ExFileCatalog

The ExFileCatalog view provides access to the metadata for all unique hashes of files discovered on your computers.

To see this file data as it is displayed in the console, click Assets > Files in the console menu and then click the File Catalog tab.

Table 1. ExFileCatalog View Details

Field Name	Data Type	Special Values	Comments
File_Catalog_Id	int		Primary Key
Prevalence	int		Prevalence of this file – number of computers that currently have this file
First_Created	datetime		Date and time when this file was first created
File_Size	bigint		Size of this file in bytes
File_Type	varchar	Application, Package, Script File, Supporting File, Other, Unknown, Unrecognized Executed File	Type of this file
MD5	char		MD5 hash of this file
Sha1	char		SHA1 hash of this file
Sha256	char		SHA256 hash of this file (see Sha256_Hash_Type for interpretation of this field)
Sha256_Hash_Type	int	5 = regular hash 6 = MSI fuzzy hash	Type of the Sha256_Hash.
First_Seen_Computer_id	int		Foreign key into ExComputers table for computer on which the file was first seen
First_Seen_Name	nvarchar		File name where this file was first seen on any computer
First_Seen_Path	nvarchar		Path where this file was first seen on any computer. Uses the path delimiter for the OS of the first-seen computer.
Product_Name	nvarchar		Product name of this file
Product_Version	nvarchar		Product version of this file
Publisher	nvarchar		Publisher of this file (if file is signed with certificate)
Publisher_State	nvarchar	Approved, Approved by Policy, Unapproved, Banned, Banned by Policy	State of this publisher (if available); “none” for unsigned files
Publisher_State_Reason	nvarchar	Manual, Reputation, Imported, External (API), Unknown	Reason the file’s publisher is approved
Publisher_or_Company	nvarchar		Publisher (if available) or Company name (if no publisher info) of this file
Company	nvarchar		Company name of this file
Installed_Program_Name	nvarchar		If this file was an installer, the name of its installed program (that is, its name on the Add/Remove Programs page in Windows). No value for macOS or Linux files.
Trust	int	-1 = unknown [0 – 10] valid values	Trust of this file; maximum=10
Trust_Messages	nvarchar		More information associated with this file’s trust
Threat	nvarchar	0 - Clean, 1 - Potential risk, 2 - Malicious, Unknown	Threat level of this file
Category	nvarchar		Category of this file
State	nvarchar	Unapproved, Approved, Banned, Approved by Policy, Banned by Policy, Mixed	Effective global file state for this file
File_State	nvarchar	Unapproved, Approved, Banned, Approved by Policy, Banned by Policy, Mixed	Global file state for this file
File_Flags	nvarchar	Comma-separated combination of one or more of the following: Installer,Not installer (Override), Installer (Override), Report Only Ban	Global file flags for this file
File_State_Reason	nvarchar	Manual, Trusted Directory, Reputation, Imported, External (API), Unknown	Reason for the approval state of this file
Approved_By_Reputation	varchar	Yes, No	Was this file approved because of its file or publisher Trust and Threat ratings in CB Reputation
Reputation_Enabled	varchar	Yes, No	Is reputation-based approval is enabled for this file
Certificate_Hash	char		Carbon Black App Control-proprietary hash that provides unique identifier for this certificate.
Certificate_State	nvarchar	Unapproved, Approved, Banned, Approved by Policy, Banned by Policy	Global State of the certificate for this file. Invalid certificates are Unapproved in this field. Unsigned certificates are null.
Certificate_State_Reason	nvarchar	Manual, External (API)	State reason of the certificate (same as Publisher State Reason)
File_Extension	nvarchar		Extension of first seen file with this hash