primary key
db_last_update	datetime2(3)	timestamp without time zone	Last update time for this entry in the database
domain_netbios	nvarchar(15)	varchar(15)	Domain NetBIOS name
domain_dns	nvarchar(256)	varchar(256)	Domain DNS name
domain_sid	varbinary(68)	bytea	Domain security identifier
forest_dns	nvarchar(2560)	varchar(256)	Forest DNS name

ad.ds_objects

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
db_domain_sid	varbinary(68)	bytea	SID of the domain itself
db_last_update	datetime2(3)	timestamp	Last update time for this entry in the database
object_guid	binary(16)	bytea	Object's GUID
object_category	nvarchar(256)	varchar(256)	Using LDAP display name, not FDN.
object_class	nvarchar(256)	varchar(256)	Only includes structural class value from this multi-value attribute.
object_sid	varbinary(68)	bytea	Object's Security Identifier
dn	nvarchar(max)	text	Distinguished name
upn	nvarchar(1024)	varchar(1024)	User principal name
sam_account_name	nvarchar(256)	varchar(256)	SAM account name
sam_account_type	integer	integer	See https://docs.microsoft.com/en-us/windows/win32/adschema/a-samaccounttype for details. Enum values: 0x00000000 - Domain 0x10000000 - Group 0x10000001 - Non-security Group object 0x20000000 - Alias object 0x20000001 - Non-security Alias object 0x30000000 - Normal User account 0x30000001 - Machine (computer) account 0x30000002 - Trust account 0x40000000 - APP_BASIC Group 0x40000001 - APP_QUERY Group
sam_principal_name	nvarchar(256)	varchar(256)	NetBIOS\SamAccountName. From msDS-PrincipalName. Note that the NetBIOS name here may be different from the associated domain NetBIOS name where this account was scanned. This is especially true for domain Builtin\* accounts and foreign security principals.
display_name	nvarchar(256)	varchar(256)
uac_flags	integer	integer	Combines both userAccessControl and msDs-User-Account-Control-Computed attribute values into a single flag. See the following for details: https://docs.microsoft.com/en-us/windows/win32/adschema/a-useraccountcontrol https://docs.microsoft.com/en-us/windows/win32/adschema/a-msds-user-account-control-computed Flags values: 0x00000001 - Logon script is executed 0x00000002 - User Account disabled 0x00000008 - Home directory required 0x00000010 - Account currently locked out 0x00000020 - No password required 0x00000040 - User cannot change password 0x00000080 - User can send encrypted password 0x00000100 - Temporary duplicate account 0x00000200 - Normal account - typical user 0x00000800 - Inter-domain trust account 0x00001000 - Computer (Workstation / Member Server) account 0x00002000 - Domain controller computer account 0x00010000 - Password does not expire 0x00020000 - Majority Node Set (MNS) logon account 0x00040000 - Smart card required for logon 0x00080000 - Service account trusted for Kerberos delegation 0x00100000 - Account not allowed trust for delegation 0x00200000 - Account can only use DES keys 0x00400000 - Account does not require Kerberos pre-authentication for logon 0x00800000 - User password has expired 0x01000000 - Account enabled for delegation 0x04000000 - Partial secrets account 0x08000000 - Account can only use Use AES keys
account_expires	datetime2(0)	timestamp
create_timestamp	datetime2(0)	timestamp
description	nvarchar(1024)	varchar(1024)	Only uses first value of this multi-value attribute
mail	nvarchar(256)	varchar(256)
given_name	nvarchar(64)	varchar(64)
surname	nvarchar(64)	varchar(64)
last_logon_timestamp	datetime2(0)	timestamp	NOTE: This attribute only has 14-day granularity. See: https://docs.microsoft.com/en-us/windows/win32/adschema/a-lastlogontimestamp
department	nvarchar(64)	varchar(64)
title	nvarchar(128)	varchar(128)
primary_group_sid	varbinary(68)	bytea	SID of referenced object
managed_by_guid	binary(16)	bytea	GUID of referenced DS object
manager_guid	binary(16)	bytea	GUID of referenced DS object
group_type	integer	integer	See https://docs.microsoft.com/en-us/windows/win32/adschema/a-grouptype for details. Flags: 0x01 - System created group 0x02 - Global group 0x04 - Domain Local group 0x08 - Universal group 0x10 - APP_BASIC group for Windows Server Authorization Manager 0x20 - APP_QUERY group for Windows Server Authorization Manager 0x80000000 - Security Group. If not set, then a Distribution Group
dns_host_name	nvarchar(2048)	varchar(2048)	Applies to Computer objects

