Application Feed

Purpose

The Application Feed CDP contains up-to-date information when an application was first seen and last seen by a particular feed. The Device Feed CDP is ideal for answering questions about when a device was last seen by a feed.

Understanding the Table

The Application Feed CDP contains first_seen and last_seen time stamps. These timestamps indicate when the application (identified by product_id) was last seen by a particular feed and event_type (identified by feed_name and class_uid).

{
	"class_name": "Vulnerability Finding",
	"class_uid": 2002,
	"feed_name": "qualys_vuln_scanner",
	"feed_version": null,
	"first_seen": "2025-06-17T09:30:24",
	"id": 589,
	"last_seen": "2025-07-12T22:33:23.241000",
	"product_id": 137,
	"record_created_at": "2025-12-19T06:25:36.161000",
	"record_updated_at": null
}

Joining to CDPs and OCSF

By joining to other CDP and OCSF tables, information about

Example Queries

Display all the applications first_seen, last_seen by feed

SELECT * from cdp.application_feed

Display when application was last scanned and joining with the application CDP

SELECT * FROM cdp.application_feed WHERE cdp.application_feed.class_uid is 2002  LEFT JOIN cdp.application

CDP Data Dictionary

Caption	Name	Requirement	Type	Description
Class Name	class_name	required	string_t	The class or category of the application feed.
Class UID	class_uid	required	integer_t	The unique identifier for the class or category of the application feed.
Feed Name	feed_name	required	string_t	The name of the data feed from which the application information was obtained.
Feed Version	feed_version	optional	string_t	The version of the data feed from which the application information was obtained.
First Seen	first_seen	required	timestamp_t	The timestamp when the application was first observed in this data feed.
ID	id	required	integer_t	Auto-incrementing unique identifier for each record.
Last Seen	last_seen	required	timestamp_t	The timestamp when the application was most recently observed in this data feed.
Product ID	product_id	required	integer_t	The unique identifier used by DataBee for a specific application. This links to the `id` field in the Application table.
Record Created At	record_created_at	required	timestamp_t	CDPs generated timestamp when record was created.
Record Updated At	record_updated_at	required	timestamp_t	CDPs generated timestamp when record was last updated.