Consumption View Reference

Column reference for every consumption view in your BrinqaDL dataset. Views are grouped by purpose, highest-value first.

Join views on numeric id columns (never uid); -1 is the Unknown sentinel; filter ARRAY<...> columns with 'value' IN UNNEST(col); every view carries _changed_at DATE for incremental pulls.

Core inventory

v_findings

All security findings pre-joined with definitions, assets, environments, and owners. Grain: one row per finding.

Column	Type	Description
id	INT64	Finding id (latest record for this uid)
uid	STRING	Logical finding identity - unique across v_findings.
finding_type	STRING	Finding type (Vulnerability, Violation, Alert, etc.)
_source_table	STRING	Internal source table tag.
displayName	STRING	Computed name whose computation is handled by the child data model.
name	STRING	Name of the entity.
severity	STRING	Finding severity level
status	STRING	Finding status
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
riskScore	FLOAT64	Finding risk score
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
complianceStatus	STRING	Whether or not this finding fulfilled the sla requirements
slaLevel	STRING	The name of the associated sla level
sla	FLOAT64	The number of sla days this finding requires
daysToFix	FLOAT64	The number of days it took to close this finding
confidence	STRING	The level of certainty that this vulnerability exists.
connectorNames	ARRAY<STRING>	The collection of distinct connector names for the source model data sets.
connectorCategories	ARRAY<STRING>	The collection of distinct connector categories for the source model data sets.
dataIntegrationTitles	ARRAY<STRING>	The collection of distinct data integration titles for the source model data sets.
deployment_models	ARRAY<STRING>	Distinct deployment models (OnPrem/Cloud) derived from the finding's connectors via v_connectors. Empty array for AppSec-only / uncatalogued findings. Single-valued today (findings are 1-connector). Filter with 'OnPrem' IN UNNEST(deployment_models).
firstFound	TIMESTAMP	Timestamp when the finding was first found.
lastFound	TIMESTAMP	Timestamp when the finding was last found.
lastUpdated	TIMESTAMP	Last modification date.
dateCreated	TIMESTAMP	Creation date.
dueDate	TIMESTAMP	When this finding needs to be closed by to meet the sla requirement
port	INT64	The port number on the target host that is impacted by the brinqaFinding.
protocol	STRING	The communication protocol for a given network service on the target host impacted by the brinqaFinding.
codeSnippet	STRING	The section of code the static code finding was discovered in.
fileName	STRING	Name of the export file
method	STRING	The method the finding was found in.
path	STRING	The path to the resource.
url	STRING	The external link to the security advisory.
definition_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_definitions on its id.
definition_name	STRING	CVE/CWE definition name
definition_category	STRING	The category of the finding definition.
definition_severity	STRING	Severity of the finding definition.
cveIds	ARRAY<STRING>	The CVE identifiers.
cvssV3BaseScore	FLOAT64	The CVSS v3 base score.
is_kev	BOOL	TRUE if any linked CVE is in CISA's Known Exploited Vulnerabilities (KEV) catalog.
max_epss_score	FLOAT64	Highest normalized EPSS score across linked CVEs (0.0-1.0). Normalized: raw values >1 are treated as percentages and divided by 100.
max_cvss	FLOAT64
cve_count	INT64	Count of related cve for this row.
asset_count	INT64	Count of related asset for this row.
asset_names	ARRAY<STRING>	Human-readable name(s) of the associated asset.
environment_ids	ARRAY<INT64>	Array of related environment identifiers. Filter with 'value' IN UNNEST(col).
environment_names	ARRAY<STRING>	Human-readable name(s) of the associated environment.
asset_id	INT64
asset_name	STRING	Related asset name
asset_display_name	STRING	Human-readable name(s) of the associated asset display.
asset_type	STRING	Asset type (Host, ContainerImage, etc.)
asset_status	STRING	Status of the asset.
asset_risk_score	FLOAT64
environment_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_environments on its id.
environment_name	STRING	Environment name for the asset
finding_type_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_types on its id.
finding_type_name	STRING	Human-readable name(s) of the associated finding type.
finding_profile_ids	ARRAY<INT64>	Array of related finding profile identifiers. Filter with 'value' IN UNNEST(col).
finding_profile_names	ARRAY<STRING>	Human-readable name(s) of the associated finding profile.
affected_technology_ids	ARRAY<INT64>	Array of related affected technology identifiers. Filter with 'value' IN UNNEST(col).
affected_technology_names	ARRAY<STRING>	Human-readable name(s) of the associated affected technology.
informed_user_ids	ARRAY<INT64>	Array of related informed user identifiers. Filter with 'value' IN UNNEST(col).
informed_user_names	ARRAY<STRING>	Human-readable name(s) of the associated informed user.
risk_factors	ARRAY<STRUCT<id INT64, name STRING, value FLOAT64, reason STRING, icon STRING, riskFactorVersion STRING>>	Risk factors contributing to the finding's score - array of {id, name, value, reason, icon, riskFactorVersion} structs.
cwe_ids	ARRAY<INT64>	Array of related cwe identifiers. Filter with 'value' IN UNNEST(col).
cwe_uids	ARRAY<STRING>	Array of related cwe identifiers. Filter with 'value' IN UNNEST(col).
cwe_names	ARRAY<STRING>	Human-readable name(s) of the associated cwe.
attack_technique_ids	ARRAY<INT64>	Array of related attack technique identifiers. Filter with 'value' IN UNNEST(col).
attack_technique_uids	ARRAY<STRING>	Array of related attack technique identifiers. Filter with 'value' IN UNNEST(col).
attack_technique_names	ARRAY<STRING>	Human-readable name(s) of the associated attack technique.
risk_owner_id	INT64	FK → v_owner_details (risk owner). Join: v_owner_details.owner_id.
remediation_owner_id	INT64	FK → v_owner_details (remediation owner).
risk_scoring_model_id	INT64	FK → v_risk_scoring_models.
status_config_model_id	INT64	FK → v_status_config_models.
sla_definition_id	INT64	FK → v_sla_definitions.
lastFixed	TIMESTAMP
extendedDueDate	TIMESTAMP	Extended remediation due date.
risk_owner	STRING	Risk owner display name
risk_owner_type	STRING
remediation_owner	STRING	Remediation owner display name
remediation_owner_type	STRING
exception_request_id	INT64	id of the finding's most-recently-updated ExceptionRequest (v_request_details); NULL if the finding has no exception.
exception_name	STRING	Name of that ExceptionRequest; NULL if none.
exception_status	STRING	Status of that ExceptionRequest; NULL if none.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).
_row_hash	INT64	Internal change-detection hash. Ignore.

v_assets

Current asset inventory with owner details. Grain: one row per asset.

