Targets, hosts and services

`groups`

Tree of groups per tenant (parent_id). Hosts and targets can be placed in a group; plans can target a group with its subgroups.

8 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`tenant_id`	`bigint(20) unsigned`			`tenants` on delete cascade
`parent_id`	`bigint(20) unsigned`	yes		`groups` on delete set null
`name`	`varchar(255)`
`description`	`text`	yes
`position`	`int(11)`		`0`
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes

Indexes: parent_id · tenant_id

`targets`

What a user entered: IPv4, IPv6, hostname, CIDR, range or domain. A single-host target points to its host.

11 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`tenant_id`	`bigint(20) unsigned`			`tenants` on delete cascade
`group_id`	`bigint(20) unsigned`	yes		`groups` on delete set null
`host_id`	`bigint(20) unsigned`	yes		`hosts` on delete set null
`type`	`varchar(16)`
`value`	`varchar(255)`
`label`	`varchar(255)`	yes
`enabled`	`tinyint(1)`		`1`
`created_by`	`bigint(20) unsigned`	yes		`users` on delete set null
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes

Indexes: created_by · group_id · host_id · tenant_id, type, value (unique)

`hosts`

One machine with all its addresses. Status, open service count, OS guess, last scan, manual location and address.

17 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`tenant_id`	`bigint(20) unsigned`			`tenants` on delete cascade
`group_id`	`bigint(20) unsigned`	yes		`groups` on delete set null
`name`	`varchar(255)`
`description`	`text`	yes
`os_guess`	`varchar(255)`	yes
`status`	`varchar(16)`		`unknown`
`auto_merge`	`tinyint(1)`		`1`
`open_services_count`	`int(10) unsigned`		`0`
`first_seen_at`	`timestamp`	yes
`last_seen_at`	`timestamp`	yes
`last_scanned_at`	`timestamp`	yes
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes
`latitude`	`decimal(9,6)`	yes
`longitude`	`decimal(9,6)`	yes
`address`	`varchar(300)`	yes

Indexes: group_id · tenant_id, group_id

`host_addresses`

IPv4, IPv6 addresses and hostnames of a host with their source (manual, dns, ptr, cert, …) and the PTR name of an IP.

10 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`host_id`	`bigint(20) unsigned`			`hosts` on delete cascade
`type`	`varchar(16)`
`value`	`varchar(255)`
`ptr`	`varchar(255)`	yes
`source`	`varchar(16)`		`manual`
`first_seen_at`	`timestamp`	yes
`last_seen_at`	`timestamp`	yes
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes

Indexes: host_id, type, value (unique) · value

`host_fingerprints`

SSH host keys and TLS certificate fingerprints seen on a host. SSH keys merge hosts; TLS fingerprints never do.

7 columns

Column	Type	Null	References
`id` PK	`bigint(20) unsigned`
`host_id`	`bigint(20) unsigned`		`hosts` on delete cascade
`type`	`varchar(32)`
`value`	`varchar(255)`
`label`	`varchar(255)`	yes
`first_seen_at`	`timestamp`	yes
`last_seen_at`	`timestamp`	yes

Indexes: host_id, type, value (unique) · type, value

`host_paths`

Latest traceroute from each satellite to each address of a host: the hops, whether the target was reached, round-trip time and the last router.

11 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`host_id`	`bigint(20) unsigned`			`hosts` on delete cascade
`satellite_id`	`bigint(20) unsigned`			`satellites` on delete cascade
`target`	`varchar(255)`
`hops`	`longtext`
`hop_count`	`smallint(5) unsigned`		`0`
`reached`	`tinyint(1)`		`0`
`rtt_ms`	`double`	yes
`gateway`	`varchar(45)`	yes
`created_at`	`timestamp`		`current_timestamp()`
`last_seen_at`	`timestamp`	yes

Indexes: host_id, satellite_id, created_at · satellite_id, gateway

`services`

A port/protocol of a host with what runs there (nmap name, product, version, CPE, identified by a probe), open or closed, first and last seen.

17 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`host_id`	`bigint(20) unsigned`			`hosts` on delete cascade
`protocol`	`varchar(8)`
`port`	`int(10) unsigned`
`name`	`varchar(255)`	yes
`identified`	`varchar(16)`	yes
`product`	`varchar(255)`	yes
`version`	`varchar(255)`	yes
`extra_info`	`varchar(255)`	yes
`tunnel`	`varchar(16)`	yes
`cpe`	`longtext`	yes
`is_open`	`tinyint(1)`		`0`
`first_seen_at`	`timestamp`	yes
`last_seen_at`	`timestamp`	yes
`last_change_at`	`timestamp`	yes
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes

Indexes: host_id, protocol, port (unique)

`service_observations`

The same service as seen from one satellite on one address: state, missed scans (a port is closed after 2 misses), policy violation counter, scripts output.

16 columns

Column	Type	Null	Default	References
`id` PK	`bigint(20) unsigned`
`service_id`	`bigint(20) unsigned`			`services` on delete cascade
`satellite_id`	`bigint(20) unsigned`			`satellites` on delete cascade
`address`	`varchar(255)`
`state`	`varchar(16)`
`missed_scans`	`smallint(5) unsigned`		`0`
`violation_scans`	`smallint(5) unsigned`		`0`
`violation_run_id`	`bigint(20) unsigned`	yes
`product`	`varchar(255)`	yes
`version`	`varchar(255)`	yes
`scripts`	`longtext`	yes
`scan_run_id`	`bigint(20) unsigned`	yes		`scan_runs` on delete set null
`first_seen_at`	`timestamp`	yes
`last_seen_at`	`timestamp`	yes
`created_at`	`timestamp`	yes
`updated_at`	`timestamp`	yes

Indexes: satellite_id · scan_run_id · service_id, satellite_id, address (unique)

`service_events`

History: a service appeared, disappeared or changed its fingerprint, per satellite and address. Kept beyond the result retention.

9 columns

Column	Type	Null	References
`id` PK	`bigint(20) unsigned`
`tenant_id`	`bigint(20) unsigned`		`tenants` on delete cascade
`host_id`	`bigint(20) unsigned`		`hosts` on delete cascade
`service_id`	`bigint(20) unsigned`	yes	`services` on delete cascade
`satellite_id`	`bigint(20) unsigned`	yes	`satellites` on delete set null
`address`	`varchar(255)`	yes
`event`	`varchar(16)`
`details`	`longtext`	yes
`occurred_at`	`timestamp`

Indexes: host_id, occurred_at · satellite_id · service_id · tenant_id, occurred_at

`service_versions`

Every product/version seen on a service with its source (nmap, banner, HTTP header) and first/last seen — the software inventory.

7 columns

Column	Type	Default	References
`id` PK	`bigint(20) unsigned`
`service_id`	`bigint(20) unsigned`		`services` on delete cascade
`product`	`varchar(255)`
`version`	`varchar(255)`
`source`	`varchar(16)`	`nmap`
`first_seen_at`	`timestamp`
`last_seen_at`	`timestamp`

Indexes: service_id, product, version (unique)