Database tables and fields

FA_Events

Stores every audited file and folder access event

FA_Events

FA_LastEvents

Internal tracking of the last scanned event per computer

FA_LastEvents

FA_ALERT

History of all alerts triggered by the Alerts feature

FA_ALERT

SNAPSHOTS

Index of snapshots

SNAPSHOTS

REALFILES

File inventory captured in a snapshot

REALFILES

REALFOLDERS

Folder inventory captured in a snapshot

REALFOLDERS

ACES

Access control entries (NTFS permissions) of scanned objects

ACES

SCANERRORS

Errors and warnings logged during a snapshot scan

SCANERRORS

SERVERS

Inventory of scanned computers

SERVERS

Computer

String

NetBIOS name of the computer where the audited file or folder is located.

FileName

String

Path of the audited file or folder.

UserAccount

String

User account that accessed the file or folder.

DomainName

String

Domain of the user account that accessed the file or folder.

Process

String

Process used to access the file or folder. Available only when the access is made locally.

Accepted

Number

1 = allowed, 0 = rejected.

AccessRights

Number

Rights used to access the file or folder. See AccessRights bitmask.

Privileges

Number

Privileges used to access the file or folder. See Privileges bitmask.

AccessId

Number

Access operation determined by FileAudit. See AccessId operations.

RecordNumber

Number

Event record number in the Windows Security log.

EventTime

DateTime

Local date and time of the access.

EventLocalTime

DateTime

Reserved. Do not use.

ObjectType

Number

0 = unknown, 1 = folder, 2 = file.

ClientAddress

String

Client IP address from which the access was performed. Available only when the access is made remotely.

LogonId

String

Logon ID of the user access token used for the access.

Id

Number

Primary key, automatically incremented for each new record.

ClientName

String

Client machine name from which the access was performed. Available only when ClientAddress is present.

UniqueId

String

Unique identifier per access event.

OldFileName

String

Previous file or folder path before a move or rename. Cloud objects only.

FileUniqueId

String

Unique identifier per file or folder. Does not change on move or rename. Cloud objects only.

NewFileName

String

New path after a move or rename.

OldSd

String

Security descriptor of the object before a permissions change event.

NewSd

String

Security descriptor of the object after a permissions change event.

Computer

String

NetBIOS name of the computer where the audited file or folder is located.

RecordNumber

Number

Record number of the last event scanned from the Windows Security log.

EventTime

DateTime

Date and time (UTC) of the last event scanned from the Windows Security log.

AlertType

Number

Type of alert (single or mass alert).

AlertTime

DateTime

Time when the alert was triggered.

Status

Number

Access status (granted or denied).

AlertName

String

Name of the alert.

ServerName

String

Name of the server where the alert was triggered.

DomainName

String

Domain of the user account that accessed the file or folder.

UserName

String

Name of the user that accessed the file or folder.

Path

String

Path of the files or folders where the alert was triggered.

ClientName

String

Client machine name from which the alert was triggered.

ClientAddress

String

List of client IP addresses from which the alert was triggered.

AccessType

Number

List of access types that triggered the alert.

MailRecipient

String

List of email recipients notified that the alert was triggered.

Script

String

Names of the scripts executed by the alert.

Process

String

Name of the process that triggered the alert.

EffectiveCount

Number

Number of events detected to trigger the alert, for a mass alert.

EffectiveTimePeriodInSec

Number

Time period between the first and last event that triggered the alert, for a mass alert.

id_snapshot

Number

Identifier of the snapshot.

shot_time

DateTime

Time when the snapshot scan began.

config_file

String

description

String

Id_realfiles

Number

Identifier of this file.

server_name

String

Name or network address of the related computer.

id_snapshot

Number

Snapshot auto-number.

pathname

String

Full path of the file.

filename

String

attribs

Number

Bit mask specifying the file attributes.
See File and folder attributes.

realsize

Number

Real size of the file.

compressedsize

Number

Compressed size of the file.

time_created

DateTime

Time when the file was created.

time_modified

DateTime

time_accessed

DateTime

account_name

String

Owner of the file.

id_Acl

Number

id_snapshot

Number

Snapshot auto-number.

server_name

String

NetBIOS name of the server, without the leading backslashes.

id_realfolder

Number

Identifier of this folder. Used to link tables such as aces.object_id.

id_share

Number

Link to the share if the folder is shared (shares table).

pathname

String

Full path of the folder.

foldername

String

Name of the folder.

attribs

Number

Bit mask specifying the folder attributes.
See File and folder attributes.

time_created

DateTime

Time when the folder was created.

account_name

String

Owner of the folder.

realsize

Number

Size of the folder including all subdirectories and files (bytes).

compressedsize

Number

Currently not scanned.