Column	Type	Description
id	INT64	Asset id
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Computed name whose computation is handled by the child data model.
asset_type	STRING	Asset type (Host, ContainerImage, Application, etc.)
status	STRING	Asset status
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
riskScore	FLOAT64	Asset risk score
riskRating	STRING	The risk score of this asset, on a scale between none and critical
complianceStatus	STRING	The compliance status of the asset.
cloudProvider	STRING	The name of cloud provider providing the resource.
cloudInstanceId	STRING	The unique identifier the cloud provider has given this host.
resourceType	STRING	The name of resource type providing the resource.
os	STRING	The full operating system of the host.
tags	ARRAY<STRING>	A label to help identify or track assets.
projects	ARRAY<STRING>
categories	ARRAY<STRING>	The categories of the entity.
connectorNames	ARRAY<STRING>	The collection of distinct connector names for the source model data sets.
connectorCategories	ARRAY<STRING>	The collection of distinct connector categories for the source model data sets.
dataIntegrationTitles	ARRAY<STRING>	The collection of distinct data integration titles for the source model data sets.
deployment_models	ARRAY<STRING>	Distinct deployment models (OnPrem/Cloud) derived from the asset's connectors via v_connectors. Empty array for AppSec-only / uncatalogued / no-connector assets. Filter with 'OnPrem' IN UNNEST(deployment_models).
firstSeen	TIMESTAMP	Timestamp when this record was first seen.
lastSeen	TIMESTAMP	Timestamp when this record was last seen.
lastAssessed	TIMESTAMP	Last assessment timestamp
dateCreated	TIMESTAMP	Creation date.
lastUpdated	TIMESTAMP	Last modification date.
asset_type_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_asset_types on its id.
asset_type_name	STRING	Human-readable name(s) of the associated asset type.
asset_profile_ids	ARRAY<INT64>	Array of related asset profile identifiers. Filter with 'value' IN UNNEST(col).
asset_profile_names	ARRAY<STRING>	Human-readable name(s) of the associated asset profile.
asset_technology_ids	ARRAY<INT64>	Array of related asset technology identifiers. Filter with 'value' IN UNNEST(col).
asset_technology_names	ARRAY<STRING>	Human-readable name(s) of the associated asset technology.
os_family_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_os_families on its id.
os_family_name	STRING	Human-readable name(s) of the associated os family.
informed_user_ids	ARRAY<INT64>	Array of related informed user identifiers. Filter with 'value' IN UNNEST(col).
informed_user_names	ARRAY<STRING>	Human-readable name(s) of the associated informed user.
business_service_names	ARRAY<STRING>	Human-readable name(s) of the associated business service.
business_service_owner_names	ARRAY<STRING>	Human-readable name(s) of the associated business service owner.
image_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to the corresponding dimension view on its id.
image_name	STRING	Human-readable name(s) of the associated image.
environment_ids	ARRAY<INT64>	Array of related environment identifiers. Filter with 'value' IN UNNEST(col).
environment_names	ARRAY<STRING>	Human-readable name(s) of the associated environment.
environment_id	INT64	Scalar FK → v_environments - first environment id at the latest snapshot, consistent with environment_ids.
risk_owner_id	INT64	FK → v_owner_details for the asset's risk owner cluster
remediation_owner_id	INT64	FK → v_owner_details for the asset's remediation owner cluster
risk_scoring_model_id	INT64	FK → v_risk_scoring_models
status_config_model_id	INT64	FK → v_status_config_models
sla_definition_id	INT64	FK → v_sla_definitions
host_id	INT64	FK → v_assets for the parent Host (ContainerImage type only)
host_image_id	INT64	Foreign key to the associated HostImage asset (numeric). -1 is the Unknown sentinel; join to v_assets on its id.
cloud_account_id	INT64	Customers with a CloudAccount custom model carry a live FK; unmatched assets carry -1 (never-NULL-FK sentinel). Customers without the model always carry CAST(NULL AS INT64).
external_facing	BOOL	TRUE when the asset has any canonical public-internet signal (publiclyAccessible, non-empty publicIpAddresses, or publicDnsName). Always FALSE (never NULL) via COALESCE.
owner_count	INT64	Count of related owner for this row.
owner_names	STRING	Human-readable name(s) of the associated owner.
owner_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_owner_details on its id.
owner_name	STRING
ownerType	STRING	Owner type (Person, Team, etc.)
ipAddresses	ARRAY<STRING>	All IP addresses for the asset (from v_assets; populated on the Host subtype only - other asset subtypes emit []). Empty array if none.
publicIpAddresses	ARRAY<STRING>	Public IP addresses (from v_assets; Host subtype only). Empty array if none.
privateIpAddresses	ARRAY<STRING>	Private IP addresses (from v_assets; Host subtype only). Empty array if none.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_tickets

All remediation tickets with linked-finding counts.

Column	Type	Description
id	INT64	Ticket id
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Computed name whose computation is handled by the child data model.
ticket_type	STRING	Ticket type (VulnerabilityTicket, ViolationTicket, etc.)
_source_table	STRING	Internal source table tag.
status	STRING	Ticket status
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
riskScore	FLOAT64	The maximum risk score of findings in ticket
riskRating	STRING	The risk rating of the finding with the greatest risk score in the ticket
complianceStatus	STRING	Whether or not this ticket fulfilled the SLA requirements
slaLevel	STRING	The name of the associated sla level
sla	FLOAT64	The number of sla days this ticket requires
daysToFix	FLOAT64	The number of days it took to close this finding
progress	FLOAT64	The percentage of source findings closed
dateCreated	TIMESTAMP	Ticket creation date
dueDate	TIMESTAMP	When this ticket needs to be closed by to meet the SLA requirement
dateClosed	TIMESTAMP	Ticket closure date
lastUpdated	TIMESTAMP	Last modification date.
sprint_id	INT64	Sprint FK (from v_tickets; NULL when ticket has no sprint)
linked_finding_count	INT64	Number of findings linked to this ticket
finding_ids	ARRAY<INT64>
asset_ids	ARRAY<INT64>
environment_id	INT64	FK to v_environments; NULL when no environment association; correlated with environment_name via single STRUCT pick
environment_name	STRING	Human-readable name(s) of the associated environment.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Risk and compliance KPIs

v_risk_summary

Findings summarized by type, severity, and statusCategory, with affected-asset counts.

