Database Schema Reference

Auto-generated — do not edit. Re-run scripts/generate-db-erd.ts to update.

Summary Stats

• Total entities: 133
• Database: PostgreSQL (TypeORM)
• Tenant isolation: Schema-per-tenant (search_path)
• Generated: 2026-04-05T09:31:31.171Z

Entity Catalog

Entity Class	Table Name	Module	Description
ApiAuditLog	api_audit_logs	Administration & Auth	—
AuditLog	audit_log	Administration & Auth	—
IpBlacklist	ip_blacklist	Administration & Auth	—
IpWhitelist	ip_whitelist	Administration & Auth	—
LicenseConfig	license_config	Administration & Auth	Singleton row (id = 'default') that persists the active license key in the datab
LicenseEvent	license_events	Administration & Auth	—
NotificationConfig	notification_config	Administration & Auth	NotificationConfig — Global notification system configuration Stores SMTP settin
NotificationLog	notification_log	Administration & Auth	NotificationLog — Tracks every notification sent to users Supports in-app and em
NotificationPreference	notification_preference	Administration & Auth	NotificationPreference — Per-user notification channel preferences Each user can
Role	roles	Administration & Auth	—
SavedFilter	saved_filters	Administration & Auth	SavedFilter — User-scoped saved filter presets for Explore page Each user can sa
SecurityAuditLog	security_audit_logs	Administration & Auth	—
Settings	settings	Administration & Auth	—
SsoConfig	sso_config	Administration & Auth	Singleton row (id = 'default') storing Microsoft Entra ID SSO configuration. Onl
TenantEntitlement	tenant_entitlements	Administration & Auth	Per-tenant entitlement record in the public schema. Populated on provisioning, u
TokenBlacklist	token_blacklist	Administration & Auth	—
User	users	Administration & Auth	—
VfpAuditLog	vfp_audit_log	Administration & Auth	VfpAuditLog — VFP-specific audit trail Records all significant actions within th
AiCacheEntry	ai_cache_entry	AI Labs	AiCacheEntry — Persists AI response cache entries to survive restarts. Used by a
AiConversation	ai_conversation	AI Labs	AiConversation — Persistent AI chat conversations Stores multi-turn conversation
AiGovernancePolicy	ai_governance_policies	AI Labs	AiGovernancePolicy — An organization-defined policy governing AI tool usage. Pol
AiPromptTemplate	ai_prompt_template	AI Labs	AiPromptTemplate — Versioned prompt templates for AI features Each AI feature (f
AiProvider	ai_provider	AI Labs	AiProvider — Configurable AI provider settings Stores connection details and con
AiRisk	ai_risks	AI Labs	AiRisk — A detected risk or violation related to AI tool usage. Risks are raised
AiTool	ai_tools	AI Labs	AiTool — An AI/ML tool detected or registered within an organization. Tracks AI
AiUsageLog	ai_usage_log	AI Labs	AiUsageLog — Tracks AI API usage for billing and analytics Records every AI exec
AiUserProvider	ai_user_provider	AI Labs	AiUserProvider — Per-user AI provider configuration Allows individual users to c
AnomalyDay	anomaly_days	AI Labs	AnomalyDay tracks days with detected data anomalies (spikes) Used for: - KPI nor
SensitiveDataPattern	sensitive_data_patterns	AI Labs	SensitiveDataPattern - Configurable regex patterns for sensitive data detection.
AppSecCredential	appsec_credentials	AppSec / Pentest Scanner	AppSecCredential — Centralized credential vault for the AppSec module. Stores na
OsintApiKey	osint_api_keys	AppSec / Pentest Scanner	—
PentestActivityEvent	pentest_activity_events	AppSec / Pentest Scanner	—
PentestAgentConfig	pentest_agent_configs	AppSec / Pentest Scanner	PentestAgentConfig - runtime configuration for each attack agent. Each agent (xs
PentestAgentLog	pentest_agent_logs	AppSec / Pentest Scanner	PentestAgentLog - execution log for each agent run within an assessment. Tracks
PentestAssessment	pentest_assessments	AppSec / Pentest Scanner	PentestAssessment - a single penetration test run against a target. Each assessm
PentestAuthProfile	pentest_auth_profiles	AppSec / Pentest Scanner	PentestAuthProfile - authentication configuration for authenticated testing. Sto
PentestCrawlResult	pentest_crawl_results	AppSec / Pentest Scanner	PentestCrawlResult - stores crawl discovery data for an assessment. Each row rep
PentestEvidence	pentest_evidence	AppSec / Pentest Scanner	PentestEvidence - proof artifacts attached to a finding. Each finding can have m
PentestExploitChain	pentest_exploit_chains	AppSec / Pentest Scanner	PentestExploitChain - a multi-step attack path combining individual findings. Ex
PentestFinding	pentest_findings	AppSec / Pentest Scanner	PentestFinding - an individual vulnerability discovered during an assessment. Ea
PentestFindingException	pentest_finding_exception	AppSec / Pentest Scanner	PentestFindingException — AppSec exception / risk acceptance for DAST findings S
PentestFindingObservation	pentest_finding_observation	AppSec / Pentest Scanner	PentestFindingObservation - append-only observation record for scan history inte
PentestReport	pentest_reports	AppSec / Pentest Scanner	PentestReport - generated assessment report. Reports are generated after an asse
PentestScanTemplate	pentest_scan_template	AppSec / Pentest Scanner	PentestScanTemplate — reusable scan configuration templates for AppSec assessmen
PentestTarget	pentest_targets	AppSec / Pentest Scanner	PentestTarget - a web application or API endpoint registered for security assess
PentestTestCase	pentest_test_cases	AppSec / Pentest Scanner	PentestTestCase - a reusable test case template that agents execute. Migrated fr
Phase0Session	pentest_phase0_sessions	AppSec / Pentest Scanner	Sensitive patterns that trigger encryption of the answer field. */ const SENSIT
ProxyConfig	proxy_config	AppSec / Pentest Scanner	Singleton row (id = 'default') that persists the corporate proxy configuration.
ScannerAgent	scanner_agents	AppSec / Pentest Scanner	ScannerAgent — WeaverScan agent registry Each row represents a registered scanne
ScannerAttackPath	scanner_attack_paths	AppSec / Pentest Scanner	ScannerAttackPath — Computed attack path analysis Represents a chain of vulnerab
ScannerBenchmark	scanner_benchmarks	AppSec / Pentest Scanner	ScannerBenchmark — ground truth database for vulnerability benchmarks. Stores kn
ScannerComplianceAttestation	scanner_compliance_attestations	AppSec / Pentest Scanner	—
ScannerComplianceSnapshot	scanner_compliance_snapshots	AppSec / Pentest Scanner	ScannerComplianceSnapshot — Point-in-time compliance assessment Stores the overa
ScannerConfig	scanner_config	AppSec / Pentest Scanner	ScannerConfig — stores configuration for each connected vulnerability scanner. E
ScannerConflict	scanner_conflicts	AppSec / Pentest Scanner	—
ScannerContainer	scanner_containers	AppSec / Pentest Scanner	ScannerContainer — Container tracking for WeaverScan Tracks individual container
ScannerDetectionSignature	scanner_detection_signatures	AppSec / Pentest Scanner	ScannerDetectionSignature — Vulnerability detection rules Each signature describ
ScannerEdrEvent	scanner_edr_events	AppSec / Pentest Scanner	ScannerEdrEvent — EDR event tracking for WeaverScan Records endpoint detection a
ScannerEnrollmentToken	scanner_enrollment_tokens	AppSec / Pentest Scanner	ScannerEnrollmentToken — One-time or multi-use tokens for agent enrollment Agent
ScannerFalsePositivePattern	scanner_false_positive_patterns	AppSec / Pentest Scanner	ScannerFalsePositivePattern — False positive suppression rules Defines patterns
ScannerFimRule	scanner_fim_rules	AppSec / Pentest Scanner	ScannerFimRule — File Integrity Monitoring rules for WeaverScan Defines which fi
ScannerIntelSyncLog	scanner_intel_sync_log	AppSec / Pentest Scanner	ScannerIntelSyncLog — Threat intelligence feed sync tracking Records each sync a
ScannerMobileDevice	scanner_mobile_devices	AppSec / Pentest Scanner	ScannerMobileDevice — Mobile/IoT device tracking for WeaverScan Tracks mobile de
ScannerNlpPolicy	scanner_nlp_policies	AppSec / Pentest Scanner	—
ScannerRelay	scanner_relays	AppSec / Pentest Scanner	ScannerRelay — WeaverRelay tracking entity Represents a relay node in the Weaver
ScannerRemediationJob	scanner_remediation_jobs	AppSec / Pentest Scanner	ScannerRemediationJob — Agent-executed remediation tasks Represents an approved
ScannerSbomDriftEvent	scanner_sbom_drift_events	AppSec / Pentest Scanner	ScannerSbomDriftEvent — SBOM change detection events When consecutive SBOM snaps
ScannerSbomSnapshot	scanner_sbom_snapshots	AppSec / Pentest Scanner	ScannerSbomSnapshot — Point-in-time SBOM capture from an agent Stores the full C
ScannerScanResult	scanner_scan_results	AppSec / Pentest Scanner	ScannerScanResult — Individual scan execution result from an agent Each row repr
ScannerSyncLog	scanner_sync_log	AppSec / Pentest Scanner	ScannerSyncLog — tracks each sync run for any scanner. Records start time, compl
TargetLearnedContext	pentest_target_learned_context	AppSec / Pentest Scanner	TargetLearnedContext — persists learned intelligence about a pentest target acro
SbomAssetLink	sbom_asset_link	Cloud Security	SbomAssetLink — Links SBOM components to specific assets Many-to-many relationsh
SbomComponent	sbom_component	Cloud Security	SbomComponent — Software Bill of Materials component record Represents a single
SbomImportLog	sbom_import_log	Cloud Security	SbomImportLog — Audit trail for SBOM file imports Records every SBOM import oper
Asset	assets	Exposure Management	Asset entity for storing vulnerability management asset inventory. Supports mult
AssetGroup	asset_group	Exposure Management	AssetGroup — Logical grouping of assets by dynamic filter criteria Groups can be
AssetOwnership	asset_ownership	Exposure Management	AssetOwnership — Maps assets to owners, teams, and business context Enables rout
AssetTag	asset_tags	Exposure Management	AssetTag — user-defined tags that can be assigned to assets. Separate from Tenab
ComplianceAssessment	compliance_assessment	Exposure Management	ComplianceAssessment — Point-in-time compliance assessment result Records the re
ComplianceFramework	compliance_framework	Exposure Management	ComplianceFramework — Defines a compliance standard with mapped controls Represe
Dashboard	dashboard	Exposure Management	—
DashboardGroup	dashboard_group	Exposure Management	—
DashboardWidget	dashboard_widget	Exposure Management	—
RemediationCampaign	remediation_campaign	Exposure Management	RemediationCampaign — Orchestrates a group of work packages A campaign is a time
RemediationPlaybook	remediation_playbook	Exposure Management	RemediationPlaybook — Step-by-step remediation instructions A playbook provides
Scan	scans	Exposure Management	Scan — the core scan definition. Represents a configured scan with targets, cred
ScanAgentTask	scan_agent_tasks	Exposure Management	ScanAgentTask — Remote scan agent task registry Each row represents a scan task
ScanBlackoutWindow	scan_blackout_windows	Exposure Management	ScanBlackoutWindow — time windows during which scans must not run. Blackout wind
ScanChain	scan_chains	Exposure Management	ScanChainStep — a single step within a scan chain pipeline. Each step references
ScanCredential	scan_credentials	Exposure Management	ScanCredential — encrypted credentials for authenticated scans. Stores SSH keys,
ScanExclusion	scan_exclusions	Exposure Management	ScanExclusion — patterns that exclude specific targets, plugins, or CVEs from sc
ScanFinding	scan_findings	Exposure Management	ScanFinding — individual vulnerability/compliance finding from a scan. Each find
ScanFolder	scan_folders	Exposure Management	ScanFolder — organizational folders for scans. Supports system folders (My Scans
ScanHistoryImport	scan_history_imports	Exposure Management	Tracks individual scan-run imports. Each row represents one Tenable scan history
ScanImportJob	scan_import_jobs	Exposure Management	Tracks bulk scan history import jobs. Each row represents one admin-initiated im
ScanNotification	scan_notifications	Exposure Management	ScanNotification — Tracks scan-related notifications for users Created automatic
ScanPolicy	scan_policies	Exposure Management	ScanPolicy — custom scan policies for fine-grained check control. Policies defin
ScanResultHost	scan_result_hosts	Exposure Management	ScanResultHost — per-host results within a scan run. Each row represents a singl
ScanRun	scan_runs	Exposure Management	ScanRun — a single execution instance of a Scan. Each time a scan is launched, a
ScanSchedule	scan_schedules	Exposure Management	ScanSchedule — recurring schedule definitions for scans. Each schedule is linked
ScanTemplate	scan_templates	Exposure Management	ScanTemplate — built-in and custom scan template definitions. Templates define t
SyncJob	sync_jobs	Exposure Management	—
SyncLog	sync_logs	Exposure Management	Vulnerability entity for storing Tenable.io vulnerability data This allows viewi
VfpException	vfp_exception	Exposure Management	VfpException — Risk acceptance / exception request Tracks exception requests for
VfpPolicyConfig	vfp_policy_config	Exposure Management	VfpPolicyConfig — Risk scoring policy configuration Stores the weight distributi
VfpRiskScore	vfp_risk_score	Exposure Management	VfpRiskScore — Composite risk score per vulnerability instance Stores the comput
VfpTeam	vfp_team	Exposure Management	VfpTeam — Remediation team for work package assignment Teams group users for ass
VfpTicketLink	vfp_ticket_link	Exposure Management	VfpTicketLink — External ticket system integration Links a work package to an ex
VfpValidationRecord	vfp_validation_record	Exposure Management	VfpValidationRecord — Remediation verification evidence Tracks the validation/ve
VfpWorkPackage	vfp_work_package	Exposure Management	VfpWorkPackage — Grouped remediation work unit A work package bundles related vu
VfpWorkPackageItem	vfp_work_package_item	Exposure Management	VfpWorkPackageItem — Individual vulnerability in a work package Each item refere
Vulnerability	vulnerabilities	Exposure Management	Vulnerability entity for storing Tenable.io vulnerability data This allows viewi
VulnerabilityStateTransition	vulnerability_state_transitions	Exposure Management	VulnerabilityStateTransition tracks state changes over time Enhanced to support
VulnerabilityStats	vulnerability_stats	Exposure Management	VulnerabilityStats entity for pre-computed daily aggregations This allows fast d
VulnerabilityStatsByCategory	vulnerability_stats_by_category	Exposure Management	VulnerabilityStatsByCategory stores daily per-category aggregations This enables
WidgetTemplate	widget_template	Exposure Management	—
ApiConfig	api_config	Operations & Integrations	—
ArchivedData	archived_data	Operations & Integrations	—
ChunkProgress	chunk_progress	Operations & Integrations	ChunkProgress entity for tracking individual chunk downloads Enables resume capa
CleanupLog	cleanup_logs	Operations & Integrations	—
DateExclusion	date_exclusions	Operations & Integrations	DateExclusion entity - stores excluded dates for dashboard calculations Enhanced
ExportJob	export_jobs	Operations & Integrations	ExportJob entity for tracking async export requests Enables background generatio
GeneratedReport	generated_report	Operations & Integrations	GeneratedReport — A completed report instance with its data Stores the output of
IntegrationConfig	integration_config	Operations & Integrations	IntegrationConfig — VFP Phase 10 External Integration Settings Stores configurat
OsCategoryRule	os_category_rules	Operations & Integrations	—
QuarantinedData	quarantined_data	Operations & Integrations	QuarantinedData entity for storing corrupted or invalid data Enables data integr
ReportTemplate	report_template	Operations & Integrations	ReportTemplate — Reusable report layout definition Defines the structure and dat
ScheduledReport	scheduled_report	Operations & Integrations	ScheduledReport — Recurring report generation configuration Stores user-defined
SlaEscalation	sla_escalation	Operations & Integrations	SlaEscalation — SLA tracking for individual work packages Records the SLA due da
SlaPolicyConfig	sla_policy_config	Operations & Integrations	SlaPolicyConfig — SLA policy definitions for vulnerability remediation Defines t
TargetGroup	scan_target_groups	Operations & Integrations	TargetGroup — reusable groups of scan targets. Static groups contain explicit IP
WebhookConfig	webhook_config	Operations & Integrations	WebhookConfig — VFP Phase 10 Webhook Configuration Stores outbound webhook endpo
WebhookDeliveryLog	webhook_delivery_log	Operations & Integrations	WebhookDeliveryLog — VFP Phase 10 Webhook Delivery Tracking Records every outbou