NbFiles

Number

Number of files in the folder.

NbFolders

Number

Number of subfolders in the folder.

time_accessed

DateTime

Last access time.

rootsize

Number

Size of all files at the root of the folder.

id_Acl

Number

id_scan

Number

id_snapshot

Number

Auto-number of the snapshot.

object_id

Number

Identifier of a file (see REALFILES) or a folder (see REALFOLDERS).

type

Number

Type of access: 1 = ACCESS_ALLOWED_ACE_TYPE, 0 = ACCESS_DENIED_ACE_TYPE.

rightmask

Number

Bit mask describing the access, allowed or denied.
See ACE rights mask.

aceflags

Number

account_name

String

Full account name corresponding to the ACE.

Rights

String

Access rights in rwxd form: read, write, execute, delete.

id_snapshot

Number

Snapshot auto-number.

server_name

String

Name or network address of the related computer.

EventLevel

Number

0 = warning, 1 = error.

EventCode

Number

Scan error number.
See Scan error and warning codes.

id_snapshot

Number

Identifier of the snapshot.

server_name

String

NetBIOS name of the server, without the two leading backslashes.

domain_name

String

Name of the domain or workgroup to which the server belongs.

type

Number

Bit mask describing the server type.
See Server type.

texttype

String

Readable text string describing the type value.

comments

String

Comments on the server.

maxusers

Number

Maximum number of concurrent connected users. A value of -1 means no limit.

userspath

String

Path to user directories.

sp

String

Windows NT service pack installed.

install_date

Date

Date when the operating system was installed.

bios_type

String

BIOS description.

bios_date

String

BIOS date.

os

String

Active operating system.

OSLevel

0 = workstation, 1 = server, 2 = advanced server.

wmi

Number

1 if Windows Management Instrumentation is active on the computer, otherwise 0.

ram

Number

Amount of physical memory (MB).

ramUsed

Number

Memory in use (MB).

dns_hostname

String

dns_domainname

String

dns_nameservers

String

dns_suffixes

String

Manufacturer

String

Computer manufacturer.

Model

String

Computer model.

Serial

String

Computer serial number.

MotherBoard

String

MBSerial

String

Motherboard serial.

MBManufacturer

String

Motherboard manufacturer.

SmBIOSVersion

String

Supported version of the SMBIOS standard.

DComEnabled

Number

0 = DCOM disabled, 1 = DCOM enabled.

RegisteredOwner

String

Name of the registered user.

RegisteredOrganization

String

Name of the registered company.

LastUser

String

Last logged-on user (account_name).

SystemRoot

String

OS directory (commonly c:\winnt or c:\windows).

ProgramFilesDir

String

Commonly c:\program files.

CommonFilesDir

String

Commonly c:\program files\Common Files.

BootTime

Number

Time interval (in days) since the last boot of the machine.

IdleTime

Number

Idle time (in days) since the last boot. Used processor time % = 100 - IdleTime / BootTime * 100.

ScanTime

Time

Scan time.

IEVersion

Number

Internet Explorer version.

IESPNumber

Number

Internet Explorer service pack.

LanguageId

Number

Operating system language.
See Server language ID.

CanonicalName

String

Canonical name of the computer in Active Directory.

Container

String

Container of the computer in Active Directory.

ComputerState

Number

1 = reboot needed, 0 = no reboot needed.

ChassisType

Number

Computer case type.
See Server chassis type.

ChipSet

String

Platform

Number

Edition

String

Edition.