Column	Type	Description
environment_name	STRING	Human-readable name(s) of the associated environment.
finding_type	STRING	Finding type (dataModelName)
severity	STRING	Severity level
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
finding_count	INT64	Number of findings
avg_risk_score	FLOAT64	Average risk score
affected_assets	INT64	Approximate count of distinct affected assets
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_compliance_posture

Finding counts by severity and statusCategory with pre-computed category rates.

Column	Type	Description
environment_name	STRING	Environment name
severity	STRING	Severity level (NULL group exists for findings without severity)
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
finding_count	INT64	Number of findings in this category
total_count	INT64	Total findings across all categories for this severity
category_rate	FLOAT64	Ratio of finding_count to total_count (0.0 to 1.0)
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_mttr_sla

Mean-time-to-remediate and SLA attainment by severity, status, and SLA definition, over rolling windows.

Column	Type	Description
remediation_date	DATE
window_days	INT64
entity_type	STRING
severity_bucket	INT64
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
dataModelName	STRING	The name of the most specific data model for this data set.
slaDefinitionName	STRING
sla_definition_id	INT64	FK → v_sla_definitions (-1 sentinel when no SLA definition applies).
complianceStatus	STRING	Whether or not this finding fulfilled the sla requirements
remediated_count	INT64	Count of related remediated for this row.
sum_mttr_days	INT64
cnt_mttr_days	INT64
within_sla_count	INT64	Count of related within sla for this row.
cnt_sla	INT64
avg_mttr_days	FLOAT64
pct_within_sla	FLOAT64
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_mttr_sla_by_env

Mean-time-to-remediate and SLA attainment broken out by environment.

Column	Type	Description
remediation_date	DATE
window_days	INT64
environment_name	STRING	Human-readable name(s) of the associated environment.
environment_id	INT64	FK → v_environments - numeric companion to environment_name. NULL when no environment association (the '(no environment)' sentinel carries NULL here, not -1).
severity_bucket	INT64
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
dataModelName	STRING	The name of the most specific data model for this data set.
slaDefinitionName	STRING
sla_definition_id	INT64	FK → v_sla_definitions (-1 sentinel when no SLA definition applies).
complianceStatus	STRING	Whether or not this finding fulfilled the sla requirements
remediated_count	INT64	Count of related remediated for this row.
sum_mttr_days	INT64
cnt_mttr_days	INT64
within_sla_count	INT64	Count of related within sla for this row.
cnt_sla	INT64
avg_mttr_days	FLOAT64
pct_within_sla	FLOAT64
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_coverage_gaps

Assets never scanned or not scanned in 30+ days.

Column	Type	Description
id	INT64	Asset id
name	STRING	Name of the entity.
displayName	STRING	Computed name whose computation is handled by the child data model.
asset_type	STRING	Asset type (Host, ContainerImage, etc.)
status	STRING	Asset status
lastAssessed	TIMESTAMP	Last assessment timestamp (NULL if never scanned)
days_since_scan	INT64	Days since last assessment (NULL if never scanned)
environment_id	INT64	FK to v_environments; NULL when no environment association; correlated with environment_name via single STRUCT pick
environment_name	STRING	Human-readable name(s) of the associated environment.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Trends and change tracking

v_findings_daily

Daily open finding inventory by environment, type, severity, and compliance. Snapshot counts, not deltas.

Column	Type	Description
snapshot_date	DATE	Date of the inventory snapshot
environment_name	STRING	Environment name
environment_id	INT64	FK → v_environments - environment id for the snapshot grain. NULL when no environment association. Forward-only: historical partitions written before the deploy carry NULL; only partitions written after deploy are populated.
dataModelName	STRING	Finding data model name
severity_bucket	INT64	Integer severity bucket (FLOOR of raw CVSS-like float)
riskRating	STRING	Risk rating
complianceStatus	STRING	Compliance status
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
lifecycleStatus	STRING	Lifecycle status (active, inactive, na)
status	STRING	Current status of the finding
slaLevel	STRING	SLA compliance level
cisaDueDateExpired	BOOL	Whether the CISA due date has expired
finding_count	INT64	Finding count for this dimension group
avg_risk_score	FLOAT64	Average risk score for the group
avg_base_risk_score	FLOAT64	Average base risk score for the group
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_findings_trend

Finding inventory trends at daily, weekly, and monthly granularity. Always filter granularity.

Column	Type	Description
granularity	STRING	Time granularity: 'daily', 'weekly', or 'monthly'
period_date	DATE	Start date for the period (day, week Monday, or month start)
environment_name	STRING	Environment name (e.g. Production, Staging)
environment_id	INT64	FK → v_environments - environment id for the trend grain. NULL when no environment association. Forward-only: historical rows written before the deploy carry NULL.
finding_type	STRING	Finding data model name (e.g. Vulnerability, Violation)
severity_bucket	INT64	Integer severity bucket (FLOOR of raw CVSS-like float)
riskRating	STRING	Risk rating
complianceStatus	STRING	Compliance status
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
lifecycleStatus	STRING	Lifecycle status (active, inactive, na)
status	STRING	Current status of the finding
slaLevel	STRING	SLA compliance level
cisaDueDateExpired	BOOL	Whether the CISA due date has expired
finding_count	INT64	Finding count for this dimension group
avg_risk_score	FLOAT64	Average risk score for the group
avg_base_risk_score	FLOAT64	Average base risk score for the group
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_findings_by_org_trend

Finding trends broken out by organizational dimension at daily/weekly/monthly granularity. A finding linked to multiple organizational units is counted once per unit, so per-unit counts can sum to more than the overall total; don't reconcile against v_findings_trend.