Exposure Management Tables

42 entities

Entity Relationships (Mermaid ERD)

Column Reference

asset_group (AssetGroup)

AssetGroup — Logical grouping of assets by dynamic filter criteria Groups can be defined by filter criteria (e.g. all Linux production servers) and used for bulk work package assignment and reporting.

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
filterCriteria	jsonb	Yes
createdBy	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

asset_ownership (AssetOwnership)

AssetOwnership — Maps assets to owners, teams, and business context Enables routing vulnerability fix tasks to the correct team/individual. Supports CSV bulk import for enterprise onboarding.

Column	Type	Nullable	Notes
id	uuid	No	PK
assetUuid	varchar	No
ownerEmail	varchar	Yes
ownerTeam	varchar	Yes
businessUnit	varchar	Yes
environment	varchar	Yes
criticality	varchar	No
tags	jsonb	Yes
importedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

asset_tags (AssetTag)

AssetTag — user-defined tags that can be assigned to assets. Separate from Tenable-synced tags (which live in Asset.tags text column). These are local custom tags created in ThreatWeaver.

Column	Type	Nullable	Notes
id	uuid	No	PK
key	varchar	No
value	varchar	No
color	varchar	Yes
description	text	Yes
assetUuids	simple-array	Yes
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

assets (Asset)

Asset entity for storing vulnerability management asset inventory. Supports multi-platform ingestion (Tenable, Qualys, Rapid7, CrowdStrike, etc.) Core fields are normalized across tools; tool-specific

Column	Type	Nullable	Notes
uuid	varchar	No	PK
id	varchar	Yes
hostname	varchar	Yes
ipv4	simple-array	Yes
ipv6	simple-array	Yes
fqdn	simple-array	Yes
operatingSystem	varchar	Yes
hasAgent	boolean	No
lastSeen	timestamp	Yes
lastAuthenticatedScanDate	timestamp	Yes
lastLicensedScanDate	timestamp	Yes
sources	text	Yes
tags	text	Yes
isLicensed	boolean	No
assetType	varchar	Yes
acrScore	float	Yes
aesScore	float	Yes
systemType	varchar	Yes
agentName	varchar	Yes
netbiosName	varchar	Yes
macAddresses	text	Yes
networkId	varchar	Yes
installedSoftware	text	Yes
sshFingerprint	varchar	Yes
isPublic	boolean	Yes
terminatedAt	timestamp	Yes
lastScanTime	timestamp	Yes
firstObserved	timestamp	Yes
sourceTool	varchar	No
sourceToolAssetId	varchar	Yes
toolSpecificData	text	Yes
syncJobId	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

compliance_assessment (ComplianceAssessment)

ComplianceAssessment — Point-in-time compliance assessment result Records the results of running a compliance assessment against a framework. Tracks per-control pass/fail and overall compliance score,

Column	Type	Nullable	Notes
id	uuid	No	PK
frameworkId	varchar	No
assessmentDate	timestamp	No
totalControls	integer	No
passedControls	integer	No
failedControls	integer	No
notApplicable	integer	No
complianceScore	decimal	No
findings	jsonb	Yes
createdBy	varchar	No
createdAt	varchar	No

compliance_framework (ComplianceFramework)

ComplianceFramework — Defines a compliance standard with mapped controls Represents a compliance framework (e.g., PCI-DSS 4.0, SOC 2, HIPAA, ISO 27001) with its control mappings. Controls can be linke

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
version	varchar	Yes
description	text	Yes
controls	jsonb	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

dashboard (Dashboard)

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
slug	varchar	No
ownerId	uuid	No
groupId	uuid	Yes
isDefault	boolean	No
isTemplate	boolean	No
isSystem	boolean	No
isShared	boolean	No
layout	jsonb	No
filters	jsonb	No
category	varchar	Yes
moduleTag	varchar	Yes
tags	simple-array	No
usageCount	integer	No
createdAt	varchar	No
updatedAt	varchar	No
deletedAt	timestamp	Yes

Relations:

• owner: ManyToOne → User

dashboard_group (DashboardGroup)

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
ownerId	uuid	No
sortOrder	integer	No
createdAt	varchar	No

Relations:

• owner: ManyToOne → User

dashboard_widget (DashboardWidget)

Column	Type	Nullable	Notes
id	uuid	No	PK
dashboardId	uuid	No
templateId	uuid	Yes
name	varchar	No
description	text	Yes
chartType	varchar	No
dataSource	varchar	No
config	jsonb	No
position	jsonb	No
refreshInterval	integer	No
createdAt	varchar	No
updatedAt	varchar	No

Relations:

• dashboard: ManyToOne → Dashboard

remediation_campaign (RemediationCampaign)

RemediationCampaign — Orchestrates a group of work packages A campaign is a time-bound effort to remediate a set of vulnerabilities, grouping multiple work packages under a shared target date and trac

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
targetDate	date	Yes
status	varchar	No
metrics	jsonb	Yes
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

remediation_playbook (RemediationPlaybook)

RemediationPlaybook — Step-by-step remediation instructions A playbook provides structured remediation steps for a class of vulnerabilities, including commands, rollback procedures, and validation che

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
vulnClass	varchar	Yes
osFamily	varchar	Yes
appFamily	varchar	Yes
steps	jsonb	No
rollback	jsonb	Yes
validationSteps	jsonb	Yes
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scan_agent_tasks (ScanAgentTask)

ScanAgentTask — Remote scan agent task registry Each row represents a scan task assigned to a remote scan agent. Tasks are dispatched from the gateway, acknowledged by the agent, and results reported

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
assessmentId	uuid	Yes
scanRunId	uuid	Yes
taskType	varchar	No
targetUrl	text	No
targetScope	jsonb	No
scanConfig	jsonb	No
priority	varchar	No
status	varchar	No
assignedAt	timestamp	Yes
acknowledgedAt	timestamp	Yes
startedAt	timestamp	Yes
completedAt	timestamp	Yes
progress	integer	No
endpointsDiscovered	integer	No
endpointsScanned	integer	No
requestsSent	integer	No
findingsCount	integer	No
hostsScanned	integer	No
portsScanned	integer	No
servicesDetected	integer	No
summary	jsonb	Yes
errorMessage	text	Yes
durationSeconds	integer	Yes
timeoutSeconds	integer	No
maxRequests	integer	No
createdAt	varchar	No
updatedAt	varchar	No

scan_blackout_windows (ScanBlackoutWindow)

ScanBlackoutWindow — time windows during which scans must not run. Blackout windows can be global (affect all scans), scoped to a specific scan, or scoped to a folder. Supports recurring windows (e.g.