srs.analysis.file_scan_entries

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_time	datetime2(3)	timestamp	Time when file content was scanned
fullpath	nvarchar(max)	text	Full UNC path to the file
fullpath_hash	binary(20)	bytea	SHA-1 hash of lowercase fullpath
content_hash	binary(32)	bytea	SHA-2 hash of file content
size	bigint	bigint	File size
modify_time	datetime2(2)	timestamp	Last write time of file
classification	nvarchar(64)	varchar(64)	Classification name
category	nvarchar(64)	varchar(64)	Category name
search_pattern_name	nvarchar(64)	varchar(64)	Search pattern name
search_pattern_string	nvarchar(1024)	varchar(1024)	Search pattern string
match_count	int	int	Number of matches for Search Pattern on this path
match_confidence	int	int	1 = Low 2 = Medium 3 = High
job_id	int	int	File content scan job ID
job_definition	nvarchar(64)	varchar(64)	Job definition name
status_code	int	int	Processing status code for this file entry

ms365.drive_item_types

Column Name	SQL Server	PostgreSQL	Notes
item_type	int	int	0 = unknown 1 = file 2 = folder 3 = remote_item
item_type_name	nvarchar(32)	varchar(32)	Item type description

ms365.drive_items

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_id	bigint	bigint	Reference to primary key in ms365.drive_scans
drive_id	bigint	bigint	Reference to associated drive in ms365.drives
ms365_id	nvarchar(256)	varchar(256)	Unique ID provided by MS GraphAPI
ms365_drive_id	nvarchar(256)	varchar(256)	Unique ID provided by MS GraphAPI for the associated drive
ms365_parent_id	nvarchar(256)	varchar(256)	Unique ID provided by MS GraphAPI for parent path
created_by	nvarchar(256)	varchar(256)	Unique ID provided by MS GraphAPI for the associated identity
created_by_name	nvarchar(256)	varchar(256)	Display name of the "created_by" account
create_time	datetime2(3)	timestamp	Create time for entry
item_type	integer	integer	Note: Only one of these values is set as a "primary" value for this entry as opposed to the item_facets column 0 = unknown 1 = file 2 = folder 4 = package 8 = remote item
item_facets	integer	integer	Note: All applicable flags are set for this value, as opposed to the item_type column 0 = none 1 = file 2 = folder 4 = package 8 = remote item
file_hash	varbinary(64)	varchar(64)	Files only - QuickXorHash of entry See https://docs.microsoft.com/en-us/graph/api/resources/hashes?view=graph-rest-1.0
child_count	bigint	bigint	Folders only - number of child entries in the folder Only includes immediate children, not recursive.
modified_by	nvarchar(256)	varchar(256)	Unique ID provided by MS GraphAPI for the associated identity
modified_by_name	nvarchar(256)	varchar(256)	Display name of the "modified_by" account
modify_time	datetime2(3)	timestamp	Last modified time
name	nvarchar(256)	varchar(256)	Name of entry
file_extension	nvarchar(32)	varchar(32)	File name extension
size	bigint	bigint	Size in bytes
web_url	nvarchar(max)	text	Full path to item
web_url_hash	varbinary(32)	bytea	SHA-256 hash of web_url

ms365.drive_scans

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	integer	integer	Reference to primary key in ms365.jobs
drive_id	bigint	bigint	Reference to primary key in ms365.drives
scan_status	integer	integer	0 = Queued 1 = In progress 2 = Completed 3 = Failed 99 = Canceled
scan_state	integer	integer	0 = Pending 1 = Current 99 = Marked for cleanup
delegated_time	datetime2(3)	timestamp	Time at which scan was requested
start_time	datetime2(3)	timestamp	Time when scan started
stop_time	datetime2(3)	timestamp	Time when scan stopped
scan_progress_data	nvarchar(max)	text	JSON data with scan progress details
agent_name	nvarchar(256)	varchar(256)	Name of Agent365 server performing the scan

ms365.drive_scans_history

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
scan_id	bigint	bigint	Reference to primary key in ms365.drive_scans
start_time	datetime2(3)	timestamp	Drive scan start time
stop_time	datetime2(3)	timestamp	Drive scan stop time
drive_id	bigint	bigint	Reference to primary key in ms365.drives
drive_name	nvarchar(256)	varchar(256)	Drive name
web_url	nvarchar(max)	text	Full path to drive
ms365_drive_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
scan_progress_status	nvarchar(max)	text	JSON data with scan progress details
agent_name	nvarchar(256)	varchar(256)	Name of Agent365 server that performed the scan
scan_status	int	int	0 = Queued 1 = In progress 2 = Completed 3 = Failed 99 = Canceled
scan_state	int	int	0 = Pending 1 = Current 99 = Marked for cleanup
result_string	nvarchar(max)	text	Success or error message