Column	Type	Description
granularity	STRING	Time granularity: 'daily', 'weekly', or 'monthly'
period_date	DATE	Start date for the period (day, week Monday, or month start)
wbdL2Name	STRING	Org layer 2 name (e.g. business division)
wbdL3Name	STRING	Org layer 3 name (e.g. department)
wbdL4Name	STRING	Org layer 4 name
wbdL5Name	STRING	Org layer 5 name
wbdL6Name	STRING	Org layer 6 name (cloud account / leaf)
severity_bucket	INT64	Integer severity bucket (FLOOR of raw CVSS-like float)
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
finding_count	INT64	Finding count for this org/period/severity/status group
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_changes_daily

Daily NEW/CHANGED/UNSEEN counts across findings, assets, tickets, and owners. Always filter entity_type.

Column	Type	Description
entity_type	STRING	Entity type: 'finding', 'asset', 'ticket', or 'owner'
change_date	DATE	Date of the state changes
environment_name	STRING	Environment name (finding + asset only, NULL for ticket/owner)
environment_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_environments on its id.
dataModelName	STRING	Entity data model name
severity	STRING	Severity level (finding only, NULL for others)
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
new_count	INT64	Entities that appeared (NEW event type)
changed_count	INT64	Entities with state changes (CHANGED event type)
unseen_count	INT64	Entities no longer seen (UNSEEN event type)
status_transitioned_count	INT64	Count of findings/tickets that transitioned to a different statusCategory
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_changes_weekly

Weekly change counts across findings, tickets, and owners (ISO weeks; no asset rows).

Column	Type	Description
entity_type	STRING	Entity type: 'finding', 'ticket', or 'owner'
change_week	DATE	Week start date (Monday)
environment_name	STRING	Environment name (finding only, NULL for ticket/owner)
environment_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_environments on its id.
dataModelName	STRING	Entity data model name
severity	STRING	Severity level (finding only, NULL for others)
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
new_count	INT64	Entities that appeared during the week
changed_count	INT64	Entities with state changes during the week
unseen_count	INT64	Entities no longer seen during the week
status_transitioned_count	INT64	Count of findings/tickets that transitioned to a different statusCategory during the week
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_status_transitions

Daily counts of findings that changed statusCategory.

Column	Type	Description
transition_date	DATE	Date the status transition was detected
environment_name	STRING	Environment name
environment_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_environments on its id.
dataModelName	STRING	Finding data model name
severity	STRING	Severity level
status	STRING	Current status value after transition
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
prev_statusCategory	STRING	Previous statusCategory before transition
transition_count	INT64	Count of findings that transitioned
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

History and time travel

v_finding_history

Time-travel event log for reconstructing finding state at any past date. A filter on event_date is required.

Column	Type	Description
event_date	DATE	Date the event was recorded
event_type	STRING	Type of state change: NEW, CHANGED, or UNSEEN
id	INT64	Finding ID (numeric)
finding_type	STRING	Finding data model name (e.g. Vulnerability, Violation)
status	STRING	Finding status at time of event
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
severity	STRING	Severity level at time of event
riskScore	FLOAT64	Calculated risk score at time of event
baseRiskScore	FLOAT64	The risk score without any risk factors applied
riskRating	STRING	Risk score bucketed into a label
complianceStatus	STRING	Compliance status at time of event
slaLevel	STRING	The name of the associated sla level
firstFound	TIMESTAMP	Timestamp when the finding was first found.
lastFound	TIMESTAMP	Timestamp when the finding was last found.
definition_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_definitions on its id.
definition_name	STRING	CVE/CWE definition display name
definition_category	STRING	The category of the finding definition.
definition_severity	STRING	Severity of the finding definition.
asset_count	INT64	Count of related asset for this row.
asset_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_assets on its id.
asset_name	STRING	Name of the affected asset
asset_type	STRING	Asset data model name (e.g. Host, Container)
environment_id	INT64	FK to v_environments; NULL when no environment association; correlated with environment_name via single STRUCT pick
environment_name	STRING	Human-readable name(s) of the associated environment.
risk_owner_id	INT64	FK to v_owner_details for the risk owner (-1 sentinel when none)
remediation_owner_id	INT64	FK to v_owner_details for the remediation owner (-1 sentinel when none)
risk_owner	STRING	Risk owner display name
remediation_owner	STRING	Remediation owner display name
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_history

Time-travel event log for reconstructing asset state at any past date. A filter on event_date is required.

Column	Type	Description
event_date	DATE	Date the event was recorded
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).
event_type	STRING	Type of state change: NEW, CHANGED, or UNSEEN
id	INT64	Asset ID (numeric)
asset_type	STRING	Asset type (Host, ContainerImage, Application, etc.)
status	STRING	Asset status at time of event
riskScore	FLOAT64	Risk score at time of event
riskRating	STRING	Risk rating label at time of event
complianceStatus	STRING	Compliance status at time of event
lastSeen	TIMESTAMP	Timestamp when this record was last seen.
lastAssessed	TIMESTAMP	Last assessment timestamp at time of event
firstSeen	TIMESTAMP	Timestamp when this record was first seen.
lastUpdated	TIMESTAMP	Last modification date.
environment_id	INT64	FK → v_environments - first environment id for the asset. NULL when no environment association.
environment_name	STRING	Human-readable name(s) of the associated environment.
risk_owner_id	INT64	FK → v_owner_details for the asset's risk owner (-1 sentinel when none).
remediation_owner_id	INT64	FK → v_owner_details for the asset's remediation owner (-1 sentinel when none).
risk_owner	STRING	Risk owner display name
remediation_owner	STRING	Remediation owner display name

v_asset_owner_history

Daily snapshots of asset-owner links. A snapshot_date filter is required.

Column	Type	Description
snapshot_date	DATE	Date of the bridge snapshot
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).
asset_id	INT64	Asset ID (numeric)
owner_id	INT64	Owner ID (numeric)
asset_name	STRING	Asset display name at current state
asset_status	STRING	Status of the asset.
asset_riskScore	FLOAT64	The risk score of this asset, on a scale between 1-10
asset_riskRating	STRING	The risk score of this asset, on a scale between none and critical
owner_name	STRING	Owner display name at current state
ownerType	STRING	Owner type (Person, Team, RemediationOwner, RiskOwner, User)

v_finding_asset_history

Daily snapshots of finding-asset links. A snapshot_date filter is required.