0

FILE_READ_DATA

List folder / read data

1

FILE_WRITE_DATA

Create files / write data

2

FILE_APPEND_DATA

Create folders / append data

3

FILE_READ_EA

Read extended attributes

4

FILE_WRITE_EA

Write extended attributes

5

FILE_EXECUTE

Traverse folder / execute file

7

FILE_READ_ATTRIBUTES

Read attributes

8

FILE_WRITE_ATTRIBUTES

Write attributes

16

DELETE

Delete

17

READ_CONTROL

Read permissions

18

WRITE_DAC

Change permissions

19

WRITE_OWNER

Take ownership

20

SYNCHRONIZE

24

ACCESS_SYSTEM_SECURITY

5

SeSecurityPrivilege

6

SeTakeOwnershipPrivilege

14

SeBackupPrivilege

15

SeRestorePrivilege

0

Delete

The file or folder was deleted, moved, or renamed.

1

Ownership

A user took ownership of the file or folder.

2

Permissions

A user changed permissions on the file or folder.

3

Write

The file was opened in write mode.

4

Execute

The file is an executable and was executed by a user.

5

Read

The file was opened in read mode.

6

System

An attempt was made to read or write the system access control list of the file or folder. Typically means a user displayed the object properties in Windows Explorer.

7

Write Attributes

A file attribute was changed.

8

Other

9

Creation (Cloud)

The file was created.

10

Move (Cloud)

The file was moved.

11

Rename (Cloud)

The file was renamed.

12

Lock (Cloud)

13

Unlock (Cloud)

14

Copy (Cloud)

The file was copied.

15

Download (Cloud)

The file was downloaded.

16

Restore (Cloud)

The file was restored.

17

Revert (Cloud)

The file was reverted.

18

Share (Cloud)

The file was shared.

19

Unshare (Cloud)

The file was unshared.

20

Check In (Cloud)

A user checked in a file in SharePoint Online.

21

Check Out (Cloud)

A user tried to check out a file in SharePoint Online.

22

Undo Check Out (Cloud)

A user discarded a check out of a file in SharePoint Online.

23

Destroy (Cloud)

The file was deleted from trash.

FILE_ATTRIBUTE_ARCHIVE

0x00000020

The file or directory is an archived file or directory. Applications use this attribute to mark files for backup or removal.

FILE_ATTRIBUTE_COMPRESSED

0x00000800

The file or directory is compressed. For a directory, compression is the default for newly created files and subdirectories.

FILE_ATTRIBUTE_DIRECTORY

0x00000010

The handle identifies a directory.

FILE_ATTRIBUTE_ENCRYPTED

0x00000040

The file or directory is encrypted. For a directory, encryption is the default for newly created files and subdirectories.

FILE_ATTRIBUTE_HIDDEN

0x00000002

The file or directory is hidden. It is not included in an ordinary directory listing.

FILE_ATTRIBUTE_NORMAL

0x00000080

The file or directory has no other attributes set. Valid only when used alone.

FILE_ATTRIBUTE_OFFLINE

0x00001000

The file data is not immediately available. The data has been physically moved to offline storage.

FILE_ATTRIBUTE_READONLY

0x00000001

The file or directory is read-only. Applications can read the file but cannot write to or delete it.

FILE_ATTRIBUTE_REPARSE_POINT

0x00000400

The file has an associated reparse point.

FILE_ATTRIBUTE_SPARSE_FILE

0x00000200

The file is a sparse file.

FILE_ATTRIBUTE_SYSTEM

0x00000004

The file or directory is part of the operating system or used exclusively by it.

FILE_ATTRIBUTE_TEMPORARY

0x00000100

The file is used for temporary storage. It should be deleted by the application as soon as it is no longer needed.

0-15

Specific rights

Access mask specific to the object type.

16

DELETE

Delete access.

17

READ_CONTROL

Read access to the owner, group, and discretionary access control list (ACL) of the security descriptor.

18

WRITE_DAC

Write access to the discretionary access control list (ACL).

19

WRITE_OWNER

Write access to the owner.

20

SYNCHRONIZE

Synchronize access.

24

ACCESS_SYSTEM_SECURITY

Access to a system ACL. Requires a specific privilege on the calling process.

25

MAXIMUM_ALLOWED

Maximum allowed.

26-27

Reserved

28

GENERIC_ALL

Generic all.

29

GENERIC_EXECUTE

Generic execute.

30

GENERIC_WRITE

Generic write.

31

GENERIC_READ

Generic read.

0

SCAN_ERROR_NAME_RESOLUTION

Error

Unable to resolve the name.

1

SCAN_ERROR_PING

Error

Unable to ping.

