ExFileInstances

The ExFileInstances view provides access to the metadata for each instance of each hash found on each computer at your site.

To see this file data displayed in the console, click Assets > Files in the console menu and then click the File on Computers tab. To see the complete File Instance details for any one file, from the Files on Computers tab, click the View Details button next to the file.

Table 1. ExFileInstances View Details

Field Name	Data Type	Special Values	Comments
File_Instance_Id	bigint		Primary Key
File_Instance_Group_Id	int		Foreign key into ExFileInstanceGroups table for group that contains this file
File_Catalog_Id	int		Foreign key into ExFileCatalog table for details about this file
Computer_Id	int		Foreign key into ExComputers table for computer that has this file
Date_Created	datetime		Date and time (UTC) when file was created
File_Name	nvarchar		Name of this file
Path_Name	nvarchar		Path of this file. Uses OS-specific delimiter for the agent where the file is located.
Executed	varchar	Yes, No	Yes if this file was ever executed
Local_State	nvarchar	Unapproved, Approved, Banned	Local state of this file
Detailed_Local_State	nvarchar	Approved (Not Persisted) Unapproved (Persisted) Banned by Hash Locally Approved Banned by Name Banned by Name (Report Only) Locally Approved (Auto) Approved as Installer Approved Approved as Installer (Top Level) Banned by Hash (Report Only) Unapproved	Detailed local state of this file
Detached_Publisher	nvarchar		Name of the detached publisher. Note that embedded publishers can be retrieved through a join with ExFileCatalog.
Detached_Publisher_State	nvarchar	Approved, Approved by Policy, Unapproved, Banned, Banned by Policy	State of the detached publisher (if available); “none” for unsigned files
Detached_Publisher_State_Reason	nvarchar	Manual, Imported, External (API), Unknown	Reason for the state of this file’s publisher
Detached_Certificate_Hash	char		Carbon Black App Control-proprietary hash of the detached certificate. Embedded certificates can be retrieved through a join with ExFileCatalog.
Detached_Certificate_State	nvarchar	Unapproved, Approved, Banned, Approved by Policy, Banned by Policy	Global state of the detached certificate Invalid certificates are Unapproved in this field. Unsigned certificates are null.
Detached_Certificate_State_Reason	nvarchar	Manual, Imported, External (API), Unknown	Reason for the state of the file’s detached certificate (same as Publisher State reason)