Purpose
The Cloud Table Core Data Product is an inventory of your cloud data-table resources, such as NoSQL tables. Each asset appears once, no matter how many feeds report it, and the table keeps both its current state and its history. Use it to see which tables exist, when they first appeared and when they were closed, and to join back to OCSF activity and findings that involve those resources.
Entity Correlation
The Entity Correlator identifies a cloud asset by its unique ID (uid), for example an Amazon
Resource Name. When several feeds report the same uid, they are merged into a single asset with a single id. If feeds disagree about a value, feed priority and recency decide which one is kept.
Understanding the Table
When a value on an asset changes, a new row is created, and active is set to false on the older rows, so each asset has exactly one row with active = TRUE. The table is refreshed hourly.
An asset appears in this table when the feed that reports it classifies it as a table (type ID 3). The end_time field is populated when an asset is closed: either the source reports it as decommissioned, or no feed has reported it for the cloud-resource retention period (365 days by default, configurable). A closed asset has active = FALSE. If a closed asset is reported again, it is tracked as a new asset with a new id.
Joining to CDPs and OCSF
cloud_table.id identifies the asset across all of its history rows. OCSF event tables that reference cloud resources carry the asset in their resources array, and each element's id matches the CDP id. Join on that element to find the activity and findings that involve a table.
Schema
Example Queries
Find all active cloud tables
SELECT * FROM cloud_table WHERE active=TRUE
Find the latest record for a given id
SELECT * FROM cloud_table WHERE active=TRUE AND id={id}
Find the largest active cloud tables
SELECT id, name, uid, size
FROM cloud_table
WHERE active=TRUE
ORDER BY size DESC NULLS LAST
How to join back to OCSF
SELECT t.name, a.*
FROM OCSF.{activity} a,
LATERAL FLATTEN(input => a.resources) r,
CDP.cloud_table t
WHERE t.id = r.value:id::INT
AND t.active=TRUE