2

SCAN_ERROR_NETPATH_NOTFOUND

Error

Network path not found.

3

SCAN_ERROR_REMOTEREG

Error

Unable to access the registry.

4

SCAN_ERROR_ACCESS_DENIED

Error

Access denied.

5

SCAN_ERROR_CONNECT

Error

Unable to connect.

6

SCAN_ERROR_COMPUTER_REC

Error

Unable to insert the computer in the database.

7

SCAN_ERROR_LICENSE_SERVERS

Error

Not enough server licenses.

8

SCAN_ERROR_LICENSE_WKSTAS

Error

Not enough workstation licenses.

9

SCAN_ERROR_OTHER

Error

Unspecified error.

10

SCAN_ERROR_EXCEPTION

Error

Unexpected error.

100

SCAN_WARNING_SMBIOS_INITDENIED

Warning

Advanced scan: initialization denied.

101

SCAN_WARNING_SMBIOS_RPCUNAVAILABLE

Warning

Advanced scan: RPC server unavailable.

102

SCAN_WARNING_SMBIOS_NODATA

Warning

Advanced scan: no SMBIOS data.

103

SCAN_WARNING_SMBIOS_OTHER

Warning

Advanced scan error.

104

SCAN_WARNING_NOADMINSHARES

Warning

No administrative shares.

105

SCAN_WARNING_DBINSERTION

Warning

Database insertion error.

106

SCAN_WARNING_OTHER

Warning

Unspecified warning.

107

SCAN_WARNING_ERRORSHARES

Warning

Unable to scan shares.

108

SCAN_WARNING_ERRORSERVICES

Warning

Unable to scan services.

109

SCAN_WARNING_EXCEPTION

Warning

Unexpected warning.

1000

SCAN_DOMAIN_ERROR_OU

Domain error

Unable to retrieve computers from the Global Catalog.

1001

SCAN_DOMAIN_ERROR_LIST

Domain error

Unable to find a domain controller.

1002

SCAN_DOMAIN_ERROR_CONTROLLER

Domain error

Unable to retrieve computers from the domain controller.

SV_TYPE_WORKSTATION

0x00000001

All LAN Manager workstations.

SV_TYPE_SERVER

0x00000002

All LAN Manager servers.

SV_TYPE_SQLSERVER

0x00000004

Any server running Microsoft SQL Server.

SV_TYPE_DOMAIN_CTRL

0x00000008

Primary domain controller.

SV_TYPE_DOMAIN_BAKCTRL

0x00000010

Backup domain controller.

SV_TYPE_TIMESOURCE

0x00000020

Server running the Timesource service.

SV_TYPE_AFP

0x00000040

Apple File Protocol servers.

SV_TYPE_NOVELL

0x00000080

Novell servers.

SV_TYPE_DOMAIN_MEMBER

0x00000100

LAN Manager 2.x domain member.

SV_TYPE_PRINT

0x00000200

Server sharing a print queue.

SV_TYPE_DIALIN

0x00000400

Server running a dial-in service.

SV_TYPE_XENIX_SERVER

0x00000800

Xenix server.

SV_TYPE_NT

0x00001000

Windows NT (workstation or server).

SV_TYPE_WFW

0x00002000

Server running Windows for Workgroups.

SV_TYPE_MFPN

0x00004000

Microsoft File and Print for NetWare.

SV_TYPE_SERVER_NT

0x00008000

Windows NT non-DC server.

SV_TYPE_POTENTIAL_BROWSER

0x00010000

Server that can run the Browser service.

SV_TYPE_BACKUP_BROWSER

0x00020000

Server running a Browser service as backup.

SV_TYPE_MASTER_BROWSER

0x00040000

Server running the master Browser service.

SV_TYPE_DOMAIN_MASTER

0x00080000

Server running the domain master Browser.

SV_TYPE_WINDOWS

0x00400000

Windows 95 or later.

SV_TYPE_LOCAL_LIST_ONLY

0x40000000

Servers maintained by the browser.

SV_TYPE_DOMAIN_ENUM

0x80000000

Primary domain.

SV_TYPE_ALL

0xFFFFFFFF

All servers.