Column	Type	Description
snapshot_date	DATE	Date of the bridge snapshot
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).
finding_id	INT64	Finding ID (numeric)
asset_id	INT64	Asset ID (numeric)
definition_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_definitions on its id.
severity	STRING	Finding severity at current state
status	STRING	Finding status at current state
riskRating	STRING	Finding risk rating at current state
dataModelName	STRING	Finding type (e.g. Vulnerability, Misconfiguration)
asset_name	STRING	Asset display name at current state
asset_type	STRING	Asset type (e.g. Host, Application)

Threat intelligence

v_cve_details

Per-(finding, CVE) drilldown with full CVSS v2/v3 vectors, threat intel, and CVE catalog metadata.

Column	Type	Description
finding_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_findings on its id.
finding_name	STRING	Human-readable name(s) of the associated finding.
severity	STRING	Severity of the CVE.
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
dataModelName	STRING	The name of the most specific data model for this data set.
status	STRING	Status of the finding
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
cve_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_cve on its id.
cve_uid	STRING	Stable logical identifier of the related cve. Join on the corresponding id column, not this one.
cve_name	STRING	Human-readable name(s) of the associated cve.
cvssV2BaseScore	FLOAT64	The CVSS v2 base score.
cvssV3BaseScore	FLOAT64	The CVSS v3 base score.
cvssV3AttackVector	STRING	The CVSS v3 attack vector.
cvssV3AttackComplexity	STRING	The CVSS v3 attack complexity.
cvssV3PrivilegesRequired	STRING	The CVSS v3 privileges required.
cvssV3UserInteraction	STRING	The CVSS v3 user interaction.
cvssV3ConfidentialityImpact	STRING	The CVSS v3 confidentiality impact.
cvssV3IntegrityImpact	STRING	The CVSS v3 integrity impact.
cvssV3AvailabilityImpact	STRING	The CVSS v3 availability impact.
cvssV3ExploitCodeMaturity	STRING	The CVSS v3 exploit code maturity.
cvssV3RemediationLevel	STRING	The CVSS v3 remediation level.
cvssV3ReportConfidence	STRING	The CVSS v3 report confidence.
cvssV3BaseVectorSource	STRING
cvssV3TemporalVectorSource	STRING
cvssV2AccessVector	STRING	The CVSS v2 access vector.
cvssV2AccessComplexity	STRING	The CVSS v2 access complexity.
cvssV2Authentication	STRING	The CVSS v2 authentication.
cvssV2ConfidentialityImpact	STRING	The CVSS v2 confidentiality impact.
cvssV2IntegrityImpact	STRING	The CVSS v2 integrity impact.
cvssV2AvailabilityImpact	STRING	The CVSS v2 availability impact.
cvssV2Exploitability	STRING	The CVSS v2 exploitability.
cvssV2RemediationLevel	STRING	The CVSS v2 remediation level.
cvssV2ReportConfidence	STRING	The CVSS v2 report confidence.
cvssV2BaseVectorSource	STRING
cvssV2TemporalVectorSource	STRING
exploits	ARRAY<STRING>	The known exploits for this vulnerability in various databases such as Exploit-DB, Metasploit, Core Security, etc.
malware	ARRAY<STRING>	The associated malware information for this vulnerability.
firstReportedThreatActor	TIMESTAMP
lastReportedThreatActor	TIMESTAMP
knownActiveRansomwareCampaign	STRING
affected	ARRAY<STRING>	Provides information about the set of products, software packages and services affected by this vulnerability.
cve_description	STRING	An extended description of the entity.
daysToFirstDetection	FLOAT64	The number of days between the definition being published and the first found of any finding associated with this CVE.
cve_lifecycle_status	STRING
cve_categories	ARRAY<STRING>	The categories of the entity.
cve_tags	ARRAY<STRING>	A label to help identify or track weaknesses.
cve_alias	STRING	Nickname or alias for the CVE.
cve_references	ARRAY<STRING>	Links to external references.
cve_base_risk_score	FLOAT64
cve_number_out_of_compliance	INT64
cve_risk_factor_offset	FLOAT64
cve_connector_names	ARRAY<STRING>	Human-readable name(s) of the associated cve connector.
cve_connector_categories	ARRAY<STRING>
cve_data_integration_titles	ARRAY<STRING>
cve_source_uids	ARRAY<STRING>	Array of related cve source identifiers. Filter with 'value' IN UNNEST(col).
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_threat_intel

Findings enriched with CWE weaknesses and MITRE ATT&CK techniques and tactics.

Column	Type	Description
finding_id	INT64	Finding id
finding_uid	STRING	Stable logical identifier of the related finding. Join on the corresponding id column, not this one.
finding_type	STRING	The type of the finding.
severity	STRING	Severity rating of the finding.
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
status	STRING	Status of the finding
statusCategory	STRING	Status category. Values are specific to your deployment's configuration; confirm your own values (for example, SELECT DISTINCT statusCategory) before filtering. Works well as a GROUP BY dimension.
definition_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_definitions on its id.
cwe_ids	ARRAY<INT64>	Array of related cwe identifiers. Filter with 'value' IN UNNEST(col).
cwe_uids	ARRAY<STRING>	Array of related cwe identifiers. Filter with 'value' IN UNNEST(col).
cwe_names	ARRAY<STRING>	Human-readable name(s) of the associated cwe.
attack_technique_ids	ARRAY<INT64>	Array of related attack technique identifiers. Filter with 'value' IN UNNEST(col).
attack_technique_uids	ARRAY<STRING>	Array of related attack technique identifiers. Filter with 'value' IN UNNEST(col).
attack_technique_names	ARRAY<STRING>	Human-readable name(s) of the associated attack technique.
attack_tactic_ids	ARRAY<INT64>	Array of related attack tactic identifiers. Filter with 'value' IN UNNEST(col).
attack_tactic_uids	ARRAY<STRING>	Array of related attack tactic identifiers. Filter with 'value' IN UNNEST(col).
attack_tactic_names	ARRAY<STRING>	Human-readable name(s) of the associated attack tactic.
attack_pattern_ids	ARRAY<INT64>	Array of related attack pattern identifiers. Filter with 'value' IN UNNEST(col).
attack_pattern_uids	ARRAY<STRING>	Array of related attack pattern identifiers. Filter with 'value' IN UNNEST(col).
attack_pattern_names	ARRAY<STRING>	Human-readable name(s) of the associated attack pattern.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cve_products

Maps each CVE to the products (CPEs) it affects.