ms365.drives

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants table
site_id	bigint	bigint	Reference to primary key in ms365.sites table
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
name	nvarchar(256)	varchar(256)	Drive name
ms365_owner_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
quota	nvarchar(256)	varchar(256)	JSON data including quota details
web_url	nvarchar(max)	text	Full web path to drive
drive_type	nvarchar(64)	varchar(64)	Known values in MS GraphAPI include: business documentLibrary See: https://docs.microsoft.com/en-us/graph/api/resources/drive?view=graph-rest-1.0

ms365.group_drives

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_group_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated group
ms365_drive_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated drive

ms365.group_member_types

Column Name	SQL Server	PostgreSQL	Notes
member_type	int	int	0 = direct 1 = transitive
member_type_name	nvarchar(32)	varchar(32)	Member type description

ms365.group_members

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_group_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated group
ms365_member_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated member
member_type	int	int	0 = direct 1 = transitive

ms365.group_sites

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_group_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated group
ms365_site_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated SharePoint site

ms365.groups

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
display_name	nvarchar(256)	varchar(256)	Friendly name of group
email	nvarchar(256)	varchar(256)	Email address
group_types	nvarchar(64)	varchar(64)	One or more of the following from MS GraphAPI: Unified DynamicMembership [empty string] See: https://docs.microsoft.com/en-us/graph/api/resources/group?view=graph-rest-1.0
onprem_sid	varbinary(68)	bytea	On-premises Security Identifier (SID)
onprem_dnsdomain	nvarchar(256)	varchar(256)	On-premises DNS domain
onprem_netbios	nvarchar(256)	varchar(256)	On-premises NetBIOS domain
onprem_samaccount	nvarchar(256)	varchar(256)	On-premises SAM Account Name

ms365.identity_types

Column Name	SQL Server	PostgreSQL	Notes
identity_type	int	int	0 = unknown 1 = user 2 = group 3 = device 4 = application
identity_type_name	nvarchar(32)	varchar(32)	Identity type description

ms365.jobs

Column Name	SQL Server	PostgreSQL	Notes
id	int	int	Primary key
tenant_id	int	int	Reference to primary key in ms365.tenants
start_time	datetime2(3)	timestamp	Time job started
stop_time	datetime2(3)	timestamp	Time job stopped
job_status	int	int	0 = Queued 1 = In progress 2 = Completed 3 = Failed 99 = Canceled
job_progress_data	nvarchar(max)	text	JSON data with job progress details
agent_name	nvarchar(256)	varchar(256)	Agent365 server performing the scan

ms365.jobs_history

Column Name	SQL Server	PostgreSQL	Notes
id	int	int	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
tenant_name	nvarchar(256)	varchar(256)	Associated *.onmicrosoft.com tenant name
start_time	datetime2(3)	timestamp	Time when job started
stop_time	datetime2(3)	timestamp	Time when job stopped
job_status	int	int	0 = Queued 1 = In progress 2 = Completed 3 = Failed 99 = Canceled
result_string	nvarchar(1024)	varchar(1024)	Success or failure message
job_progress_data	nvarchar(max)	text	JSON data with job progress details
agent_name	nvarchar(256)	varchar(256)	Agent365 server performing the scan

ms365.permissions

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_id	bigint	bigint	Reference to primary key in ms365.drive_scans
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
drive_item_id	bigint	bigint	Reference to primary key in ms365.drive_items
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
expire_time	datetime2(3)	timestamp	Timestamp when link expires
is_inherited	bit	boolean	true = inherited false = not inherited
has_password	bit	boolean	This currently applies only to Anonymous sharing links
grantedto_ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated trustee
grantedto_type	integer	integer	0 = unknown 1 = user 2 = group 3 = device 4 = application
grantedto_sp_user_id	integer	integer	Reference to an associated SharePoint site collection's user account
grantedto_sp_group_id	integer	integer	Reference to an associated SharePoint site collection's group account
grantedto_sp_login_name	nvarchar(256)	varchar(256)	SharePoint-specific login name for the trustee
grantedto_display_name	nvarchar(256)	varchar(256)	Friendly name of trustee
grantedto_email	nvarchar(256)	varchar(256)	Email address of trustee
invite_email	nvarchar(256)	varchar(256)	Email address of recipient (trustee)
invite_sentby_ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated sender
invite_sentby_display_name	nvarchar(256)	varchar(256)	Friendly name of sender
invite_signin_required	bit	boolean	true = sign-in required false = sign-in not required
link_app_display_name	nvarchar(256)	varchar(256)	Friendly name of application
link_app_ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated application
link_type	nvarchar(32)	varchar(32)	One of: view edit See: https://docs.microsoft.com/en-us/graph/api/resources/sharinglink?view=graph-rest-1.0
link_scope	nvarchar(32)	varchar(32)	One of the following from MS GraphAPI: anonymous organization See : https://docs.microsoft.com/en-us/graph/api/resources/sharinglink?view=graph-rest-1.0
link_prevents_download	bit	boolean	true = view only (download not allowed)
roles	nvarchar(128)	varchar(128)	One of the following from MS GraphAPI: read write owner See: https://docs.microsoft.com/en-us/graph/api/resources/permission?view=graph-rest-1.0

