The ExFileCatalog view provides access to the metadata for all unique hashes of files discovered on your computers.

To see this file data as it is displayed in the console, click Assets > Files in the console menu and then click the File Catalog tab.

Table 1. ExFileCatalog View Details

Field Name

Data Type Special Values Comments

File_Catalog_Id

int

 

Primary Key

Prevalence

int

 

Prevalence of this file – number of computers that currently have this file

First_Created

datetime

 

Date and time when this file was first created

File_Size

bigint

 

Size of this file in bytes

File_Type

varchar

Application, Package, Script File, Supporting File, Other, Unknown, Unrecognized Executed File

Type of this file

MD5

char

 

MD5 hash of this file

Sha1

char

 

SHA1 hash of this file

Sha256

char

 

SHA256 hash of this file (see Sha256_Hash_Type for interpretation of this field)

Sha256_Hash_Type

int

5 = regular hash

6 = MSI fuzzy hash

Type of the Sha256_Hash.

First_Seen_Computer_id

int

 

Foreign key into ExComputers table for computer on which the file was first seen

First_Seen_Name

nvarchar

 

File name where this file was first seen on any computer

First_Seen_Path

nvarchar

 

Path where this file was first seen on any computer. Uses the path delimiter for the OS of the first-seen computer.

Product_Name

nvarchar

 

Product name of this file

Product_Version

nvarchar

 

Product version of this file

Publisher

nvarchar

 

Publisher of this file (if file is signed with certificate)

Publisher_State

nvarchar

Approved, Approved by Policy, Unapproved, Banned, Banned by Policy

State of this publisher (if available); “none” for unsigned files

Publisher_State_Reason

nvarchar

Manual, Reputation, Imported, External (API), Unknown

Reason the file’s publisher is approved

Publisher_or_Company

nvarchar

 

Publisher (if available) or Company name (if no publisher info) of this file

Company

nvarchar

 

Company name of this file

Installed_Program_Name

nvarchar

 

If this file was an installer, the name of its installed program (that is, its name on the Add/Remove Programs page in Windows). No value for macOS or Linux files.

Trust

int

-1 = unknown

[0 – 10] valid values

Trust of this file; maximum=10

Trust_Messages

nvarchar

 

More information associated with this file’s trust

Threat

nvarchar

0 - Clean, 1 - Potential risk, 2 - Malicious, Unknown

Threat level of this file

Category

nvarchar

 

Category of this file

State

nvarchar

Unapproved, Approved, Banned, Approved by Policy, Banned by Policy, Mixed

Effective global file state for this file

File_State

nvarchar

Unapproved, Approved, Banned, Approved by Policy, Banned by Policy, Mixed

Global file state for this file

File_Flags

nvarchar

Comma-separated combination of one or more of the following: Installer,Not installer (Override), Installer (Override), Report Only Ban

Global file flags for this file

File_State_Reason

nvarchar

Manual, Trusted Directory, Reputation, Imported, External (API), Unknown

Reason for the approval state of this file

Approved_By_Reputation

varchar

Yes, No

Was this file approved because of its file or publisher Trust and Threat ratings in CB Reputation

Reputation_Enabled

varchar

Yes, No

Is reputation-based approval is enabled for this file

Certificate_Hash

char

 

Carbon Black App Control-proprietary hash that provides unique identifier for this certificate.

Certificate_State

nvarchar

Unapproved, Approved, Banned, Approved by Policy, Banned by Policy

Global State of the certificate for this file.

Invalid certificates are Unapproved in this field. Unsigned certificates are null.

Certificate_State_Reason

nvarchar

Manual, External (API)

State reason of the certificate (same as Publisher State Reason)

File_Extension

nvarchar

 

Extension of first seen file with this hash