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
scope	varchar	No
scopeId	uuid	Yes
startTime	varchar	No
endTime	varchar	No
timezone	varchar	No
daysOfWeek	jsonb	No
startDate	date	Yes
endDate	date	Yes
isRecurring	boolean	No
isActive	boolean	No
createdBy	uuid	Yes
createdAt	varchar	No

scan_chains (ScanChain)

ScanChainStep — a single step within a scan chain pipeline. Each step references a scan to launch, with a trigger condition based on the previous step's outcome, optional target passthrough, and a del

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
steps	jsonb	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scan_credentials (ScanCredential)

ScanCredential — encrypted credentials for authenticated scans. Stores SSH keys, Windows NTLM, SNMP v3, database credentials, etc. Credentials are AES-256 encrypted at rest. Can be scoped to specific

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
credentialType	varchar	No
credentialsEncrypted	text	No
scope	jsonb	Yes
createdBy	uuid	Yes
isShared	boolean	No
lastTestedAt	timestamp	Yes
lastTestResult	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

scan_exclusions (ScanExclusion)

ScanExclusion — patterns that exclude specific targets, plugins, or CVEs from scanning. Exclusions can be global (affect all scans), scoped to a specific scan, or scoped to a folder. Every exclusion r

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
excludeType	varchar	No
pattern	text	No
scope	varchar	No
scopeId	uuid	Yes
reason	text	No
expiresAt	timestamp	Yes
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scan_findings (ScanFinding)

ScanFinding — individual vulnerability/compliance finding from a scan. Each finding is tied to a ScanRun + ScanResultHost and captures full vulnerability details: CVE/CWE IDs, CVSS scores, EPSS probab

Column	Type	Nullable	Notes
id	uuid	No	PK
scanRunId	uuid	No
hostId	uuid	No
checkId	varchar	Yes
pluginId	varchar	Yes
name	varchar	No
description	text	Yes
family	varchar	Yes
cveIds	jsonb	No
cweIds	jsonb	No
severity	varchar	No
cvssV3Score	real	Yes
cvssV3Vector	varchar	Yes
epssScore	real	Yes
weaverScore	real	Yes
solution	text	Yes
references	jsonb	No
pluginOutput	text	Yes
port	integer	Yes
protocol	varchar	Yes
service	varchar	Yes
findingStatus	varchar	No
firstSeenAt	timestamp	No
lastSeenAt	timestamp	No
exploitAvailable	boolean	No
exploitMaturity	varchar	Yes
malwareAssociated	boolean	No
inCisaKev	boolean	No
complianceFramework	varchar	Yes
complianceControl	varchar	Yes
complianceStatus	varchar	Yes
complianceEvidence	text	Yes
isFalsePositive	boolean	No
feedbackNote	text	Yes
feedbackBy	varchar	Yes
feedbackAt	timestamp	Yes
createdAt	varchar	No

scan_folders (ScanFolder)

ScanFolder — organizational folders for scans. Supports system folders (My Scans, All Scans, Trash), custom user folders, and smart folders with dynamic filter rules. Folders can be nested via parentI

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
type	varchar	No
ownerId	uuid	Yes
parentId	uuid	Yes
icon	varchar	Yes
sortOrder	integer	No
smartFilter	jsonb	Yes
createdAt	varchar	No

scan_history_imports (ScanHistoryImport)

Tracks individual scan-run imports. Each row represents one Tenable scan history entry that was (or is being) imported. The UNIQUE(scan_id, history_id) constraint prevents re-importing the same scan r

Column	Type	Nullable	Notes
id	int	No	PK
importJobId	varchar	No
scanId	int	No
scanName	varchar	Yes
historyId	int	No
scanDate	timestamptz	No
findingsCount	int	No
status	varchar	No
error	text	Yes
processedAt	timestamptz	Yes
createdAt	timestamptz	No

scan_import_jobs (ScanImportJob)

Tracks bulk scan history import jobs. Each row represents one admin-initiated import job which may process multiple scan runs. Progress counters are updated in real-time during import. Status lifecycl

Column	Type	Nullable	Notes
id	varchar	No	PK
status	varchar	No
totalRuns	int	No
processedRuns	int	No
failedRuns	int	No
skippedRuns	int	No
totalFindings	int	No
selectedScanIds	jsonb	Yes
dateRangeStart	timestamptz	Yes
dateRangeEnd	timestamptz	Yes
dryRun	boolean	No
startedBy	varchar	Yes
startedAt	timestamptz	Yes
completedAt	timestamptz	Yes
error	text	Yes
createdAt	timestamptz	No

scan_notifications (ScanNotification)

ScanNotification — Tracks scan-related notifications for users Created automatically by the NotificationManager when scan events occur (critical findings, scan complete, scan failed, schedule triggere

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	varchar	No
type	varchar	No
title	varchar	No
message	text	Yes
metadata	jsonb	Yes
read	boolean	No
readAt	timestamp	Yes
createdAt	varchar	No

scan_policies (ScanPolicy)

ScanPolicy — custom scan policies for fine-grained check control. Policies define which check families are enabled/disabled, severity overrides for specific checks, and custom check definitions. A sca

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
createdBy	uuid	Yes
checkFamilies	jsonb	No
severityOverrides	jsonb	No
customChecks	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

scan_result_hosts (ScanResultHost)

ScanResultHost — per-host results within a scan run. Each row represents a single host that was scanned during a ScanRun. Tracks host identification (IP, hostname, OS), scan status, finding counts by

Column	Type	Nullable	Notes
id	uuid	No	PK
scanRunId	uuid	No
ipAddress	varchar	Yes
hostname	varchar	Yes
osDetected	varchar	Yes
macAddress	varchar	Yes
status	varchar	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
findingsCritical	integer	No
findingsHigh	integer	No
findingsMedium	integer	No
findingsLow	integer	No
findingsInfo	integer	No
riskScore	real	Yes
openPorts	jsonb	No
createdAt	varchar	No

scan_runs (ScanRun)

ScanRun — a single execution instance of a Scan. Each time a scan is launched, a new ScanRun is created with an incrementing runNumber. Tracks progress, duration, host counts, and finding severity bre

Column	Type	Nullable	Notes
id	uuid	No	PK
scanId	uuid	No
runNumber	integer	No
status	varchar	No
progress	real	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
durationSeconds	integer	Yes
totalHosts	integer	No
hostsCompleted	integer	No
hostsFailed	integer	No
findingsCritical	integer	No
findingsHigh	integer	No
findingsMedium	integer	No
findingsLow	integer	No
findingsInfo	integer	No
segments	jsonb	No
engineId	varchar	Yes
engineType	varchar	Yes
log	text	Yes
createdAt	varchar	No
updatedAt	varchar	No

scan_schedules (ScanSchedule)

ScanSchedule — recurring schedule definitions for scans. Each schedule is linked to a Scan via scanId and defines the frequency, timing, and timezone for automatic scan execution. The scheduler servic

Column	Type	Nullable	Notes
id	uuid	No	PK
scanId	uuid	No
name	varchar	Yes
frequency	varchar	No
config	jsonb	No
isActive	boolean	No
nextRunAt	timestamp	Yes
lastRunAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

scan_templates (ScanTemplate)

ScanTemplate — built-in and custom scan template definitions. Templates define the default configuration for a scan type (e.g. Quick Scan, Full Vulnerability Scan, CIS Benchmark). Built-in templates a

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
slug	varchar	No
description	text	Yes
category	varchar	No
scanType	varchar	No
icon	varchar	Yes
estimatedDurationMinutes	integer	Yes
isBuiltin	boolean	No
isCustom	boolean	No
createdBy	uuid	Yes
config	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

scans (Scan)

Scan — the core scan definition. Represents a configured scan with targets, credentials, schedule, and results. Each scan can be launched multiple times, producing ScanRun records. Status follows the

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
folderId	uuid	Yes
templateId	uuid	Yes
policyId	uuid	Yes
createdBy	uuid	Yes
targets	jsonb	No
targetGroupIds	jsonb	No
excludedTargets	jsonb	No
credentialIds	jsonb	No
config	jsonb	No
scheduleType	varchar	No
scheduleConfig	jsonb	Yes
nextRunAt	timestamp	Yes
status	varchar	No
progress	real	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
durationSeconds	integer	Yes
totalHosts	integer	No
hostsCompleted	integer	No
hostsFailed	integer	No
findingsCritical	integer	No
findingsHigh	integer	No
findingsMedium	integer	No
findingsLow	integer	No
findingsInfo	integer	No
maxConcurrentHosts	int	Yes
maxChecksPerHost	int	Yes
networkTimeoutMs	int	Yes
retryCount	int	Yes
bandwidthLimitKbps	int	Yes
scanPriority	int	No
scanEngine	varchar	No
engineConfig	jsonb	Yes
tags	jsonb	No
notifications	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

sync_jobs (SyncJob)

Column	Type	Nullable	Notes
id	uuid	No	PK
status	varchar	No
ingestionStatus	varchar	No
statsStatus	varchar	No
triggerType	varchar	No
scope	varchar	No
dateRangeStart	date	Yes
dateRangeEnd	date	Yes
progress	int	No
totalRecords	int	No
processedRecords	int	No
apiCallsCount	int	No
phase	varchar	No
recordsInserted	int	No
recordsUpdated	int	No
recordsSkipped	int	No
recordsFailed	int	No
statusMessage	text	Yes
errorMessage	text	Yes
triggeredBy	varchar	Yes
createdAt	varchar	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
updatedAt	varchar	No

sync_logs (SyncLog)

Vulnerability entity for storing Tenable.io vulnerability data This allows viewing real IPs, hostnames, and downloading raw data UNIQUE CONSTRAINT: instanceKey (sha256 of assetUuid:pluginId:port:proto

Column	Type	Nullable	Notes
id	uuid	No	PK
syncJobId	varchar	No
endpoint	varchar	No
status	varchar	No
durationMs	int	Yes
recordCount	int	No
triggerType	varchar	No
triggeredBy	varchar	Yes
errorMessage	text	Yes
timestamp	varchar	No

vfp_exception (VfpException)

VfpException — Risk acceptance / exception request Tracks exception requests for vulnerabilities that cannot be remediated. Includes compensating controls assessment, approval workflow, and expiration

Column	Type	Nullable	Notes
id	uuid	No	PK
workPackageId	uuid	Yes
instanceKey	varchar	Yes
cveId	varchar	Yes
assetId	varchar	Yes
reason	text	No
compensatingControls	jsonb	Yes
questionnaire	jsonb	Yes
status	varchar	No
requestedBy	varchar	No
reviewedBy	varchar	Yes
reviewedAt	timestamp	Yes
expiresAt	timestamp	Yes
extendedAt	timestamp	Yes
extendedBy	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

vfp_policy_config (VfpPolicyConfig)

VfpPolicyConfig — Risk scoring policy configuration Stores the weight distribution and threshold breakpoints used by the VFP composite risk scoring engine. Only one policy may be active at a time (isA

Column	Type	Nullable	Notes
id	uuid	No	PK
policyName	varchar	No
weightsJson	jsonb	No
thresholds	jsonb	No
isActive	boolean	No
createdBy	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

vfp_risk_score (VfpRiskScore)

VfpRiskScore — Composite risk score per vulnerability instance Stores the computed composite score and all input factors used by the scoring engine. Each row represents one scored vulnerability instan

Column	Type	Nullable	Notes
id	uuid	No	PK
instanceKey	varchar	No
pluginId	varchar	Yes
cveId	varchar	Yes
cvss	decimal	Yes
vpr	decimal	Yes
severity	varchar	No
ageInDays	int	No
kevExploited	boolean	No
epssScore	decimal	Yes
exposureScope	varchar	No
assetCriticality	varchar	No
compensatingControls	boolean	No
hasPatch	boolean	No
compositeScore	decimal	No
driversJson	jsonb	No
computedAt	timestamp	No
policyConfigId	varchar	Yes
sourceScanner	varchar	No
createdAt	varchar	No

vfp_team (VfpTeam)

VfpTeam — Remediation team for work package assignment Teams group users for assigning work packages. Members are stored as a JSON array of { userId, name, role }.