ms365.sharing_link_members

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
permission_id	bigint	bigint	Reference to primary key in ms365.permissions
scan_id	bigint	bigint	Reference to primary key in ms365.drive_scans
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated member
member_type	integer	integer	0 - Direct membership 1 - Transitive (nested membership)
display_name	nvarchar(256)	varchar(256)	Friendly name of member
email	nvarchar(256)	varchar(256)	Email address of member
sp_group_id	integer	integer	Reference to an associated SharePoint site collection's group account
sp_user_id	integer	integer	Reference to an associated SharePoint site collection's user account
sp_login_name	nvarchar(256)	varchar(256)	SharePoint-specific login name for the member
sp_display_name	nvarchar(256)	varchar(256)	Friendly name of member's associated SharePoint account

ms365.sites

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
ms365_parent_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated parent site
display_name	nvarchar(256)	varchar(256)	Friendly name of SharePoint site
name	nvarchar(256)	varchar(256)	Site name
is_root	bit	boolean	true = root site (no parent sites) false = child site
web_url	nvarchar(max)	text	Full path to SharePoint site

ms365.sp_base_permissions

Column Name	SQL Server	PostgreSQL	Notes
flag	bigint	bigint	Base permissions flag value
name	nvarchar(64)	varchar(64)	Flag entry name
description	nvarchar(1024)	varchar(1024)	Flag entry description

This is a pre-populated lookup table.

Values are derived from SharePoint client and server .NET APIs.

See https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server/ee536458(v=office.15) and https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server/ms412690(v=office.15).

ms365.sp_group_members

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	integer	integer	Reference to primary key in ms365.jobs
tenant_id	integer	integer	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
sp_group_id	integer	integer	Reference to an associated SharePoint site collection's group account
sp_member_id	integer	integer	Reference to an associated SharePoint site collection's user account
ms365_member_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated member

ms365.sp_groups

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	integer	integer	Reference to primary key in ms365.jobs
tenant_id	integer	integer	Reference to primary key in ms365.tenants
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
sp_id	integer	integer	SharePoint ID for this entry, unique per site collection
last_update	datetime2(3)	timestamp	Last update time for database entry
login_name	nvarchar(256)	varchar(256)	SharePoint account name for this group
title	nvarchar(256)	varchar(256)	Group’s title
description	nvarchar(1024)	varchar(1024)	Group’s description
is_hidden	bit	boolean	Flag indicating whether this is a hidden group

ms365.sp_permission_levels

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	integer	integer	Reference to primary key in ms365.jobs
tenant_id	integer	integer	Reference to primary key in ms365.tenants
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
sp_id	integer	integer	SharePoint ID for this entry, unique per site collection
name	nvarchar(256)	varchar(256)	Name of Permission Level (role)
description	nvarchar(1024)	varchar(1024)	Description for this Permission Level
base_permissions	bigint	bigint	Flags value indicating the underlying permissions this Permission Level (Role) defines Query or join with the descriptions table ms365.sp_base_permissions. See: https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server/ee536458(v=office.15) https://docs.microsoft.com/en-us/previous-versions/office/sharepoint-server/ms412690(v=office.15)
role_type	integer	integer	0 - None 1 - Guest 2 - Reader 3 - Contributor 4 - Web Designer 5 - Administrator 6 - Editor 7 - Reviewer 8 - Restricted Reader 9 - Restricted Guest 255 - System See https://docs.microsoft.com/en-us/dotnet/api/microsoft.sharepoint.client.roletype?view=sharepoint-csom
is_hidden	bit	boolean	Indicates whether this is a hidden role

ms365.sp_permissions

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_id	bigint	bigint	Reference to primary key in ms365.drive_scans
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
drive_item_id	bigint	bigint	Reference to primary key in ms365.drive_items
sp_user_id	integer	integer	Reference to an associated SharePoint site collection's user account
sp_group_id	integer	integer	Reference to an associated SharePoint site collection's group account
sp_login_name	nvarchar(256)	varchar(256)	SharePoint account name for the trustee
sp_display_name	nvarchar(256)	varchar(256)	Display name for the trustee
sp_permission_level_id	integer	integer	Reference to primary key in ms365.sp_permission_levels
is_inherited	bit	boolean	Flag indicating whether this is an inherited permission

