Application

Purpose

The Application CDP contains up-to-date information on all software applications and "information systems” within an organization. A software application is defined as an individual piece of software installed on a device while information systems are applications defined on the business level and may contain several devices.

Understanding the Table

The Application CDP is ideal for answering questions about the current status of all software applications. This includes understanding which applications are in use, their versions, and the vendors supplying them. Information systems running in the organization can be joined to the OCSF application_lifecycle for historical trend analysis. By leveraging this historical data, users can gain insights into the evolution and lifecycle of applications within the organization, enabling better decision-making and strategic planning.

Applications is a Type 1 table. This means all columns are updated directly when new information is ingested.

A row is a unique combination of the following attributes: Application Vendor Name, Application Version, Application Name, or Application UID.

Joining to CDPs and OCSF

The application.id column should be used for all joins within the CDPs. This ensures consistency and accuracy when merging data from different sources. For joining back to OCSF tables, it is recommended to use either the application.uid or a combination of the application.name and the application.version.

Schema

Example Queries

Find all active applications

SELECT * FROM applications where last_seen_time >= {date}

How to join back to OCSF

SELECT * FROM CDP.application left join OCSF.application_lifecycle on CDP.application.uid = OCSF.application_lifecycle.app:uid

CDP Data Dictionary

Caption	Name	Requirement	Type	Description
Active	active	optional	boolean_t	ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event.
End Time	end_time	optional	timestamp_t	ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event.
First Seen Time	first_seen_time	optional	timestamp_t	ApplicationLifecycle.start_time: The start time of a time period, or the time of the least recent event included in the aggregate event. ApplicationLifecycle.time: The normalized event occurrence time. For example: `1618524549901`.
History ID	hid	optional	integer_t	Product.hid: The unique DataBee ID to identify a particular history entry or row in an entity table. This field is the primary key and should not be mapped manually as the DataBee product populates this field itself.
Application ID	id	required	integer_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: `2013.1.3-beta`. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product.
Last Seen Time	last_seen_time	optional	timestamp_t	ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. ApplicationLifecycle.time: The normalized event occurrence time. For example: `1618524549901`.
Modified Time	modified_time	optional	timestamp_t	Product.modified_time: The timestamp of the last known modification to the application, such as updates to configuration, code, or metadata.
Name	name	recommended	string_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product.
Record Created At	record_created_at	required	timestamp_t	CDPs generated timestamp when record was created.
Record Updated At	record_updated_at	required	timestamp_t	CDPs generated timestamp when record was last updated.
Risk Level	risk_level	optional	string_t	Product.risk_level: A human-readable risk assessment for the application. Indicates the potential impact or urgency of risks associated with the application, such as 'High' or 'Critical'.
Data Sources	sources	required	string_t Array	ApplicationLifecycle.metadata_: The metadata associated with the event or a finding. Metadata.product: The product that reported the event.
Start Time	start_time	optional	timestamp_t	ApplicationLifecycle.start_time: The start time of a time period, or the time of the least recent event included in the aggregate event.
Status	status	recommended	string_t	Product.status: A human-readable status of the application. Indicates the application's lifecycle state, such as 'Production' or 'Retired'.
Type	type	recommended	string_t	Product.type: A human-readable type of the application. Indicates the type of application, such as 'Commercial Software' or 'Line of Business'.
Type ID	type_id	recommended	integer_t	Product.type_id: A normalized identifier representing the type of product or application. For example: 0 means 'Unknown', 1 means 'Commercial Software', 2 means 'Line of Business', and 99 means 'Other'.
Unique ID	uid	recommended	string_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product.
URL String	url_string	optional	string_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.url_string: The URL pointing towards the product.
Vendor Name	vendor_name	required	string_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product.
Version	version	recommended	string_t	ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: `2013.1.3-beta`.