Column	Type	Description
cve_id	INT64	CVE record id
cve_uid	STRING	Stable logical identifier of the related cve. Join on the corresponding id column, not this one.
cve_name	STRING	Human-readable name(s) of the associated cve.
cve_display_name	STRING	Human-readable name(s) of the associated cve display.
cpe_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_cpe on its id.
cpe_uid	STRING	Stable logical identifier of the related cpe. Join on the corresponding id column, not this one.
cpe_name	STRING	Human-readable name(s) of the associated cpe.
cpe_part	STRING	Represents the type of the cpe. "a" means application, "o" means operating system, and "h" means hardware device.
cpe_vendor	STRING	The person or organization that manufactured or created the product.
cpe_product	STRING	The most common and recognizable title or name of the product.
cpe_product_version	STRING
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cve

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
severity	STRING	Severity of the CVE.
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
cvssV3BaseScore	FLOAT64	The CVSS v3 base score.
epssScore	FLOAT64	The probability [0-100] of exploitation in the wild in the next 30 days (following score publication).
cisaExploited	BOOL	Indicates that CVE is reported as exploitable by CISA.
publishedDate	TIMESTAMP	The timestamp (in milliseconds since epoch) when NIST published the CVE.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cwe

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
abstraction	STRING
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
description	STRING	A extended description of the entity.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cpe

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
part	STRING	Represents the type of the cpe. "a" means application, "o" means operating system, and "h" means hardware device.
vendor	STRING	The person or organization that manufactured or created the product.
product	STRING	The most common and recognizable title or name of the product.
productVersion	STRING	The vendor-specific alphanumeric text characterizing the particular release version of the product.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_eol_advisories

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
product	STRING	Identifies the person or organization that manufactured or created the package.
vendor	STRING	Identifies the person or organization that manufactured or created the package.
eolDate	DATE
isEol	BOOL
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Business context and people

v_business_services

Business-service inventory with criticality, risk, ownership, and supporting-asset counts.

Column	Type	Description
id	INT64	BusinessService id
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
criticality	STRING	Criticality of this business service to the goals of the business unit.
lifecycleStatus	STRING	The status controlled by data integration lifecycle that determines when a data set will age out of the system.
riskScore	FLOAT64	The risk score of this asset, on a scale between 1-10
riskRating	STRING	The risk score of this asset, on a scale between none and critical
complianceStatus	STRING	The compliance status of the asset.
owner_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_owner_details on its id.
owner_name	STRING	Human-readable name(s) of the associated owner.
owner_type	STRING	The asset type cluster this person belongs in.
asset_count	INT64	Count of related asset for this row.
asset_names	ARRAY<STRING>	Human-readable name(s) of the associated asset.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_owner_details

Per-owner contact, security posture (MFA, auth method), and login activity.

Column	Type	Description
owner_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_owner_details on its id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
name	STRING	Name of the entity.
dataModelName	STRING	The name of the most specific data model for this data set.
email	STRING	The email of the user.
fullName	STRING	The full name of the user.
location	STRING	Physical or organizational location associated with this record.
managedBy	STRING	If the data set is managed by the system or users
category	STRING	The category of the cluster type.
active	BOOL	Specifies whether the user is active or inactive.
hasInactiveMembers	BOOL	A flag to check if the informed user cluster has any inactive members associated to them.
lastLogin	TIMESTAMP	The last time user successfully logged in.
lastFailedLogin	TIMESTAMP	The last time user login failed.
authMethod	STRING	The authentication method configured for the user.
mfaEnforcement	STRING	MFA enforced by security policy.
mfaStatus	STRING	MFA status of the user.
browser	STRING	Last web browser used by the user.
userAgent	STRING	Web client user-agent for the user.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_persons

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
asset_type_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_asset_types on its id.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_request_details

Per-request workflow audit: submitted/approved/rejected/canceled dates plus justification and evidence.

Column	Type	Description
request_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_request_details on its id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
name	STRING	Name of the entity.
dataModelName	STRING	The name of the most specific data model for this data set.
status	STRING	The status of the request.
dateCreated	TIMESTAMP	Creation date.
dateLastSubmitted	TIMESTAMP	When this request was last submitted for review
dateLastApproved	TIMESTAMP	When this request was last approved
dateLastRejected	TIMESTAMP	When this request was last rejected
dateLastCanceled	TIMESTAMP	When this request was last canceled
exceptionRequestDate	TIMESTAMP	How long the submitter is requesting to complete the remediation of the associated findings.
justification	STRING	The reason for the request.
evidence	STRING	Evidence supporting the request
feedback	STRING	Reviewer feedback to the submitter
bqlQuery	STRING	The query of the targets associated with this request.
riskScore	FLOAT64	The risk score of this request, on a scale between 1-10
riskRating	STRING	The risk rating of this request, on a scale between none and critical
baseRiskScore	FLOAT64	The risk score without any risk factors applied
riskFactorOffset	FLOAT64	The positive or negative-sum of the applicable risk factors
complianceStatus	STRING	The compliance status of the request.
numberOutOfCompliance	INT64	The number of findings associated with this request out of compliance
categories	ARRAY<STRING>	The categories of the target entity.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_sprints

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	The name of an individual sprint within a sprint group.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
status	STRING	Sprint status
startedDate	TIMESTAMP	The starting date for a sprint.
endedDate	TIMESTAMP	The ending date for a sprint.
groupName	STRING	The name of the series of sprints generated by the ticket automation.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Connectors and sources

v_connectors

Scanner/connector catalog: name, deployment model, category, aliases. Join by name against connectorNames arrays.