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
ownerId	varchar	Yes
ownerName	varchar	Yes
members	jsonb	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

vfp_ticket_link (VfpTicketLink)

VfpTicketLink — External ticket system integration Links a work package to an external ticket (Jira, ServiceNow). The idempotencyKey (sha256 of workPackageId:provider:projectKey) prevents duplicate ti

Column	Type	Nullable	Notes
id	uuid	No	PK
workPackageId	uuid	No
provider	varchar	No
externalTicketId	varchar	No
externalUrl	varchar	Yes
status	varchar	No
idempotencyKey	varchar	Yes
lastSyncAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

vfp_validation_record (VfpValidationRecord)

VfpValidationRecord — Remediation verification evidence Tracks the validation/verification step after a work package has been remediated. Stores evidence URLs, rescan scheduling, and the final closure

Column	Type	Nullable	Notes
id	uuid	No	PK
workPackageId	uuid	No
evidenceUrls	jsonb	Yes
notes	text	Yes
rescanPlannedAt	timestamp	Yes
validatedBy	varchar	Yes
validatedAt	timestamp	Yes
closureReport	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

vfp_work_package (VfpWorkPackage)

VfpWorkPackage — Grouped remediation work unit A work package bundles related vulnerability instances into a single actionable unit that can be assigned, ticketed, tracked, and validated through its l

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
status	varchar	No
assignedTeam	varchar	Yes
assignedOwner	varchar	Yes
campaignId	uuid	Yes
createdBy	varchar	No
lockedAt	timestamp	Yes
closedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

vfp_work_package_item (VfpWorkPackageItem)

VfpWorkPackageItem — Individual vulnerability in a work package Each item references a specific vulnerability instance (by instanceKey) included in a parent work package. Denormalized fields (hostname

Column	Type	Nullable	Notes
id	uuid	No	PK
workPackageId	uuid	No
instanceKey	varchar	No
pluginId	varchar	Yes
cveId	varchar	Yes
hostname	varchar	Yes
severity	varchar	No
riskScore	decimal	Yes
sourceScanner	varchar	Yes
createdAt	varchar	No

vulnerabilities (Vulnerability)

Vulnerability entity for storing Tenable.io vulnerability data This allows viewing real IPs, hostnames, and downloading raw data UNIQUE CONSTRAINT: instanceKey (sha256 of assetUuid:pluginId:port:proto

Column	Type	Nullable	Notes
id	uuid	No	PK
instanceKey	varchar	Yes
findingId	varchar	Yes
assetUuid	varchar	No
hostname	varchar	Yes
ipv4	simple-array	Yes
ipv6	simple-array	Yes
operatingSystem	varchar	Yes
fqdn	simple-array	Yes
pluginId	int	No
pluginName	varchar	No
pluginFamily	varchar	Yes
description	text	Yes
solution	text	Yes
port	int	Yes
protocol	varchar	Yes
service	varchar	Yes
severity	varchar	No
severityId	int	No
cvssBaseScore	decimal	Yes
cvss3BaseScore	decimal	Yes
vprScore	float	Yes
cve	simple-array	Yes
cveIds	text	Yes
exploitAvailable	boolean	No
hasPatch	boolean	No
state	varchar	No
firstFound	timestamp	Yes
lastFound	timestamp	Yes
lastFixed	timestamp	Yes
firstFixedObservedAt	timestamp	Yes
syncJobId	varchar	Yes
osCategory	varchar	Yes
source	varchar	Yes
dataChecksum	varchar	Yes
version	int	No
lastSeenAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

vulnerability_state_transitions (VulnerabilityStateTransition)

VulnerabilityStateTransition tracks state changes over time Enhanced to support instanceKey-based tracking and detailed event metadata Used for: - Historical trend computation (correct snapshots) - MT

Column	Type	Nullable	Notes
id	uuid	No	PK
instanceKey	varchar	Yes
assetUuid	varchar	No
pluginId	int	No
port	int	No
protocol	varchar	No
previousState	varchar	Yes
newState	varchar	No
oldLastFound	timestamp	Yes
newLastFound	timestamp	Yes
oldLastFixed	timestamp	Yes
newLastFixed	timestamp	Yes
syncJobId	varchar	Yes
reasonTag	varchar	Yes
source	varchar	No
hasPatch	boolean	Yes
severity	varchar	Yes
pluginFamily	varchar	Yes
transitionedAt	varchar	No

vulnerability_stats (VulnerabilityStats)

VulnerabilityStats entity for pre-computed daily aggregations This allows fast dashboard loading without processing 100k+ records in realtime

Column	Type	Nullable	Notes
date	date	No	PK
totalActive	int	No
totalNew	int	No
totalRemediated	int	No
totalResurfaced	int	No
patchableNew	int	No
unpatchableNew	int	No
patchableRemediated	int	No
unpatchableRemediated	int	No
patchableResurfaced	int	No
unpatchableResurfaced	int	No
totalRemediatedCumulative	int	No
criticalCount	int	No
highCount	int	No
mediumCount	int	No
lowCount	int	No
infoCount	int	No
patchableActive	int	No
unpatchableActive	int	No
patchableCritical	int	No
patchableHigh	int	No
unpatchableCritical	int	No
unpatchableHigh	int	No
patchableMedium	int	No
patchableLow	int	No
patchableInfo	int	No
unpatchableMedium	int	No
unpatchableLow	int	No
unpatchableInfo	int	No
reopenedCount	int	No
meanTimeToRemediate	float	No
osCounts	simple-json	Yes
dataSource	varchar	No
syncJobId	varchar	Yes
computedAt	varchar	No

vulnerability_stats_by_category (VulnerabilityStatsByCategory)

VulnerabilityStatsByCategory stores daily per-category aggregations This enables correct historical trend computation - trends are computed from these snapshots, NOT derived from current state Categor

Column	Type	Nullable	Notes
date	date	No	PK
osCategory	varchar	No	PK
totalActive	int	No
totalNew	int	No
totalRemediated	int	No
totalResurfaced	int	No
patchableNew	int	No
unpatchableNew	int	No
patchableRemediated	int	No
unpatchableRemediated	int	No
patchableResurfaced	int	No
unpatchableResurfaced	int	No
criticalCount	int	No
highCount	int	No
mediumCount	int	No
lowCount	int	No
infoCount	int	No
patchableActive	int	No
unpatchableActive	int	No
patchableCritical	int	No
patchableHigh	int	No
unpatchableCritical	int	No
unpatchableHigh	int	No
patchableMedium	int	No
patchableLow	int	No
patchableInfo	int	No
unpatchableMedium	int	No
unpatchableLow	int	No
unpatchableInfo	int	No
validRemediations	int	No
mttrHours	decimal	Yes
mttrHoursValidOnly	decimal	Yes
dataSource	varchar	No
syncJobId	varchar	Yes
computedAt	varchar	No

widget_template (WidgetTemplate)

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
category	varchar	No
chartType	varchar	No
dataSource	varchar	No
config	jsonb	No
isSystem	boolean	No
previewIcon	varchar	Yes
tags	simple-array	No
usageCount	integer	No
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

AppSec / Pentest Scanner Tables

42 entities

Entity Relationships (Mermaid ERD)

Column Reference

appsec_credentials (AppSecCredential)

AppSecCredential — Centralized credential vault for the AppSec module. Stores named credentials (username/password, bearer token, or API key) that can be referenced from auth profiles and ScanContext

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
description	varchar	Yes
targetUrl	varchar	Yes
credType	varchar	No
username	text	Yes
passwordEncrypted	text	Yes
tokenEncrypted	text	Yes
loginUrl	varchar	Yes
loginPayloadTemplate	text	Yes
tokenExtractionPath	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

osint_api_keys (OsintApiKey)

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	varchar	Yes
serviceName	varchar	No
displayName	varchar	No
apiKey	text	No
enabled	boolean	No
lastValidatedAt	timestamp	Yes
lastValidationStatus	varchar	Yes
lastUsedAt	timestamp	Yes
usageCount	int	No
metadata	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_activity_events (PentestActivityEvent)

Column	Type	Nullable	Notes
id	uuid	No	PK
assessmentId	varchar	No
organizationId	varchar	No
eventType	varchar	No
data	jsonb	No
createdAt	varchar	No

pentest_agent_configs (PentestAgentConfig)

PentestAgentConfig - runtime configuration for each attack agent. Each agent (xssHunter, sqliProber, etc.) has a default config row that controls its behavior: whether it's enabled, max requests per s

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	Yes
agentName	varchar	No
displayName	varchar	No
description	text	Yes
category	varchar	No
enabled	boolean	No
maxRequestsPerSecond	integer	No
maxTotalRequests	integer	No
timeoutSeconds	integer	No
aggressiveness	varchar	No
owaspCoverage	jsonb	No
defaultPayloadSet	varchar	Yes
config	jsonb	No
assessmentTypes	jsonb	No
executionPhase	integer	No
createdAt	varchar	No
updatedAt	varchar	No

pentest_agent_logs (PentestAgentLog)

PentestAgentLog - execution log for each agent run within an assessment. Tracks the lifecycle of each agent's execution: start, progress, findings produced, errors encountered, and completion. Used fo

Column	Type	Nullable	Notes
id	uuid	No	PK
assessmentId	uuid	No
agentName	varchar	No
displayName	varchar	No
status	varchar	No
progress	real	No
requestsSent	integer	No
requestsSuccess	integer	No
requestsFailed	integer	No
endpointsTested	integer	No
rawFindingsCount	integer	No
validatedFindingsCount	integer	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
durationMs	integer	Yes
errorMessage	text	Yes
errorStack	text	Yes
retryCount	integer	No
wasRateLimited	boolean	No
wasWafBlocked	boolean	No
configSnapshot	jsonb	Yes
coverageData	jsonb	Yes
createdAt	varchar	No

pentest_assessments (PentestAssessment)

PentestAssessment - a single penetration test run against a target. Each assessment represents one lifecycle of: queue -> profile -> plan -> attack -> validate -> chain -> complete. Assessments track

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
targetId	uuid	No
name	varchar	No
applicationName	varchar	Yes
assessmentType	varchar	No
status	varchar	No
progress	real	No
currentPhase	varchar	Yes
config	jsonb	No
aiResidencyMode	varchar	No
priority	integer	No
encryptionConfig	jsonb	Yes
startedAt	timestamp	Yes
completedAt	timestamp	Yes
durationSeconds	integer	Yes
attackPlan	jsonb	Yes
aiUsage	jsonb	No
findingsTotal	integer	No
findingsCritical	integer	No
findingsHigh	integer	No
findingsMedium	integer	No
findingsLow	integer	No
findingsInfo	integer	No
exploitChainsFound	integer	No
agentsTotal	integer	No
agentsCompleted	integer	No
agentsFailed	integer	No
totalRequestsSent	integer	No
targetProfile	jsonb	Yes
errorMessage	text	Yes
errorLog	jsonb	No
tags	jsonb	No
createdBy	uuid	Yes
scanContext	jsonb	Yes
parentAssessmentId	uuid	Yes
baselineAssessmentId	uuid	Yes
runNumber	integer	No
pausedAtPhase	varchar	Yes
lastCheckpointAt	timestamptz	Yes
scheduleFrequency	varchar	Yes
scheduleEnabled	boolean	No
scheduleNextRun	timestamp	Yes
scheduleLastRun	timestamp	Yes
scheduleConfig	jsonb	Yes
phaseDurations	jsonb	Yes
requiresManualReview	boolean	No
createdAt	varchar	No
updatedAt	varchar	No

pentest_auth_profiles (PentestAuthProfile)

PentestAuthProfile - authentication configuration for authenticated testing. Stores credentials and auth flow details needed to maintain authenticated sessions during assessment. Supports multiple aut

