Purpose
The Application Feed CDP contains up-to-date information when an application was first seen and last seen by a particular feed. The Device Feed CDP is ideal for answering questions about when a device was last seen by a feed.
Understanding the Table
The Application Feed CDP contains first_seen and last_seen time stamps. These timestamps indicate when the application (identified by product_id) was last seen by a particular feed and event_type (identified by feed_name and class_uid).
{
"class_name": "Vulnerability Finding",
"class_uid": 2002,
"feed_name": "qualys_vuln_scanner",
"feed_version": null,
"first_seen": "2025-06-17T09:30:24",
"id": 589,
"last_seen": "2025-07-12T22:33:23.241000",
"product_id": 137,
"record_created_at": "2025-12-19T06:25:36.161000",
"record_updated_at": null
}Joining to CDPs and OCSF
By joining to other CDP and OCSF tables, information about
Example Queries
Display all the applications first_seen, last_seen by feed
SELECT * from cdp.application_feedDisplay when application was last scanned and joining with the application CDP
SELECT * FROM cdp.application_feed WHERE cdp.application_feed.class_uid is 2002 LEFT JOIN cdp.application