Column	Type	Description
connector_name	STRING	Human-readable name(s) of the associated connector.
deployment_model	STRING
connector_category	STRING
aliases	STRING
notes	STRING
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_source_models

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
connectorName	STRING	Name of the connector this entity was sourced from.
connectorCategory	STRING	Category of the connector this entity was sourced from.
dataIntegrationTitle	STRING	Title of the data integration this entity was sourced from.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Reference catalogs

v_assessments

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
status	STRING	The normalized status of the assessment
complianceStatus	STRING	The compliance status of the asset.
riskRating	STRING	The risk score of this asset, on a scale between none and critical
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_affected_technologies

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the technology.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_domains

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_profiles

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the profile.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_technologies

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the technology.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_types

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the profile.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_mitigations

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
domain	STRING
summary	STRING	A summary or short description of the entity.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_patterns

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
abstraction	STRING
likelihoodOfAttack	STRING
typicalSeverity	STRING
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_tactics

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
domain	STRING
url	STRING	The external link to the security advisory.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_techniques

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the entity, e.g. a person's preferred name or host fqdn.
dataModelName	STRING	The name of the most specific data model for this data set.
domain	STRING
url	STRING	The external link to the security advisory.
summary	STRING	A summary or short description of the entity.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cloud_accounts

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
cloudAccountId	STRING	The id of the account this host was deployed with.
cloudProvider	STRING	The name of cloud provider providing the resource.
owner_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_owner_details on its id.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_environments

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the environment.
dataModelName	STRING	The name of the most specific data model for this data set.
category	STRING	The category of the cluster type.
description	STRING	A extended description of the entity.
active	BOOL	Specifies whether the user is active or inactive.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_definitions

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Computed name whose computation is handled by the child data model.
dataModelName	STRING	The name of the most specific data model for this data set.
_source_table	STRING	Internal source table tag.
severity	STRING	Severity of the finding definition.
riskRating	STRING	The risk rating of this finding definition, on a scale between none and critical
cveIds	ARRAY<STRING>	The CVE identifiers.
exploitsExists	BOOL
exploitedInTheWild	BOOL
finding_type_id	INT64	Foreign key (numeric). -1 is the Unknown sentinel. Join to v_finding_types on its id.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_profiles

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the profile.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_types

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the environment.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_os_families

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the profile.
dataModelName	STRING	The name of the most specific data model for this data set.
manufacturer	STRING	The manufacturer of the operating system
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_risk_factors

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the riskFactor.
dataModelName	STRING	The name of the most specific data model for this data set.
value	FLOAT64	A positive or a negative number for the risk score adjustment.
reason	STRING	Justification or explanation of the value used for adjustment.
icon	STRING	An icon representing this risk factor.
riskFactorVersion	STRING	The version of the risk factors being used for risk scoring.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_risk_levels

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name to identify the rating level.
description	STRING	Description for the rating level.
fromValue	FLOAT64	The lowest value that will make apply this rating level.
toValue	FLOAT64	The highest value that will make apply this rating level.
order	INT64	Order related with the rating level. Used for UI concern.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_risk_scoring_models

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the environment.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_service_levels

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
active	BOOL	Specifies whether the user is active or inactive.
dateCreated	TIMESTAMP	Creation date.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_sla_definitions

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the slaDefinition.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_status_config_models

Column	Type	Description
id	INT64	Primary key. Join to related views on this numeric id.
uid	STRING	Stable logical identity string. Join on numeric id, not uid.
name	STRING	Name of the entity.
displayName	STRING	Display name of the environment.
dataModelName	STRING	The name of the most specific data model for this data set.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Association views (one row per relationship)

v_asset_application

Column	Type	Description
asset_id	INT64	FK to v_assets (the asset endpoint)
asset_name	STRING	Human-readable name(s) of the associated asset.
application_id	INT64	FK to v_assets (the application endpoint - Application rows live in v_assets)
application_name	STRING	Human-readable name(s) of the associated application.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_business_service

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
business_service_id	INT64	FK to v_business_services
business_service_name	STRING	Human-readable name(s) of the associated business service.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_domain

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
asset_domain_id	INT64
asset_domain_name	STRING	Human-readable name(s) of the associated asset domain.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_environment

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
environment_id	INT64	FK to v_environments
environment_name	STRING	Human-readable name(s) of the associated environment.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_informed_user

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
owner_id	INT64	FK to v_owner_details
owner_name	STRING	Human-readable name(s) of the associated owner.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_owner

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
owner_id	INT64	FK to v_owner_details
owner_name	STRING	Human-readable name(s) of the associated owner.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_profile

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
asset_profile_id	INT64
asset_profile_name	STRING	Human-readable name(s) of the associated asset profile.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_subnet

Column	Type	Description
asset_id	INT64	FK to v_assets (the asset endpoint)
asset_name	STRING	Human-readable name(s) of the associated asset.
subnet_id	INT64	FK to v_assets (the Subnet endpoint - Subnet rows live in v_assets)
subnet_name	STRING	Human-readable name(s) of the associated subnet.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_asset_technology

Column	Type	Description
asset_id	INT64	FK to v_assets
asset_name	STRING	Human-readable name(s) of the associated asset.
asset_technology_id	INT64
asset_technology_name	STRING	Human-readable name(s) of the associated asset technology.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_risk_factor

Column	Type	Description
finding_id	INT64	FK to v_findings
finding_name	STRING	Human-readable name(s) of the associated finding.
risk_factor_id	INT64	FK to v_risk_factors
risk_factor_name	STRING	Human-readable name(s) of the associated risk factor.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_informed_user

Column	Type	Description
finding_id	INT64	FK to v_findings
finding_name	STRING	Human-readable name(s) of the associated finding.
owner_id	INT64	FK to v_owner_details
owner_name	STRING	Human-readable name(s) of the associated owner.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_definition_profile

Column	Type	Description
finding_definition_id	INT64	FK to v_finding_definitions
finding_definition_name	STRING	Human-readable name(s) of the associated finding definition.
finding_profile_id	INT64
finding_profile_name	STRING	Human-readable name(s) of the associated finding profile.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_finding_definition_technology

Column	Type	Description
finding_definition_id	INT64	FK to v_finding_definitions
finding_definition_name	STRING	Human-readable name(s) of the associated finding definition.
affected_technology_id	INT64
affected_technology_name	STRING	Human-readable name(s) of the associated affected technology.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_definition_cve

Column	Type	Description
definition_id	INT64	FK to v_finding_definitions
definition_name	STRING	Human-readable name(s) of the associated definition.
cve_record_id	INT64	FK to v_cve
cve_record_name	STRING	Human-readable name(s) of the associated cve record.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_definition_weakness

Column	Type	Description
definition_id	INT64	FK to v_finding_definitions
definition_name	STRING	Human-readable name(s) of the associated definition.
weakness_id	INT64	FK to v_cwe
weakness_name	STRING	Human-readable name(s) of the associated weakness.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_ticket_finding