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
authType	varchar	No
privilegeLevel	varchar	No
privilegeLabel	varchar	Yes
tokenValueEncrypted	text	Yes
tokenType	varchar	Yes
loginUrl	varchar	Yes
usernameField	varchar	Yes
passwordField	varchar	Yes
username	text	Yes
password	text	Yes
oauthConfig	jsonb	Yes
apiKey	text	Yes
apiKeyLocation	varchar	Yes
apiKeyName	varchar	Yes
bearerToken	text	Yes
customAuthFlow	jsonb	Yes
totpSecret	text	Yes
backupCodes	jsonb	Yes
multiUserContexts	jsonb	No
verified	boolean	No
lastVerifiedAt	timestamp	Yes
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_crawl_results (PentestCrawlResult)

PentestCrawlResult - stores crawl discovery data for an assessment. Each row represents a single crawled page, including its extracted links, forms, scripts, and response metadata. Used by agents to d

Column	Type	Nullable	Notes
id	uuid	No	PK
assessmentId	uuid	No
targetId	uuid	No
organizationId	uuid	No
url	varchar	No
canonicalUrl	varchar	No
depth	integer	No
statusCode	integer	No
contentType	varchar	Yes
responseTimeMs	integer	No
title	varchar	Yes
bodyLength	integer	No
links	jsonb	No
forms	jsonb	No
scripts	jsonb	No
headers	jsonb	No
discoveryMethod	varchar	No
createdAt	varchar	No

pentest_evidence (PentestEvidence)

PentestEvidence - proof artifacts attached to a finding. Each finding can have multiple evidence items: the HTTP request/response that triggered the vulnerability, screenshots, HAR files, OOB callback

Column	Type	Nullable	Notes
id	uuid	No	PK
findingId	uuid	Yes
assessmentId	uuid	No
evidenceType	varchar	No
title	varchar	No
httpRequest	text	Yes
httpResponse	text	Yes
statusCode	integer	Yes
responseTimeMs	integer	Yes
blobContent	text	Yes
mimeType	varchar	Yes
structuredData	jsonb	Yes
highlight	text	Yes
highlightOffset	integer	Yes
sortOrder	integer	No
createdAt	varchar	No

pentest_exploit_chains (PentestExploitChain)

PentestExploitChain - a multi-step attack path combining individual findings. Exploit chains represent the real-world impact of vulnerabilities when combined. For example: info disclosure (leak admin

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
assessmentId	uuid	No
title	varchar	No
narrative	text	Yes
severity	varchar	No
impactScore	real	No
findingIds	jsonb	No
steps	jsonb	No
mitreTechniques	jsonb	No
businessImpact	text	Yes
prerequisites	jsonb	No
confidence	real	No
discoveryMethod	varchar	No
proofStatus	varchar	No
executionEvidence	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_finding_exception (PentestFindingException)

PentestFindingException — AppSec exception / risk acceptance for DAST findings Separate from VfpException (which handles CVE-based vulnerability management). This entity handles CWE-based, endpoint-sp

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
targetId	uuid	No
dedupHash	varchar	No
findingId	uuid	Yes
findingTitle	varchar	No
findingSeverity	varchar	No
vulnType	varchar	Yes
endpoint	varchar	Yes
reason	text	No
compensatingControls	text	Yes
requestedBy	uuid	No
requestedAt	timestamp	No
status	varchar	No
reviewedBy	uuid	Yes
reviewedAt	timestamp	Yes
reviewComment	text	Yes
secondReviewedBy	uuid	Yes
secondReviewedAt	timestamp	Yes
secondReviewComment	text	Yes
requiresSecondReview	boolean	No
expiresAt	timestamp	No
originalDaysGranted	integer	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_finding_observation (PentestFindingObservation)

PentestFindingObservation - append-only observation record for scan history intelligence. Each completed scan writes one observation per finding it detects ('present') and one per finding from the pre

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
targetId	uuid	No
assessmentId	uuid	No
dedupHash	varchar	No
semanticHash	varchar	Yes
findingId	uuid	Yes
severity	varchar	No
confidence	real	No
status	varchar	No
title	varchar	Yes
vulnType	varchar	Yes
scanCoverage	real	Yes
observedAt	timestamp	No
createdAt	varchar	No

pentest_findings (PentestFinding)

PentestFinding - an individual vulnerability discovered during an assessment. Each finding is produced by an attack agent, then validated by the validation engine with a confidence score. Findings can

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
assessmentId	uuid	No
targetId	uuid	No
title	varchar	No
description	text	Yes
vulnType	varchar	No
severity	varchar	No
cvssScore	real	Yes
cvssVector	varchar	Yes
cweIds	jsonb	No
owaspCategory	varchar	Yes
owaspApiCategory	varchar	Yes
owaspLlmCategory	varchar	Yes
endpoint	varchar	No
httpMethod	varchar	No
parameter	varchar	Yes
parameterLocation	varchar	Yes
confidence	real	No
validationMethod	varchar	No
confidenceTier	varchar	No
status	varchar	No
isFalsePositive	boolean	No
discoveredBy	varchar	No
contributingAgents	jsonb	No
payload	text	Yes
dedupHash	varchar	Yes
semanticHash	varchar	Yes
historyStatus	varchar	Yes
sources	jsonb	Yes
multiEngineConfirmed	boolean	No
remediation	jsonb	Yes
references	jsonb	No
weaverScore	real	Yes
businessImpact	jsonb	Yes
lastRetestAt	timestamp	Yes
retestStatus	varchar	Yes
feedbackNote	text	Yes
feedbackBy	uuid	Yes
feedbackAt	timestamp	Yes
slaDeadline	timestamp	Yes
slaBreached	boolean	No
slaBreachedAt	timestamp	Yes
firstSeenAt	timestamp	No
lastSeenAt	timestamp	No
createdAt	varchar	No
updatedAt	varchar	No

pentest_phase0_sessions (Phase0Session)

Sensitive patterns that trigger encryption of the answer field. */ const SENSITIVE_ANSWER_PATTERNS = /password|token|secret|credential|bearer|api.?key|authorization/i function getPhase0EncryptionKey()

Column	Type	Nullable	Notes
id	uuid	No	PK
assessmentId	uuid	No
organizationId	uuid	Yes
phase	varchar	No
question	text	No
answer	text	Yes
answeredAt	timestamptz	Yes
timeoutSeconds	int	No
timedOut	boolean	No
metadata	jsonb	Yes
discoveredSubdomains	jsonb	Yes
dnsIntelligence	jsonb	Yes
historicalEndpoints	jsonb	Yes
detectedAiServices	jsonb	Yes
createdAt	timestamptz	No

pentest_reports (PentestReport)

PentestReport - generated assessment report. Reports are generated after an assessment completes and can be in multiple formats (PDF, HTML, JSON). They include executive summaries, technical findings,

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
assessmentId	uuid	No
title	varchar	No
reportType	varchar	No
format	varchar	No
status	varchar	No
executiveSummary	text	Yes
content	text	Yes
reportMetadata	jsonb	No
complianceFrameworks	jsonb	No
filePath	varchar	Yes
fileSizeBytes	integer	Yes
fileHash	varchar	Yes
sharedWith	jsonb	No
isSharedExternally	boolean	No
errorMessage	text	Yes
generatedBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_scan_template (PentestScanTemplate)

PentestScanTemplate — reusable scan configuration templates for AppSec assessments. Users can create custom templates specifying which agents to run, budget levels, crawl depth, AI planning toggles, e

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
description	text	Yes
isDefault	boolean	No
baseType	varchar	No
enabledAgents	jsonb	No
budgetLevel	varchar	No
customBudgets	jsonb	Yes
maxCrawlPages	integer	No
maxCrawlDepth	integer	No
scanTimeoutMinutes	integer	Yes
enableAiPlanning	boolean	No
enableChainAnalysis	boolean	No
enableMultiPass	boolean	No
enableHeadlessCrawl	boolean	No
prioritizeSpecEndpoints	boolean	No
enableIntelligentDiscovery	boolean	No
enableApiVersionMirroring	boolean	No
createdBy	uuid	Yes
usageCount	integer	No
lastUsedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_target_learned_context (TargetLearnedContext)

TargetLearnedContext — persists learned intelligence about a pentest target across multiple scans. Populated during Phase 0 discovery (OSINT, sector detection, schema field harvesting). Unique per (ta

Column	Type	Nullable	Notes
id	uuid	No	PK
targetId	uuid	No
organizationId	uuid	Yes
sector	varchar	Yes
subsector	varchar	Yes
attackPatterns	jsonb	No
osintSubdomains	jsonb	No
osintPorts	jsonb	No
harvestedSchemaFields	jsonb	No
bootstrapStrategy	varchar	Yes
discoveredEndpoints	jsonb	No
authPatterns	jsonb	No
productiveResourceIds	jsonb	No
scanIntelligence	jsonb	No
createdAt	timestamptz	No
updatedAt	timestamptz	No

pentest_targets (PentestTarget)

PentestTarget - a web application or API endpoint registered for security assessment. Each target represents a single root URL or API base that can be assessed. Targets belong to an organization (mult

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
description	text	Yes
baseUrl	varchar	No
targetType	varchar	No
environment	varchar	No
status	varchar	No
ownershipVerified	boolean	No
verificationMethod	varchar	Yes
techStack	jsonb	No
apiSpecUrl	text	Yes
apiSpec	jsonb	Yes
scopeIncludes	jsonb	No
scopeExcludes	jsonb	No
respectRobotsTxt	boolean	No
maxCrawlPages	integer	No
maxCrawlDepth	integer	No
authProfileId	uuid	Yes
totalAssessments	integer	No
lastAssessmentAt	timestamp	Yes
openFindings	integer	No
tags	jsonb	No
metadata	jsonb	No
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

pentest_test_cases (PentestTestCase)

PentestTestCase - a reusable test case template that agents execute. Migrated from the reference codebase's 1,953 SQL test cases + 57-part seed files. Each test case defines a specific vulnerability c

Column	Type	Nullable	Notes
id	uuid	No	PK
testCaseId	varchar	No
title	varchar	No
description	text	Yes
vulnType	varchar	No
owaspCategory	varchar	Yes
owaspApiCategory	varchar	Yes
cweIds	jsonb	No
riskLevel	varchar	No
agentId	varchar	No
phase	varchar	No
payloads	jsonb	No
detectionMethod	varchar	No
expectedPatterns	jsonb	No
applicableMethods	jsonb	No
applicableLocations	jsonb	No
isActive	boolean	No
source	varchar	No
version	int	No
tags	jsonb	No
remediationTemplate	text	Yes
references	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

proxy_config (ProxyConfig)

Singleton row (id = 'default') that persists the corporate proxy configuration. Supports HTTP and SOCKS5 proxies with optional authentication. Password is stored encrypted via AES-256-GCM (crypto.ts).