ms365.sp_site_permissions

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	integer	integer	Reference to primary key in ms365.jobs
site_id	bigint	bigint	Reference to primary key in ms365.sites for the associated site
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
drive_item_id	bigint	bigint	Reference to primary key in ms365.drive_items
sp_user_id	integer	integer	Reference to an associated SharePoint site collection's user account
sp_group_id	integer	integer	Reference to an associated SharePoint site collection's group account
sp_login_name	nvarchar(256)	varchar(256)	SharePoint account name for the trustee
sp_display_name	nvarchar(256)	varchar(256)	Display name for the trustee
sp_permission_level_id	integer	integer	Reference to primary key in ms365.sp_permission_levels
is_inherited	bit	boolean	Flag indicating whether this is an inherited permission

ms365.sp_users

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants table
site_collection_id	bigint	bigint	Reference to primary key in ms365.sites for the site collection root site
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
sp_id	integer	integer	SharePoint ID for this entry, unique per site collection
last_update	datetime2(3)	timestamp	Last update time for database entry
login_name	nvarchar(256)	varchar(256)	SharePoint account name for this user
upn	nvarchar(256)	varchar(256)	User principal name
email	nvarchar(256)	varchar(256)	User's email address
title	nvarchar(256)	varchar(256)	User's title
principal_type	smallint	smallint	One of the following values as defined by the CSOM 'PrincipalType' enumeration: 0 : None 1 : User 2 : Distribution List 4 : Security Group 8 : SharePoint Group
is_site_admin	bit	boolean	Flag indicating whether this user is assigned as a SharePoint admin for the associated site.
is_hidden	bit	boolean	Flag indicating a hidden account
is_guest	bit	boolean	Flag indicating a guest account
is_email_authenticated	bit	boolean	Only applies to "external" users with sharing

ms365.team_channels

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
team_id	bigint	bigint	Reference to primary key in ms365.teams
display_name	nvarchar(256)	varchar(256)	Friendly name of channel
web_url	nvarchar(256)	varchar(256)	Full path to channel
ms365_files_folder_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated path
ms365_files_folder_drive_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated path’s drive

ms365.teams

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
display_name	nvarchar(256)	varchar(256)	Friendly name of team
visibility	int	int	0 = private 1 = public
web_url	nvarchar(max)	text	Full path to team

ms365.tenants

Column Name	SQL Server	PostgreSQL	Notes
id	int	int	Primary key
tenant_name	nvarchar(256)	varchar(256)	Official registered tenant name ending with ‘.onmicrosoft.com’
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
display_name	nvarchar(256)	varchar(256)	Tenant display name
default_name	nvarchar(256)	varchar(256)	Optionally registered DNS name set as the “default” e.g. corp.example.com

ms365.user_drives

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_user_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated user
ms365_drive_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI for the associated drive

ms365.users

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
job_id	int	int	Reference to primary key in ms365.jobs
tenant_id	int	int	Reference to primary key in ms365.tenants
last_update	datetime2(3)	timestamp	Last update time for database entry
ms365_id	nvarchar(256)	varchar(256)	Unique id provided by MS GraphAPI
display_name	nvarchar(256)	varchar(256)	Display name – typically First Last name
upn	nvarchar(1024)	varchar(1024)	User Principal Name
given_name	nvarchar(64)	varchar(64)	First name
surname	nvarchar(64)	varchar(64)	Last name
onprem_sid	varbinary(68)	bytea	On-premises Security Identifier (SID)
onprem_dn	nvarchar(max)	text	On-premises distinguished name
onprem_upn	nvarchar(1024)	varchar(1024)	On-premises User Principal Name
onprem_dnsdomain	nvarchar(256)	varchar(256)	On-premises DNS domain name
onprem_samaccount	nvarchar(256)	varchar(256)	On-premises SAM Account Name
onprem_immutable_id	nvarchar(256)	varchar(256)	Unique id mapping synced on-prem user to associated MS365 user
account_enabled	bit	boolean	Account is enabled
user_type	nvarchar(64)	varchar(64)	Known values from MS GraphAPI include: Member Guest See: https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0
creation_type	nvarchar(64)	varchar(64)	Known values from MS GraphAPI include: [null] Invitation LocalAccount EmailVerified See : https://docs.microsoft.com/en-us/graph/api/resources/user?view=graph-rest-1.0

srs.ad_memberships

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
group_id	integer	integer	Reference to primary key in srs.ad_objects
member_id	integer	integer	Reference to primary key in srs.ad_objects

