---
title: "Application"
slug: "application-1"
updated: 2026-10-22T15:21:32Z
published: 2026-10-22T15:21:32Z
canonical: "docs.databee.buzz/application-1"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt
> Use this file to discover all available pages before exploring further.

# Application

## Purpose

The Application CDP contains up-to-date information on all software applications and "information systems” within an organization. A software application is defined as an individual piece of software installed on a device while information systems are applications defined on the business level and may contain several devices.

## Understanding the Table

The Application CDP is ideal for answering questions about the current status of all software applications. This includes understanding which applications are in use, their versions, and the vendors supplying them. Information systems running in the organization can be joined to the OCSF `application_lifecycle` for historical trend analysis. By leveraging this historical data, users can gain insights into the evolution and lifecycle of applications within the organization, enabling better decision-making and strategic planning.

Applications is a Type 1 table. This means all columns are updated directly when new information is ingested.

A row is a unique combination of the following attributes: Application Vendor Name, Application Version, Application Name, or Application UID.

## Joining to CDPs and OCSF

The `application.id` column should be used for all joins within the CDPs. This ensures consistency and accuracy when merging data from different sources. For joining back to OCSF tables, it is recommended to use either the `application.uid` or a combination of the `application.name` and the `application.version`.

## [Schema](/user-manual/docs/application)

## Example Queries

Find all active applications

```pgsql
SELECT * FROM applications where last_seen_time >= {date}
```

How to join back to OCSF

```pgsql
SELECT * FROM CDP.application left join OCSF.application_lifecycle on CDP.application.uid = OCSF.application_lifecycle.app:uid
```

## CDP Data Dictionary

| **Caption** | **Name** | **Requirement** | **Type** | **Description** |
| --- | --- | --- | --- | --- |
| Active | active | optional | boolean_t | ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. |
| End Time | end_time | optional | timestamp_t | ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. |
| First Seen Time | first_seen_time | optional | timestamp_t | ApplicationLifecycle.start_time: The start time of a time period, or the time of the least recent event included in the aggregate event. ApplicationLifecycle.time: The normalized event occurrence time. For example: `1618524549901`. |
| History ID | hid | optional | integer_t | Product.hid: The unique DataBee ID to identify a particular history entry or row in an entity table. This field is the primary key and should not be mapped manually as the DataBee product populates this field itself. |
| Application ID | id | required | integer_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: `2013.1.3-beta`. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product. |
| Last Seen Time | last_seen_time | optional | timestamp_t | ApplicationLifecycle.end_time: The end time of a time period, or the time of the most recent event included in the aggregate event. ApplicationLifecycle.time: The normalized event occurrence time. For example: `1618524549901`. |
| Modified Time | modified_time | optional | timestamp_t | Product.modified_time: The timestamp of the last known modification to the application, such as updates to configuration, code, or metadata. |
| Name | name | recommended | string_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.name: The name of the product. |
| Record Created At | record_created_at | required | timestamp_t | CDPs generated timestamp when record was created. |
| Record Updated At | record_updated_at | required | timestamp_t | CDPs generated timestamp when record was last updated. |
| Risk Level | risk_level | optional | string_t | Product.risk_level: A human-readable risk assessment for the application. Indicates the potential impact or urgency of risks associated with the application, such as 'High' or 'Critical'. |
| Data Sources | sources | required | string_t Array | ApplicationLifecycle.metadata_: The metadata associated with the event or a finding. Metadata.product: The product that reported the event. |
| Start Time | start_time | optional | timestamp_t | ApplicationLifecycle.start_time: The start time of a time period, or the time of the least recent event included in the aggregate event. |
| Status | status | recommended | string_t | Product.status: A human-readable status of the application. Indicates the application's lifecycle state, such as 'Production' or 'Retired'. |
| Type | type | recommended | string_t | Product.type: A human-readable type of the application. Indicates the type of application, such as 'Commercial Software' or 'Line of Business'. |
| Type ID | type_id | recommended | integer_t | Product.type_id: A normalized identifier representing the type of product or application. For example: 0 means 'Unknown', 1 means 'Commercial Software', 2 means 'Line of Business', and 99 means 'Other'. |
| Unique ID | uid | recommended | string_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.uid: The unique identifier of the product. |
| URL String | url_string | optional | string_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.url_string: The URL pointing towards the product. |
| Vendor Name | vendor_name | required | string_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.vendor_name: The name of the vendor of the product. |
| Version | version | recommended | string_t | ApplicationLifecycle.app: The application that was affected by the lifecycle event. This also applies to self-updating application systems. Product.version: The version of the product, as defined by the event source. For example: `2013.1.3-beta`. |