Column	Type	Description
ticket_id	INT64	FK to v_tickets
ticket_name	STRING	Human-readable name(s) of the associated ticket.
finding_id	INT64	FK to v_findings
finding_name	STRING	Human-readable name(s) of the associated finding.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_ticket_prev_finding

Column	Type	Description
ticket_id	INT64	FK to v_tickets
ticket_name	STRING	Human-readable name(s) of the associated ticket.
finding_id	INT64	FK to v_findings
finding_name	STRING	Human-readable name(s) of the associated finding.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_ticket_user

Column	Type	Description
ticket_id	INT64	FK to v_tickets
ticket_name	STRING	Human-readable name(s) of the associated ticket.
user_id	INT64	FK to v_owner_details
user_name	STRING	Human-readable name(s) of the associated user.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_request_finding

Column	Type	Description
request_id	INT64	FK to v_request_details
request_name	STRING	Human-readable name(s) of the associated request.
finding_id	INT64	FK to v_findings
finding_name	STRING	Human-readable name(s) of the associated finding.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_owner_member

Column	Type	Description
owner_id	INT64	FK to v_owner_details (the owner/group endpoint)
owner_name	STRING	Human-readable name(s) of the associated owner.
user_id	INT64	FK to v_owner_details (the member endpoint)
user_name	STRING	Human-readable name(s) of the associated user.
association_type	STRING
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cve_weakness

Column	Type	Description
cve_id	INT64	FK to v_cve
cve_name	STRING	Human-readable name(s) of the associated cve.
weakness_id	INT64	FK to v_cwe
weakness_name	STRING	Human-readable name(s) of the associated weakness.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cve_attack_pattern

Column	Type	Description
cve_id	INT64	FK to v_cve
cve_name	STRING	Human-readable name(s) of the associated cve.
attack_pattern_id	INT64	FK to v_attack_patterns
attack_pattern_name	STRING	Human-readable name(s) of the associated attack pattern.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_cve_attack_technique

Column	Type	Description
cve_id	INT64	FK to v_cve
cve_name	STRING	Human-readable name(s) of the associated cve.
attack_technique_id	INT64	FK to v_attack_techniques
attack_technique_name	STRING	Human-readable name(s) of the associated attack technique.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_pattern_weakness

Column	Type	Description
attack_pattern_id	INT64	FK to v_attack_patterns
attack_pattern_name	STRING	Human-readable name(s) of the associated attack pattern.
weakness_id	INT64	FK to v_cwe
weakness_name	STRING	Human-readable name(s) of the associated weakness.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_technique_tactic

Column	Type	Description
attack_technique_id	INT64	FK to v_attack_techniques
attack_technique_name	STRING	Human-readable name(s) of the associated attack technique.
attack_tactic_id	INT64	FK to v_attack_tactics
attack_tactic_name	STRING	Human-readable name(s) of the associated attack tactic.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_mitigation_technique

Column	Type	Description
mitigation_id	INT64	FK to v_attack_mitigations
mitigation_name	STRING	Human-readable name(s) of the associated mitigation.
attack_technique_id	INT64	FK to v_attack_techniques
attack_technique_name	STRING	Human-readable name(s) of the associated attack technique.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_weakness_parent

Self-referential hierarchy: one row per parent-child link.

Column	Type	Description
weakness_id	INT64	FK to v_cwe (the child weakness endpoint)
weakness_name	STRING	Human-readable name(s) of the associated weakness.
parent_weakness_id	INT64	FK to v_cwe (the parent weakness endpoint)
parent_weakness_name	STRING	Human-readable name(s) of the associated parent weakness.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_pattern_parent

Self-referential hierarchy: one row per parent-child link.

Column	Type	Description
attack_pattern_id	INT64	FK to v_attack_patterns (the child pattern endpoint)
attack_pattern_name	STRING	Human-readable name(s) of the associated attack pattern.
parent_pattern_id	INT64	FK to v_attack_patterns (the parent pattern endpoint)
parent_pattern_name	STRING	Human-readable name(s) of the associated parent pattern.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

v_attack_technique_parent

Self-referential hierarchy: one row per parent-child link.

Column	Type	Description
attack_technique_id	INT64	FK to v_attack_techniques (the child technique endpoint)
attack_technique_name	STRING	Human-readable name(s) of the associated attack technique.
parent_technique_id	INT64	FK to v_attack_techniques (the parent technique endpoint)
parent_technique_name	STRING	Human-readable name(s) of the associated parent technique.
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).

Utility

v_active_dates

Calendar dimension with day/week/month/quarter/year parts and fiscal attributes.

Column	Type	Description
date_key	DATE	Date (PK from v_active_dates)
year	INT64	Calendar year
quarter	INT64	Calendar quarter (1-4).
quarter_name	STRING	Quarter label (Q1, Q2, etc.)
month	INT64	Calendar month (1-12).
month_name	STRING	Full month name
month_short_name	STRING	Abbreviated month name (Jan, Feb, etc.).
week_of_year	INT64	ISO week number within the year.
day_of_week	INT64	Day of week (1-7).
day_name	STRING	Full day-of-week name (Monday, Tuesday, etc.).
day_short_name	STRING	Abbreviated day-of-week name (Mon, Tue, etc.).
day_of_month	INT64	Day of month (1-31).
day_of_year	INT64	Day of year (1-366).
is_weekend	BOOL	TRUE if Saturday or Sunday.
is_business_day	BOOL	TRUE if weekday
is_today	BOOL	TRUE if this is the current date.
is_yesterday	BOOL	TRUE if this is the prior date.
week_start	DATE	Date of the first day (Monday) of this row's week.
week_end	DATE	Date of the last day (Sunday) of this row's week.
month_start	DATE	First date of this row's month.
month_end	DATE	Last date of this row's month.
quarter_start	DATE	First date of this row's quarter.
year_start	DATE	First date of this row's year.
fiscal_year	INT64	Fiscal year (per your organization's fiscal calendar).
fiscal_quarter	INT64	Fiscal quarter (per your organization's fiscal calendar).
_changed_at	DATE	Date this row's content last changed. Pull daily deltas with WHERE _changed_at >= your high-water mark (see the Incremental Pull Guide).