srs.ad_objects

Column Name	SQL Server	PostgreSQL	Notes
id	integer	integer	Primary key
name	nvarchar(256)	varchar(256)	SAM Account Name
fdn	nvarchar(512)	varchar(512)	Full distinguished object name
domain	nvarchar(256)	varchar(256)	Domain name
guid	binary(16)	bytea	Globally Unique Identifier
sid	varbinary(68)	bytea	Security Identifier
object_type	integer	integer	0 = Unknown / Other 1 = User 2 = Group 3 = Computer
identity_system_id	integer	integer	Reference to primary key of identity_systems table

srs.identity_systems

Column Name	SQL Server	PostgreSQL	Notes
id	integer	integer	Primary key
type	integer	integer	0 = Unknown 1 = Active Directory 3 = Windows Local
name	nvarchar(256)	varchar(256)	One of: AD Forest Root DNS name Member server NetBIOS name Built-in Account Prefix
domain	nvarchar(256)	varchar(256)	AD Forest Root NetBIOS name
proxy_account	nvarchar(256)	varchar(256)
is_primary	bit	boolean	0 = Not the primary identity system 1 = Primary identity system for authentication
is_managed	bit	boolean	0 = Not managed (member server, built-in domain, etc.) 1 = Managed, configured system
last_modified	datetime2(0)	timestamp

srs.ntfs_aces

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_data_id	bigint	bigint	Reference to scan_data table
flags	smallint	smallint	0x1 = Object Inherit 0x2 = Container Inherit 0x4 = No Propagate 0x8 = Inherit Only 0x10 = Inherited 0x40 = Successful Access 0x80 = Failed Access
ace_type	smallint	smallint	0 = Access Allowed 1 = Access Denied 2 = System Audit 9 = Allowed Callback 10 = Denied Callback 13 = System Audit Callback 17 = System Mandatory Label
access_mask	integer	integer	0x1 = Read Data / List Directory 0x2 = Write Data / Create File 0x4 = Append Data / Create Subdirectory 0x8 = Read Extended Attributes 0x10 = Write Extended Attributes 0x20 = File Execute / Traverse 0x40 = Delete Child 0x80 = Read Attributes 0x100 = Write Attributes 0x10000 = Delete 0x20000 = Read Permissions 0x40000 = Change Permissions 0x80000 = Change Owner 0x100000 = Synchronize 0x1000000 = Access System Security 0x10000000 = Generic All 0x20000000 = Generic Execute 0x40000000 = Generic Write 0x80000000 = Generic Read
sid	varbinary(68)	bytea	Trustee Security Identifier (SID)
index_on_disk	smallint	smallint	Discovered order of this ACE for the associated entry as read from the file system

srs.scan_data

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_id	integer	integer	Reference to primary key in srs.scans
path_type	integer	integer	0 = Unknown 1 = File 2 = Directory 3 = File Symbolic Link 4 = Directory Symbolic Link 5 = Junction 6 = Mount Point 7 = Share 8 = Volume 9 = DFS Link 10 = DFS Folder 11 = DFS Root 12 = HSM Stub 13 = Reparse Point Unknown 17 = Single Instance Storage Stub 18 = Named Stream
is_link	bit	boolean	Flag indicating entry is a link (symlink, hardlink, etc.)
name	nvarchar(256)	varchar(256)	File or directory name
fullpath	nvarchar(max)	text	Full UNC path to the file system entry
fullpath_hash	binary(20)	bytea	SHA-1 hash of lowercase fullpath
filename_extension	nvarchar(32)	varchar(32)	Extensions having more than 32 characters are treated as if they have none
owner_id	varbinary(68)	bytea	Security Identifier (SID)
attributes	integer	integer	0x0 = None 0x1 = Read Only 0x2 = Archive 0x4 = System 0x8 = Hidden 0x10 = Directory 0x20 = Compressed 0x40 = Offline 0x80 = NTFS device 0x100 = NTFS Normal 0x200 = NTFS Temporary 0x400 = NTFS Sparse File 0x800 = NTFS Reparse Point 0x1000 = NTFS Not content indexed 0x2000 = NTFS Encrypted 0x4000 = NTFS Virtual
create_time	datetime2(0)	timestamp
modify_time	datetime2(0)	timestamp
access_time	datetime2(0)	timestamp
size	bigint	bigint	For files, actual size; for directories, accumulative size of all subordinate files
size_on_disk	bigint	bigint	Assumes typical allocation unit size of 4K
size_compressed	bigint	bigint	Only accurate for NTFS file systems
idx	integer	integer	Scan index; unique per scan
parent_idx	integer	integer	Parent index. Used for hierarchical relation processing
path_depth	integer	integer	Entry depth with respect to the scan target’s root path.
ns_left	integer	integer	Nested-set Left index – used for hierarchical relation processing
ns_right	integer	integer	Nested-set Right index – used for hierarchical relation processing
status_code	integer	integer