LANG_NEUTRAL

0x00

Neutral

LANG_ARABIC

0x01

Arabic

LANG_BULGARIAN

0x02

Bulgarian

LANG_CATALAN

0x03

Catalan

LANG_CHINESE

0x04

Chinese

LANG_CZECH

0x05

Czech

LANG_DANISH

0x06

Danish

LANG_GERMAN

0x07

German

LANG_GREEK

0x08

Greek

LANG_ENGLISH

0x09

English

LANG_SPANISH

0x0a

Spanish

LANG_FINNISH

0x0b

Finnish

LANG_FRENCH

0x0c

French

LANG_HEBREW

0x0d

Hebrew

LANG_HUNGARIAN

0x0e

Hungarian

LANG_ICELANDIC

0x0f

Icelandic

LANG_ITALIAN

0x10

Italian

LANG_JAPANESE

0x11

Japanese

LANG_KOREAN

0x12

Korean

LANG_DUTCH

0x13

Dutch

LANG_NORWEGIAN

0x14

Norwegian

LANG_POLISH

0x15

Polish

LANG_PORTUGUESE

0x16

Portuguese

LANG_ROMANIAN

0x18

Romanian

LANG_RUSSIAN

0x19

Russian

LANG_CROATIAN

0x1a

Croatian

LANG_SERBIAN

0x1a

Serbian

LANG_SLOVAK

0x1b

Slovak

LANG_ALBANIAN

0x1c

Albanian

LANG_SWEDISH

0x1d

Swedish

LANG_THAI

0x1e

Thai

LANG_TURKISH

0x1f

Turkish

LANG_URDU

0x20

Urdu

LANG_INDONESIAN

0x21

Indonesian

LANG_UKRAINIAN

0x22

Ukrainian

LANG_BELARUSIAN

0x23

Belarusian

LANG_SLOVENIAN

0x24

Slovenian

LANG_ESTONIAN

0x25

Estonian

LANG_LATVIAN

0x26

Latvian

LANG_LITHUANIAN

0x27

Lithuanian

LANG_FARSI

0x29

Farsi

LANG_VIETNAMESE

0x2a

Vietnamese

LANG_ARMENIAN

0x2b

Armenian

LANG_AZERI

0x2c

Azeri

LANG_BASQUE

0x2d

Basque

LANG_MACEDONIAN

0x2f

FYRO Macedonian

LANG_AFRIKAANS

0x36

Afrikaans

LANG_GEORGIAN

0x37

Georgian

LANG_FAEROESE

0x38

Faeroese

LANG_HINDI

0x39

Hindi

LANG_MALAY

0x3e

Malay

LANG_KAZAK

0x3f

Kazak

LANG_KYRGYZ

0x40

Kyrgyz

LANG_SWAHILI

0x41

Swahili

LANG_UZBEK

0x43

Uzbek

LANG_TATAR

0x44

Tatar

LANG_BENGALI

0x45

Not supported

LANG_PUNJABI

0x46

Punjabi

LANG_GUJARATI

0x47

Gujarati

LANG_ORIYA

0x48

Not supported

LANG_TAMIL

0x49

Tamil

LANG_TELUGU

0x4a

Telugu

LANG_KANNADA

0x4b

Kannada

LANG_MALAYALAM

0x4c

Not supported

LANG_ASSAMESE

0x4d

Not supported

LANG_MARATHI

0x4e

Marathi

LANG_SANSKRIT

0x4f

Sanskrit

LANG_MONGOLIAN

0x50

Mongolian

LANG_GALICIAN

0x56

Galician

LANG_KONKANI

0x57

Konkani

LANG_MANIPURI

0x58

Not supported

LANG_SINDHI

0x59

Not supported

LANG_SYRIAC

0x5a

Syriac

LANG_KASHMIRI

0x60

Not supported

LANG_NEPALI

0x61

Not supported

LANG_DIVEHI

0x65

Divehi

LANG_INVARIANT

0x7f

1

Other

2

Unknown

3

Desktop

4

Low profile desktop

5

Pizza box

6

Mini tower

7

Tower

8

Portable

9

Laptop

10

Notebook

11

Hand held

12

Docking station

13

All in one

14

Sub notebook

15

Space-saving

16

Lunch box

17

Main server chassis

18

Expansion chassis

19

Sub chassis

20

Bus expansion chassis

21

Peripheral chassis

22

RAID chassis

23

Rack mount chassis

24

Multi-system chassis