Column	Type	Nullable	Notes
id	varchar	No	PK
enabled	boolean	No
proxyType	varchar	No
proxyUrl	varchar	Yes
proxyPort	int	Yes
authUsername	varchar	Yes
authPassword	text	Yes
noProxyList	text	No
useForDns	boolean	No
lastTestedAt	timestamp	Yes
lastTestResult	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_agents (ScannerAgent)

ScannerAgent — WeaverScan agent registry Each row represents a registered scanner agent running on a target host. Agents authenticate via mTLS certificate and report heartbeats, SBOM snapshots, and sc

Column	Type	Nullable	Notes
id	uuid	No	PK
hostname	varchar	No
biosUuid	varchar	Yes
macAddress	varchar	Yes
ipAddress	varchar	Yes
osName	varchar	Yes
osFamily	varchar	Yes
arch	varchar	Yes
agentVersion	varchar	No
status	varchar	No
assetId	uuid	Yes
certificateFingerprint	varchar	Yes
lastHeartbeat	timestamp	Yes
lastScanAt	timestamp	Yes
scanIntervalMinutes	integer	No
tags	jsonb	No
cpuUsagePercent	float	Yes
memoryUsageMb	float	Yes
diskUsageMb	float	Yes
uptime	integer	Yes
cloudInstanceId	varchar	Yes
connectionType	varchar	No
maxConcurrentTasks	integer	No
currentTaskCount	integer	No
jwtFingerprint	varchar	Yes
capabilities	jsonb	No
networkZone	varchar	Yes
lastError	text	Yes
totalScansCompleted	integer	No
totalFindingsReported	integer	No
agentName	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_attack_paths (ScannerAttackPath)

ScannerAttackPath — Computed attack path analysis Represents a chain of vulnerabilities across assets that an attacker could exploit to move laterally. Includes MITRE ATT&CK technique mapping and a co

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
severity	varchar	No
score	float	No
hops	jsonb	No
startAsset	varchar	Yes
targetAsset	varchar	Yes
mitreTechniques	jsonb	No
status	varchar	No
computedAt	timestamp	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_benchmarks (ScannerBenchmark)

ScannerBenchmark — ground truth database for vulnerability benchmarks. Stores known vulnerabilities per intentionally-vulnerable app (dvws-node, crAPI, etc.) so the scanner can compare its findings ag

Column	Type	Nullable	Notes
id	uuid	No	PK
appName	varchar	No
vulnName	varchar	No
vulnType	varchar	No
owaspCategory	varchar	No
endpoint	varchar	Yes
httpMethod	varchar	Yes
dastDetectable	boolean	No
status	varchar	No
notes	text	Yes
sourceUrl	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_compliance_attestations (ScannerComplianceAttestation)

Column	Type	Nullable	Notes
id	uuid	No	PK
framework	varchar	No
status	varchar	No
score	float	No
findings	jsonb	No
attestedBy	varchar	Yes
attestedAt	timestamp	Yes
validUntil	timestamp	Yes
scanScope	jsonb	No
evidencePackageUrl	varchar	Yes
clientId	integer	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_compliance_snapshots (ScannerComplianceSnapshot)

ScannerComplianceSnapshot — Point-in-time compliance assessment Stores the overall compliance score and per-control pass/fail results for a given framework (PCI-DSS, SOC2, HIPAA, ISO 27001, NIST CSF,

Column	Type	Nullable	Notes
id	uuid	No	PK
frameworkId	varchar	No
overallScore	float	No
passedControls	integer	No
failedControls	integer	No
notApplicableControls	integer	No
details	jsonb	No
assessedAt	timestamp	No
createdAt	varchar	No

scanner_config (ScannerConfig)

ScannerConfig — stores configuration for each connected vulnerability scanner. Each row represents one scanner instance (e.g. "Tenable Production", "Qualys Dev"). Credentials are stored encrypted in J

Column	Type	Nullable	Notes
id	uuid	No	PK
slug	varchar	No
displayName	varchar	No
adapterType	varchar	No
baseUrl	varchar	Yes
credentialsEncrypted	jsonb	Yes
syncSchedule	varchar	Yes
batchSize	integer	No
isActive	boolean	No
healthStatus	varchar	No
lastSyncAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_conflicts (ScannerConflict)

Column	Type	Nullable	Notes
id	uuid	No	PK
cve	varchar	No
sourceA	varchar	No
sourceB	varchar	No
findingA	jsonb	No
findingB	jsonb	No
severityA	varchar	No
severityB	varchar	No
scannerSources	jsonb	Yes
severityValues	jsonb	Yes
conflictType	varchar	Yes
resolution	varchar	No
resolvedBy	varchar	Yes
resolvedAt	timestamp	Yes
mergedSeverity	varchar	Yes
notes	text	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_containers (ScannerContainer)

ScannerContainer — Container tracking for WeaverScan Tracks individual containers running on agents. Supports Docker, containerd, and CRI-O runtimes. Links to Kubernetes metadata (namespace, pod, clus

Column	Type	Nullable	Notes
id	uuid	No	PK
containerId	varchar	No
containerName	varchar	Yes
imageName	varchar	No
imageTag	varchar	No
imageDigest	varchar	Yes
hostAgentId	uuid	No
runtime	varchar	No
status	varchar	No
namespace	varchar	Yes
podName	varchar	Yes
clusterName	varchar	Yes
vulnerabilityCount	integer	No
criticalCount	integer	No
highCount	integer	No
mediumCount	integer	No
lowCount	integer	No
sbomGenerated	boolean	No
lastScannedAt	timestamp	Yes
layers	jsonb	No
ports	jsonb	No
environment	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_detection_signatures (ScannerDetectionSignature)

ScannerDetectionSignature — Vulnerability detection rules Each signature describes how to detect a specific CVE on an asset, e.g. by checking installed package versions, config files, or registry keys

Column	Type	Nullable	Notes
id	uuid	No	PK
cveId	varchar	No
detectionType	varchar	No
packageName	varchar	Yes
ecosystem	varchar	Yes
affectedVersions	varchar	Yes
fixedVersion	varchar	Yes
osFilter	varchar	Yes
detectionLogic	jsonb	Yes
source	varchar	No
confidence	float	No
requiresReview	boolean	No
isActive	boolean	No
dataSources	varchar	Yes
sourceForCvss	varchar	Yes
sourceForPackage	varchar	Yes
reviewedBy	varchar	Yes
reviewedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_edr_events (ScannerEdrEvent)

ScannerEdrEvent — EDR event tracking for WeaverScan Records endpoint detection and response events ingested from agents. Covers process execution, file changes, network connections, registry modificat

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
eventType	varchar	No
severity	varchar	No
processName	varchar	Yes
processPath	varchar	Yes
processHash	varchar	Yes
parentProcessName	varchar	Yes
userId	varchar	Yes
commandLine	text	Yes
filePath	varchar	Yes
fileAction	varchar	Yes
networkDestIp	varchar	Yes
networkDestPort	integer	Yes
networkProtocol	varchar	Yes
yaraRuleMatch	varchar	Yes
mitreAttackId	varchar	Yes
details	jsonb	No
acknowledged	boolean	No
detectedAt	timestamp	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_enrollment_tokens (ScannerEnrollmentToken)

ScannerEnrollmentToken — One-time or multi-use tokens for agent enrollment Agents present an enrollment token on first contact to register themselves. Tokens can be scoped with tags that auto-apply to

Column	Type	Nullable	Notes
id	uuid	No	PK
token	varchar	No
name	varchar	No
description	text	Yes
maxUses	integer	No
usedCount	integer	No
expiresAt	timestamp	Yes
isActive	boolean	No
createdBy	varchar	No
tags	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_false_positive_patterns (ScannerFalsePositivePattern)

ScannerFalsePositivePattern — False positive suppression rules Defines patterns for suppressing known false positives in scan results, e.g. a CVE that doesn't apply to a specific package/OS combinatio

Column	Type	Nullable	Notes
id	uuid	No	PK
patternType	varchar	No
cveId	varchar	Yes
packageName	varchar	Yes
pluginFamily	varchar	Yes
assetFilter	jsonb	Yes
reason	text	No
suppressionCount	integer	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_fim_rules (ScannerFimRule)

ScannerFimRule — File Integrity Monitoring rules for WeaverScan Defines which file paths agents should monitor for changes. Each rule specifies watch paths, exclusions, actions to monitor, and the sev

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
watchPaths	jsonb	No
excludePaths	jsonb	No
fileActions	jsonb	No
alertSeverity	varchar	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_intel_sync_log (ScannerIntelSyncLog)

ScannerIntelSyncLog — Threat intelligence feed sync tracking Records each sync attempt from external intel sources (NVD, GitHub Advisories, CISA KEV, EPSS, Red Hat OVAL, etc.) with counts and error de

Column	Type	Nullable	Notes
id	uuid	No	PK
source	varchar	No
status	varchar	No
recordsFetched	integer	No
recordsNew	integer	No
recordsUpdated	integer	No
errorMessage	text	Yes
startedAt	timestamp	No
completedAt	timestamp	Yes
createdAt	varchar	No

scanner_mobile_devices (ScannerMobileDevice)

ScannerMobileDevice — Mobile/IoT device tracking for WeaverScan Tracks mobile devices (iOS, Android, ChromeOS) and IoT endpoints registered via MDM providers (Jamf, Intune, Workspace ONE) or manual en

Column	Type	Nullable	Notes
id	uuid	No	PK
deviceName	varchar	No
deviceType	varchar	No
osVersion	varchar	Yes
mdmProvider	varchar	Yes
mdmDeviceId	varchar	Yes
serialNumber	varchar	Yes
model	varchar	Yes
manufacturer	varchar	Yes
complianceStatus	varchar	No
lastCheckin	timestamp	Yes
isJailbroken	boolean	No
isEncrypted	boolean	No
installedApps	jsonb	No
securityPatchLevel	varchar	Yes
assetId	uuid	Yes
tags	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_nlp_policies (ScannerNlpPolicy)

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	No
ruleText	text	No
parsedConditions	jsonb	Yes
compiledRules	jsonb	Yes
severity	varchar	Yes
enabled	boolean	No
status	varchar	No
targetScope	varchar	Yes
createdBy	varchar	Yes
violationCount	int	No
lastEvaluatedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_relays (ScannerRelay)

ScannerRelay — WeaverRelay tracking entity Represents a relay node in the WeaverScan network. Relays act as local aggregation points for agents, buffering scan results and distributing intelligence DB

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
hostname	varchar	No
ipAddress	varchar	Yes
status	varchar	No
relayType	varchar	No
uplinkRelayId	uuid	Yes
connectedAgents	integer	No
bufferSizeMb	float	No
bufferCapacityMb	float	No
lastIntelDbUpdate	timestamp	Yes
intelDbVersion	varchar	Yes
lastHeartbeat	timestamp	Yes
tlsCertFingerprint	varchar	Yes
lastExportAt	timestamp	Yes
tags	jsonb	No
splitTunnelConfig	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

scanner_remediation_jobs (ScannerRemediationJob)

ScannerRemediationJob — Agent-executed remediation tasks Represents an approved (or pending) remediation action to be executed by a scanner agent, such as updating a package, applying a patch, or roll

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
vulnerabilityId	varchar	Yes
cveId	varchar	Yes
packageName	varchar	Yes
action	varchar	No
command	text	No
status	varchar	No
approvedBy	varchar	Yes
rejectedBy	varchar	Yes
rejectedReason	text	Yes
approvedAt	timestamp	Yes
executedAt	timestamp	Yes
completedAt	timestamp	Yes
rolledBackAt	timestamp	Yes
rollbackCommand	text	Yes
targetVersion	varchar	Yes
result	jsonb	Yes
output	text	Yes
errorMessage	text	Yes
dryRun	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scanner_sbom_drift_events (ScannerSbomDriftEvent)

ScannerSbomDriftEvent — SBOM change detection events When consecutive SBOM snapshots differ, drift events are generated for each package added, removed, or changed. Used for change tracking and securi

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
driftType	varchar	No
packageName	varchar	No
previousVersion	varchar	Yes
newVersion	varchar	Yes
ecosystem	varchar	Yes
riskLevel	varchar	No
acknowledged	boolean	No
acknowledgedBy	varchar	Yes
acknowledgedAt	timestamp	Yes
detectedAt	timestamp	No
createdAt	varchar	No

scanner_sbom_snapshots (ScannerSbomSnapshot)

ScannerSbomSnapshot — Point-in-time SBOM capture from an agent Stores the full CycloneDX (or SPDX) SBOM payload submitted by an agent after a software inventory scan. Used for drift detection and vuln

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
format	varchar	No
packageCount	integer	No
checksum	varchar	No
sbomData	jsonb	No
collectedAt	timestamp	No
createdAt	varchar	No

scanner_scan_results (ScannerScanResult)

ScannerScanResult — Individual scan execution result from an agent Each row represents one scan run (vulnerability, config, or drift). Contains severity counts and optional raw engine output for foren

Column	Type	Nullable	Notes
id	uuid	No	PK
agentId	uuid	No
scanType	varchar	No
scanEngine	varchar	No
status	varchar	No
findingsCount	integer	No
criticalCount	integer	No
highCount	integer	No
mediumCount	integer	No
lowCount	integer	No
infoCount	integer	No
scanDurationMs	integer	Yes
packageCount	integer	Yes
rawOutput	jsonb	Yes
errorMessage	text	Yes
startedAt	timestamp	No
completedAt	timestamp	Yes
createdAt	varchar	No

scanner_sync_log (ScannerSyncLog)

ScannerSyncLog — tracks each sync run for any scanner. Records start time, completion, status, and counts of processed/new/updated vulns. Used for audit trail, debugging sync issues, and monitoring sy

Column	Type	Nullable	Notes
id	uuid	No	PK
scannerSlug	varchar	No
startedAt	timestamp	No
completedAt	timestamp	Yes
status	varchar	No
vulnsProcessed	integer	No
vulnsNew	integer	No
vulnsUpdated	integer	No
errorMessage	text	Yes
createdAt	varchar	No

AI Labs Tables

11 entities

Entity Relationships (Mermaid ERD)

Column Reference

ai_cache_entry (AiCacheEntry)

AiCacheEntry — Persists AI response cache entries to survive restarts. Used by aiCache.service.ts for warm cache loading on startup.