srs.scan_directory_data

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_data_id	bigint	bigint	Reference to scan_data table
file_count	integer	integer	Count of all files subordinate to this directory
directory_count	integer	integer	Count of all subdirectories
directory_quota	bigint	bigint	Directory quota for this directory
directory_quota_flags	integer	integer	0 = Unknown 1 = Enforced 2 = Disabled 4 = Incomplete 8 = Rebuilding
child_file_count	integer	integer	Count of all immediately subordinate files
child_link_count	integer	integer	Count of all immediately subordinate links
child_directory_count	integer	integer	Count of all immediately subordinate directories
child_size	bigint	bigint	Size of all immediately subordinate files
child_size_on_disk	bigint	bigint	Size on disk of all immediately subordinate files (assumes 4K allocation size)
child_size_compressed	bigint	bigint	Size on disk of all immediately subordinate compressed files (only accurate with NTFS)
child_link_size	bigint	bigint	Size of all immediately subordinate links

srs.scan_history

Column Name	SQL Server	PostgreSQL	Notes
id	integer	integer	Primary key
identity_system	nvarchar(256)	text	Identity system associated with this scan target
scan_target	nvarchar(1024)	text	UNC path of scan target
file_size	bigint	bigint	Total aggregate size of all files
file_count	integer	integer	Total count of all files
directory_count	integer	integer	Total count of all directories
scan_policy_name	nvarchar(64)	varchar(64)	Scan policy associated with this scan
agent_name	nvarchar(256)	text
scan_id	integer	integer	Scan ID
scan_type	integer	integer	0 = None 1 = File System Data 2 = Permissions 4 = Volume Free Space
triggered_start_time	datetime2(3)	timestamp	Initial time scan delegation starts
scan_start_time	datetime2(3)	timestamp	Start time when agent begins physical scan
scan_stop_time	datetime2(3)	timestamp	Stop time when agent completes physical scan
enum_start_time	datetime2(3)	timestamp	Agent metrics related to file system object enumeration
enum_stop_time	datetime2(3)	timestamp	Agent metrics related to file system object enumeration
enum_file_count	integer	integer	Agent metrics related to file system object enumeration
enum_directory_count	integer	integer	Agent metrics related to file system object enumeration
enum_link_count	integer	integer	Agent metrics related to file system object enumeration
caching_start_time	datetime2(3)	timestamp	Metrics related to agent caching
caching_stop_time	datetime2(3)	timestamp	Metrics related to agent caching
cached_file_count	integer	integer	Metrics related to agent caching
cached_directory_count	integer	integer	Metrics related to agent caching
cached_link_count	integer	integer	Metrics related to agent caching
cache_size	integer	integer	Metrics related to agent caching
cache_size_max	integer	integer	Metrics related to agent caching
metadata_start_time	datetime2(3)	timestamp	Agent metrics related to filesystem metadata collection
metadata_stop_time	datetime2(3)	timestamp	Agent metrics related to filesystem metadata collection
metadata_file_count	integer	integer	Agent metrics related to filesystem metadata collection
metadata_directory_count	integer	integer	Agent metrics related to filesystem metadata collection
metadata_link_count	integer	integer	Agent metrics related to filesystem metadata collection
accounts_start_time	datetime2(3)	timestamp	Agent metrics related to security principal collection
accounts_stop_time	datetime2(3)	timestamp	Agent metrics related to security principal collection
accounts_object_count	integer	integer	Agent metrics related to security principal collection
transfer_start_time	datetime2(3)	timestamp	Related to transfer of scan file from the Agent to the Engine
transfer_stop_time	datetime2(3)	timestamp	Related to transfer of scan file from the Agent to the Engine
db_start_time	datetime2(3)	timestamp	Database insert start time
db_stop_time	datetime2(3)	timestamp	Database insert stop time
status_code	integer	integer	Internal status code
error_string	nvarchar(1024)	varchar(1024)

srs.scan_targets

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
network_path	nvarchar(256)	varchar(256)	Root path for scan target
network_path_lower	nvarchar(256)	[ Not applicable ]	Computed column
server	nvarchar(256)	varchar(256)
identity_system_id	integer	integer	Reference to identity_systems table
platform	smallint	smallint	0 = Unknown 1 = Windows
filesystem	smallint	smallint	0 = Unknown 1 = NTFS
cost_per_unit	money	money	Not currently used

