Field Value Reference
Overview
Several columns on the consumption views hold a fixed, small set of values rather than free text. This page lists those values so you can write exact WHERE and GROUP BY clauses without guessing at casing or spelling.
Match every string value case-insensitively with LOWER(). See Match strings case-insensitively in the query cookbook.
Severity and risk rating
severity (on v_findings) and riskRating (on v_assets, v_tickets, and other entity views) share the same five-tier scale. Both are strings with a numeric prefix, so they sort correctly as text:
| Value | Meaning |
|---|---|
0-none | None |
2-low | Low |
3-medium | Medium |
4-high | High |
5-critical | Critical |
There is no 1 tier. The prefixes skip straight from 0 to 2.
severity_bucket is the integer form of severity, extracted from the leading number (4-high becomes 4). Valid values are 0, 2, 3, 4, 5. It's NULL when severity has no numeric prefix at all, which happens with some connector-supplied values (for example a value like BestPractice). Use severity_bucket for numeric thresholds (severity_bucket >= 4), and severity when you want the display string.
severity_bucket is exposed on the daily and trend consumption views (v_findings_daily, v_findings_trend) and on v_mttr_sla. It is not a column on v_findings itself, so use severity there instead.
See severity vs severity_bucket in Core concepts for more detail.
v_business_services uses the same five-tier scale for criticality, so 0-none through 5-critical apply there too.
Compliance status
complianceStatus takes a different shape depending on which view you're querying.
On v_findings and v_tickets, complianceStatus measures standing against an SLA target:
| Value | Meaning |
|---|---|
out of sla | Past the SLA target with no exception |
met sla | Closed within the SLA target |
exceeded sla | Closed past the SLA target |
within sla | Still open, inside the SLA target |
no sla required | No SLA target applies |
On v_assets and most other entity views (including v_business_services), complianceStatus is a simple two-value flag:
| Value | Meaning |
|---|---|
compliant | Meets the applicable compliance requirement |
non compliant | Does not meet the applicable compliance requirement |
Check which shape a view uses before filtering. Comparing an asset's complianceStatus against 'out of sla' never matches.
Lifecycle status
lifecycleStatus is exposed on v_business_services, v_cve_details (as cve_lifecycle_status), v_findings_daily, and v_findings_trend. It is not surfaced on v_findings or v_assets at the view layer, even though the underlying data carries the column:
| Value | Meaning |
|---|---|
active | Currently active |
inactive | No longer active |
na | Not applicable |
Asset status
The status column on v_assets:
| Value | Meaning |
|---|---|
confirmed active | Verified as currently active |
assumed active | Presumed active, not independently verified |
assumed inactive | Presumed inactive, not independently verified |
unknown | Status could not be determined |
stopped | Stopped (for example a powered-off cloud resource) |
terminated | Permanently decommissioned |
Ticket status
The status column on v_tickets:
| Value | Meaning |
|---|---|
open | Newly created, not yet worked |
reopened | Previously closed, reopened |
in progress | Actively being worked |
closed | Resolved |
statusCategory is not on this list
statusCategory (on v_findings, v_tickets, and v_assets) is deliberately left off the tables above. It's a customer-configurable grouping computed from each customer's own status workflow, not a fixed enumeration. The values that show up depend on how that customer's workflow is configured, so there's no canonical list to publish here.
Read the actual values back from your own data first, for example SELECT DISTINCT statusCategory FROM ..., then filter on the value your configuration uses (WHERE LOWER(statusCategory) = LOWER('open') is a normal query once you've confirmed 'open' is one of your values). statusCategory also works well as a GROUP BY dimension when you want the full breakdown instead of one filtered value. See statusCategory is a dimension, not a filter in Core concepts.
Using these values in queries
-- Critical findings
SELECT id, displayName, severity
FROM `gold_adm_views.v_findings`
WHERE LOWER(severity) = LOWER('5-critical')
-- Critical findings, grouped by status category
SELECT statusCategory, COUNT(*) AS finding_count
FROM `gold_adm_views.v_findings`
WHERE LOWER(severity) = LOWER('5-critical')
GROUP BY statusCategory
-- Assets out of compliance
SELECT id, displayName, complianceStatus
FROM `gold_adm_views.v_assets`
WHERE LOWER(complianceStatus) = LOWER('non compliant')
-- Tickets past their SLA target
SELECT id, displayName, complianceStatus
FROM `gold_adm_views.v_tickets`
WHERE LOWER(complianceStatus) = LOWER('out of sla')