Column	Type	Nullable	Notes
key	varchar	No	PK
response	text	No
category	varchar	No
keywords	simple-array	Yes
hitCount	integer	No
ttlMs	bigint	No
createdAt	varchar	No

ai_conversation (AiConversation)

AiConversation — Persistent AI chat conversations Stores multi-turn conversations between users and the AI assistant. Each conversation has a feature context (defaults to 'chat') and can carry vulnera

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	varchar	No
title	varchar	Yes
feature	varchar	No
messages	jsonb	No
context	jsonb	Yes
status	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

ai_governance_policies (AiGovernancePolicy)

AiGovernancePolicy — An organization-defined policy governing AI tool usage. Policies can operate as allowlists, blocklists, usage limits, or data classification rules. Each policy contains a set of r

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
policyType	varchar	No
scope	varchar	No
rules	jsonb	No
isEnabled	boolean	No
enforcementMode	varchar	No
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

ai_prompt_template (AiPromptTemplate)

AiPromptTemplate — Versioned prompt templates for AI features Each AI feature (fix_plan, ticket_writer, exec_summary, root_cause, exception_assistant, chat) has associated prompt templates with {{vari

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
feature	varchar	No
systemPrompt	text	No
userPromptTemplate	text	No
variables	jsonb	Yes
version	integer	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

ai_provider (AiProvider)

AiProvider — Configurable AI provider settings Stores connection details and configuration for different AI providers (OpenAI, Anthropic, Local LLM, etc.). One provider can be marked as the default fo

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
slug	varchar	No
apiEndpoint	varchar	Yes
modelId	varchar	Yes
apiKey	varchar	Yes
isActive	boolean	No
isDefault	boolean	No
maxTokens	integer	No
temperature	decimal	No
config	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

ai_risks (AiRisk)

AiRisk — A detected risk or violation related to AI tool usage. Risks are raised when AI tools are used in ways that violate policy: shadow AI usage, data leakage, unauthorized models, policy violatio

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
aiToolId	uuid	Yes
riskType	varchar	No
severity	varchar	No
title	varchar	No
description	text	Yes
affectedUsers	jsonb	Yes
evidence	jsonb	Yes
status	varchar	No
detectedAt	timestamp	No
mitigatedAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

ai_tools (AiTool)

AiTool — An AI/ML tool detected or registered within an organization. Tracks AI tools in use across the organization, whether discovered automatically (via SBOM, DNS monitoring, network traffic analys

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	No
name	varchar	No
vendor	varchar	Yes
category	varchar	No
status	varchar	No
detectionMethod	varchar	No
dataClassification	varchar	No
usersCount	integer	Yes
riskScore	integer	No
metadata	jsonb	Yes
firstSeenAt	timestamp	Yes
lastSeenAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

ai_usage_log (AiUsageLog)

AiUsageLog — Tracks AI API usage for billing and analytics Records every AI execution with token counts, latency, provider info, and status. Enables usage dashboards, cost tracking, and rate limiting.

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	varchar	No
feature	varchar	No
providerId	varchar	Yes
modelId	varchar	Yes
inputTokens	integer	No
outputTokens	integer	No
totalTokens	integer	No
latencyMs	integer	No
status	varchar	No
errorMessage	text	Yes
metadata	jsonb	Yes
promptRaw	text	Yes
promptSanitized	text	Yes
systemPrompt	text	Yes
response	text	Yes
sanitizationApplied	boolean	No
providerType	varchar	Yes
responseSource	varchar	Yes
createdAt	varchar	No

ai_user_provider (AiUserProvider)

AiUserProvider — Per-user AI provider configuration Allows individual users to configure their own AI models (e.g., local Ollama, LM Studio) without affecting other users. The system resolves provider

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	varchar	No
name	varchar	No
providerType	varchar	No
apiEndpoint	varchar	No
modelId	varchar	Yes
apiKey	varchar	Yes
isActive	boolean	No
isPreferred	boolean	No
maxTokens	integer	No
temperature	decimal	No
config	jsonb	Yes
createdAt	varchar	No
updatedAt	varchar	No

anomaly_days (AnomalyDay)

AnomalyDay tracks days with detected data anomalies (spikes) Used for: - KPI normalization (exclude anomaly days from counts) - Spike investigation and root cause analysis - Automated detection based

Column	Type	Nullable	Notes
date	date	No	PK
fixedCount	int	No
baselineAvg	decimal	Yes
baselineStddev	decimal	Yes
classification	varchar	No
status	varchar	No
suspectedCause	varchar	Yes
distinctPluginsAffected	int	Yes
distinctAssetsAffected	int	Yes
notes	text	Yes
createdAt	varchar	No

sensitive_data_patterns (SensitiveDataPattern)

SensitiveDataPattern - Configurable regex patterns for sensitive data detection. Supports built-in patterns (shipped with app), industry-specific patterns, and user-created custom patterns. Used by th

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	uuid	Yes
name	varchar	No
description	text	Yes
category	varchar	No
industry	varchar	No
complianceFramework	varchar	Yes
regexPattern	text	No
regexFlags	varchar	No
severity	varchar	No
isBuiltIn	boolean	No
enabled	boolean	No
cweIds	jsonb	No
sampleMatches	jsonb	No
sampleNonMatches	jsonb	No
falsePositiveHints	jsonb	No
aiGeneratedFrom	text	Yes
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

Cloud Security Tables

3 entities

Entity Relationships (Mermaid ERD)

Column Reference

sbom_asset_link (SbomAssetLink)

SbomAssetLink — Links SBOM components to specific assets Many-to-many relationship between components and assets, tracking which version is installed and how it was detected.

Column	Type	Nullable	Notes
id	uuid	No	PK
componentId	varchar	No
assetUuid	varchar	No
installedVersion	varchar	Yes
detectedBy	varchar	No
sbomFormat	varchar	Yes
firstSeen	timestamp	No
lastSeen	timestamp	No
createdAt	varchar	No

sbom_component (SbomComponent)

SbomComponent — Software Bill of Materials component record Represents a single software component (library, framework, OS package) discovered via SBOM import (CycloneDX or SPDX).

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
version	varchar	No
vendor	varchar	Yes
packageUrl	varchar	Yes
license	varchar	Yes
type	varchar	No
hash	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

sbom_import_log (SbomImportLog)

SbomImportLog — Audit trail for SBOM file imports Records every SBOM import operation including file details, counts of imported components/links, and any errors encountered.

Column	Type	Nullable	Notes
id	uuid	No	PK
filename	varchar	No
format	varchar	No
assetUuid	varchar	Yes
componentsImported	int	No
linkagesCreated	int	No
errors	jsonb	Yes
importedBy	varchar	No
importedAt	timestamp	No
createdAt	varchar	No

Administration & Auth Tables

18 entities

Entity Relationships (Mermaid ERD)

Column Reference

api_audit_logs (ApiAuditLog)

Column	Type	Nullable	Notes
id	int	No	PK
timestamp	varchar	No
endpoint	varchar	No
method	varchar	No
status	varchar	No
httpStatus	int	Yes
durationMs	int	No
recordsLoaded	int	No
chunksProcessed	int	No
totalChunks	int	No
syncType	varchar	No
syncId	varchar	Yes
errorMessage	text	Yes
requestParams	jsonb	Yes
responseMetadata	jsonb	Yes

audit_log (AuditLog)

Column	Type	Nullable	Notes
id	uuid	No	PK
eventType	varchar	No
actorId	uuid	Yes
actorRole	varchar	Yes
actorEmail	varchar	Yes
targetId	text	Yes
targetType	varchar	Yes
metadata	jsonb	Yes
ipAddress	varchar	Yes
userAgent	text	Yes
isVendorAction	boolean	No
createdAt	varchar	No

ip_blacklist (IpBlacklist)

Column	Type	Nullable	Notes
id	uuid	No	PK
ipAddress	varchar	No
reason	varchar	No
failedAttempts	int	No
relatedUserEmails	simple-array	Yes
blockedAt	timestamp	No
expiresAt	timestamp	Yes
isActive	boolean	No
blockedByEmail	varchar	Yes
unblockedByEmail	varchar	Yes
unblockedAt	timestamp	Yes
createdAt	varchar	No

ip_whitelist (IpWhitelist)

Column	Type	Nullable	Notes
id	uuid	No	PK
ipAddress	varchar	No
reason	varchar	No
description	varchar	Yes
whitelistedAt	timestamp	No
expiresAt	timestamp	Yes
isActive	boolean	No
createdByEmail	varchar	No
removedByEmail	varchar	Yes
removedAt	timestamp	Yes
createdAt	varchar	No

license_config (LicenseConfig)

Singleton row (id = 'default') that persists the active license key in the database. Priority on startup: 1. This table (set via UI import — survives all restarts) 2. LICENSE_KEY env var (bootstrap /

Column	Type	Nullable	Notes
id	varchar	No	PK
licenseKey	text	No
importedBy	varchar	Yes
deploymentId	varchar	Yes
jti	varchar	Yes
lastSuccessfulCheckin	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

license_events (LicenseEvent)

Column	Type	Nullable	Notes
id	uuid	No	PK
eventType	varchar	No
licenseJti	varchar	Yes
licenseState	varchar	Yes
daysRemaining	integer	Yes
metadata	jsonb	Yes
message	text	Yes
createdAt	varchar	No

notification_config (NotificationConfig)

NotificationConfig — Global notification system configuration Stores SMTP settings and global notification preferences. Only one row should exist (singleton pattern).

Column	Type	Nullable	Notes
id	uuid	No	PK
smtpHost	varchar	Yes
smtpPort	int	No
smtpUser	varchar	Yes
smtpPassEncrypted	text	Yes
fromAddress	varchar	Yes
globalEnabled	boolean	No
rateLimitPerMinute	int	No
createdAt	varchar	No
updatedAt	varchar	No

notification_log (NotificationLog)

NotificationLog — Tracks every notification sent to users Supports in-app and email channels. Used for the notification inbox, read tracking, and delivery audit trail.

Column	Type	Nullable	Notes
id	uuid	No	PK
recipientId	varchar	No
type	varchar	No
channel	varchar	No
status	varchar	No
title	varchar	No
body	text	No
metadata	jsonb	Yes
createdAt	varchar	No
readAt	timestamp	Yes

notification_preference (NotificationPreference)

NotificationPreference — Per-user notification channel preferences Each user can configure how they want to receive each notification type: in_app, email, both, or none.