srs.scans

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_policy_id	integer	integer	Reference to scan_policies table
triggered_start_time	datetime2(3)	timestamp	Initial time scan delegation starts
scan_start_time	datetime2(3)	timestamp	Start time when agent begins physical scan
scan_stop_time	datetime2(3)	timestamp	Stop time when agent completes physical scan
enum_start_time	datetime2(3)	timestamp	Agent metrics related to file system object enumeration
enum_stop_time	datetime2(3)	timestamp	Agent metrics related to file system object enumeration
enum_file_count	integer	integer	Agent metrics related to file system object enumeration
enum_directory_count	integer	integer	Agent metrics related to file system object enumeration
enum_link_count	integer	integer	Agent metrics related to file system object enumeration
caching_start_time	datetime2(3)	timestamp	Metrics related to agent caching
caching_stop_time	datetime2(3)	timestamp	Metrics related to agent caching
cached_file_count	integer	integer	Metrics related to agent caching
cached_directory_count	integer	integer	Metrics related to agent caching
cached_link_count	integer	integer	Metrics related to agent caching
cache_size	integer	integer	Metrics related to agent caching
cache_size_max	integer	integer	Metrics related to agent caching
metadata_start_time	datetime2(3)	timestamp	Agent metrics related to filesystem metadata collection
metadata_stop_time	datetime2(3)	timestamp	Agent metrics related to filesystem metadata collection
metadata_file_count	integer	integer	Agent metrics related to filesystem metadata collection
metadata_directory_count	integer	integer	Agent metrics related to filesystem metadata collection
metadata_link_count	integer	integer	Agent metrics related to filesystem metadata collection
accounts_start_time	datetime2(3)	timestamp	Agent metrics related to security principal collection
accounts_stop_time	datetime2(3)	timestamp	Agent metrics related to security principal collection
accounts_object_count	integer	integer	Agent metrics related to security principal collection
transfer_start_time	datetime2(3)	timestamp	Related to transfer of scan file from the Agent to the Engine
transfer_stop_time	datetime2(3)	timestamp	Related to transfer of scan file from the Agent to the Engine
db_start_time	datetime2(3)	timestamp	Database insert start time
db_stop_time	datetime2(3)	timestamp	Database insert stop time
scan_type	integer	integer	0 = None 1 = File System Data 2 = Permissions 4 = Volume Free Space
scan_target_id	integer	integer	Reference to scan_targets table
local_identity_system_id	integer	integer
retry_count	integer	integer	Current number of scan attempts
status_code	integer	integer	Internal status code
error_string	nvarchar(1024)	varchar(1024)
progress_status	integer	integer	-2 = Waiting for retry -1 = Ready for cleanup 0 = Waiting for delegation 1 = Delegated / scan in progress 2 = Scan file transfer in progress 3 = Database update in progress 4 = Current - scan process complete 5 = Database update pending 6 = Previous 7 = Retained
next_retry_time	datetime2(0)	timestamp	Next scheduled time to retry a failed scan
ntfs_abe_enabled	bit	boolean	Flag indicating that the Windows share has ABE enabled
is_valid	bit	boolean	[Deprecated]
agent_name	nvarchar(256)	varchar(256)

srs.security_descriptors

Column Name	SQL Server	PostgreSQL	Notes
id	bigint	bigint	Primary key
scan_data_id	bigint	bigint	Reference to scan_data table
control	integer	integer	Security descriptor control flags See https://docs.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-control Possible flags: 0x0001 - Owner defaulted 0x0002 - Group defaulted 0x0004 - DACL present 0x0008 - DACL defaulted 0x0010 - SACL present 0x0020 - SACL defaulted 0x0100 - DACL auto inherit required 0x0200 - SACL auto inherit required 0x0400 - DACL auto Inherited 0x0800 - SACL auto inherited 0x1000 - DACL Protected (inheritance disabled) 0x2000 - SACL protected (inheritance disabled) 0x4000 - Resource Manager control is valid 0x8000 - Security Descriptor is self relative
dacl_present	bit	boolean	Indicates presence of DACL entries for this security descriptor
sacl_present	bit	boolean	Indicates presence of SACL entries for this security descriptor

srs.tend_volume_freespace

Column Name	SQL Server	PostgreSQL	Notes
id	integer	integer	Primary key
scan_id	integer	integer	Scan ID
identity_system	nvarchar(256)	text
network_path	nvarchar(max)	text	Scan target path
server	nvarchar(256)	text
filesystem	integer	integer	0 = Unknown 1 = NTFS
volume_guid	uniqueidentifier	uuid
volume_label	nvarchar(256)	text
volume_bytes_total	bigint	bigint
volume_bytes_free	bigint	bigint
volume_bytes_used	bigint	bigint
allocation_unit_size	integer	integer
allocation_units_total	bigint	bigint
allocation_units_free	bigint	bigint
allocation_units_used	bigint	bigint
status	integer	integer
scan_time	datetime2(0)	timestamp