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	varchar	No
notificationType	varchar	No
channel	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

roles (Role)

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
permissions	jsonb	No
isSystem	boolean	No
createdAt	varchar	No
updatedAt	varchar	No

Relations:

• users: OneToMany → User

saved_filters (SavedFilter)

SavedFilter — User-scoped saved filter presets for Explore page Each user can save named filter configurations for both the Vulnerabilities and Assets tabs. Filters can be Quick Filters, Advanced Quer

Column	Type	Nullable	Notes
id	uuid	No	PK
userId	uuid	No
name	varchar	No
page	varchar	No
filterData	jsonb	No
isDefault	boolean	No
createdAt	varchar	No
updatedAt	varchar	No

security_audit_logs (SecurityAuditLog)

Column	Type	Nullable	Notes
id	int	No	PK
timestamp	varchar	No
eventType	varchar	No
userId	varchar	Yes
userEmail	varchar	Yes
userRole	varchar	Yes
ipAddress	varchar	Yes
userAgent	varchar	Yes
endpoint	varchar	Yes
method	varchar	Yes
success	boolean	No
details	jsonb	Yes
severity	varchar	No
authMethod	varchar	Yes

settings (Settings)

Column	Type	Nullable	Notes
key	varchar	No	PK
value	jsonb	No
description	varchar	Yes
updatedAt	varchar	No

sso_config (SsoConfig)

Singleton row (id = 'default') storing Microsoft Entra ID SSO configuration. Only one row exists — upserted via the Admin SSO settings page. The clientSecret is AES-256-GCM encrypted at rest; decrypti

Column	Type	Nullable	Notes
id	varchar	No	PK
tenantId	varchar	Yes
clientId	varchar	Yes
encryptedClientSecret	text	Yes
enabled	boolean	No
loginButtonVisible	boolean	No
autoProvision	boolean	No
allowedDomains	jsonb	No
enforcedDomains	jsonb	No
defaultRole	varchar	No
roleMapping	jsonb	No
createdAt	varchar	No
updatedAt	varchar	No

tenant_entitlements (TenantEntitlement)

Per-tenant entitlement record in the public schema. Populated on provisioning, updated on plan/status changes from TLM. Used as local fallback when TLM+Redis are unreachable. Resolution chain: Redis c

Column	Type	Nullable	Notes
id	uuid	No	PK
customerId	varchar	No
customerName	varchar	Yes
schemaName	varchar	Yes
plan	varchar	No
status	varchar	No
allowedModules	jsonb	No
maxUsers	int	No
planLimits	jsonb	Yes
currentUsers	int	No
expiresAt	timestamp	Yes
deprovisionedAt	timestamp	Yes
deprovisionedBy	varchar	Yes
hardDeleteAfter	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

token_blacklist (TokenBlacklist)

Column	Type	Nullable	Notes
id	int	No	PK
token	varchar	No
userId	varchar	Yes
reason	varchar	No
expiresAt	timestamp	No
createdAt	varchar	No

users (User)

Column	Type	Nullable	Notes
id	uuid	No	PK
email	varchar	No
passwordHash	varchar	Yes
name	varchar	No
role	varchar	Yes
status	varchar	No
failedLoginAttempts	int	No
lockedUntil	timestamp	Yes
lastLoginAt	timestamp	Yes
lastLoginIp	varchar	Yes
twoFactorEnabled	boolean	No
twoFactorSecret	varchar	Yes
resetPasswordToken	varchar	Yes
resetPasswordExpires	timestamp	Yes
isVendorAccount	boolean	No
forcePasswordChange	boolean	No
inviteToken	varchar	Yes
inviteTokenExpires	timestamp	Yes
inviteStatus	varchar	No
invitedBy	varchar	Yes
invitedAt	timestamp	Yes
ssoProvider	varchar	Yes
ssoSubjectId	varchar	Yes
loginMethod	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

Relations:

• roleDefinition: ManyToOne → Role

vfp_audit_log (VfpAuditLog)

VfpAuditLog — VFP-specific audit trail Records all significant actions within the VFP module including policy changes, work package lifecycle events, exception approvals, and ticket operations. Stores

Column	Type	Nullable	Notes
id	uuid	No	PK
action	varchar	No
entityType	varchar	No
entityId	varchar	Yes
actorId	varchar	No
before	jsonb	Yes
after	jsonb	Yes
ip	varchar	Yes
timestamp	varchar	No

Operations & Integrations Tables

17 entities

Entity Relationships (Mermaid ERD)

Column Reference

api_config (ApiConfig)

Column	Type	Nullable	Notes
id	uuid	No	PK
key	varchar	No
encryptedValue	text	No
description	varchar	Yes
createdAt	varchar	No
updatedAt	varchar	No

archived_data (ArchivedData)

Column	Type	Nullable	Notes
id	int	No	PK
filename	varchar	No
startDate	date	No
endDate	date	No
status	varchar	No
sizeBytes	bigint	No
recordCount	int	No
storagePath	varchar	Yes
checksum	varchar	Yes
errorMessage	text	Yes
createdBy	varchar	Yes
createdAt	varchar	No
restoredAt	timestamp	Yes

chunk_progress (ChunkProgress)

ChunkProgress entity for tracking individual chunk downloads Enables resume capability and detailed progress monitoring

Column	Type	Nullable	Notes
id	uuid	No	PK
syncJobId	varchar	No
exportUuid	varchar	No
chunkId	int	No
chunkIndex	int	No
totalChunks	int	No
status	varchar	No
recordCount	int	No
retryCount	int	No
maxRetries	int	No
startedAt	timestamp	Yes
completedAt	timestamp	Yes
durationMs	int	Yes
errorMessage	text	Yes
lastError	text	Yes
createdAt	varchar	No
updatedAt	varchar	No

cleanup_logs (CleanupLog)

Column	Type	Nullable	Notes
id	uuid	No	PK
jobId	varchar	Yes
assetUuid	varchar	No
hostname	varchar	Yes
lastSeen	timestamp	No
reason	varchar	No
deletedVulnerabilitiesCount	int	No
deletedAt	varchar	No

date_exclusions (DateExclusion)

DateExclusion entity - stores excluded dates for dashboard calculations Enhanced with automated anomaly detection (Phase 3): - Supports both manual exclusions and auto-detected spikes - Tracks baselin

Column	Type	Nullable	Notes
date	date	No	PK
isExcluded	boolean	No
reason	varchar	Yes
excludedBy	varchar	Yes
isAutoDetected	boolean	No
baselineAvg	decimal	Yes
baselineStddev	decimal	Yes
fixedCount	int	Yes
suspectedCause	varchar	Yes
distinctPluginsAffected	int	Yes
distinctAssetsAffected	int	Yes
status	varchar	No
createdAt	timestamp	No
updatedAt	timestamp	No

export_jobs (ExportJob)

ExportJob entity for tracking async export requests Enables background generation of large exports without blocking the frontend

Column	Type	Nullable	Notes
id	uuid	No	PK
status	varchar	No
format	varchar	No
progress	int	No
totalRecords	int	Yes
processedRecords	int	Yes
filePath	varchar	Yes
downloadUrl	varchar	Yes
fileSize	bigint	Yes
expiresAt	timestamp	Yes
errorMessage	text	Yes
requestedBy	varchar	Yes
filters	simple-json	Yes
createdAt	varchar	No
updatedAt	varchar	No
completedAt	timestamp	Yes

generated_report (GeneratedReport)

GeneratedReport — A completed report instance with its data Stores the output of a report generation run. The data field contains the full report payload (stats, charts data, tables) as JSONB. Reports

Column	Type	Nullable	Notes
id	uuid	No	PK
templateId	varchar	Yes
name	varchar	No
type	varchar	No
parameters	jsonb	Yes
data	jsonb	No
format	varchar	No
status	varchar	No
generatedBy	varchar	No
createdAt	varchar	No

integration_config (IntegrationConfig)

IntegrationConfig — VFP Phase 10 External Integration Settings Stores configuration for external notification integrations (Slack, Teams, Email, PagerDuty, custom). Each integration subscribes to spec

Column	Type	Nullable	Notes
id	uuid	No	PK
type	varchar	No
name	varchar	No
config	jsonb	No
events	simple-json	No
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

os_category_rules (OsCategoryRule)

Column	Type	Nullable	Notes
id	uuid	No	PK
value	varchar	No
label	varchar	No
osPatterns	simple-array	No
familyPatterns	simple-array	Yes
sortOrder	int	No
isActive	boolean	No
createdAt	varchar	No
updatedAt	varchar	No

quarantined_data (QuarantinedData)

QuarantinedData entity for storing corrupted or invalid data Enables data integrity protection and automated recovery attempts

Column	Type	Nullable	Notes
id	uuid	No	PK
syncJobId	varchar	No
chunkId	int	Yes
quarantineReason	varchar	No
errorDetails	text	No
rawData	jsonb	Yes
assetUuid	varchar	Yes
pluginId	int	Yes
retryCount	int	No
maxRetries	int	No
status	varchar	No
resolutionNotes	text	Yes
resolvedBy	varchar	Yes
quarantinedAt	varchar	No
lastRetryAt	timestamp	Yes
resolvedAt	timestamp	Yes
updatedAt	varchar	No

report_template (ReportTemplate)

ReportTemplate — Reusable report layout definition Defines the structure and data sources for a report type. Templates can be default (system-provided) or user-created. Each template specifies section

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
type	varchar	No
description	text	Yes
sections	jsonb	No
isDefault	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

scan_target_groups (TargetGroup)

TargetGroup — reusable groups of scan targets. Static groups contain explicit IP/CIDR lists. Dynamic groups use rules (e.g. "all assets with tag=production") to auto-populate targets at scan time. Sep

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
description	text	Yes
type	varchar	No
targets	jsonb	No
dynamicRules	jsonb	Yes
createdBy	uuid	Yes
createdAt	varchar	No
updatedAt	varchar	No

scheduled_report (ScheduledReport)

ScheduledReport — Recurring report generation configuration Stores user-defined schedules for automatic report generation. The report scheduler service checks these on a timer and generates reports +

Column	Type	Nullable	Notes
id	uuid	No	PK
organizationId	varchar	Yes
createdBy	varchar	No
name	varchar	No
reportType	varchar	No
format	varchar	No
frequency	varchar	No
dayOfWeek	int	Yes
dayOfMonth	int	Yes
hour	int	No
parameters	jsonb	Yes
emailEnabled	boolean	No
emailRecipients	jsonb	Yes
enabled	boolean	No
lastRunAt	timestamp	Yes
lastRunStatus	varchar	Yes
nextRunAt	timestamp	Yes
createdAt	varchar	No
updatedAt	varchar	No

sla_escalation (SlaEscalation)

SlaEscalation — SLA tracking for individual work packages Records the SLA due date, breach status, and escalation level for each work package. Used to power SLA dashboards, breach reports, and automat

Column	Type	Nullable	Notes
id	uuid	No	PK
workPackageId	varchar	No
severity	varchar	No
dueDate	timestamp	No
breachedAt	timestamp	Yes
escalationLevel	integer	No
escalatedTo	simple-json	Yes
notifiedAt	timestamp	Yes
createdAt	varchar	No

sla_policy_config (SlaPolicyConfig)

SlaPolicyConfig — SLA policy definitions for vulnerability remediation Defines the maximum number of days allowed to remediate vulnerabilities by severity level. Only one policy can be active at a tim

Column	Type	Nullable	Notes
id	uuid	No	PK
severityCritical	integer	No
severityHigh	integer	No
severityMedium	integer	No
severityLow	integer	No
escalationRules	jsonb	Yes
isActive	boolean	No
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

webhook_config (WebhookConfig)

WebhookConfig — VFP Phase 10 Webhook Configuration Stores outbound webhook endpoints that receive event notifications when VFP actions occur (work package changes, exceptions, SLA breaches, etc.). Sup

Column	Type	Nullable	Notes
id	uuid	No	PK
name	varchar	No
url	varchar	No
secret	varchar	Yes
events	simple-json	No
isActive	boolean	No
headers	jsonb	Yes
retryCount	integer	No
lastTriggeredAt	timestamp	Yes
lastStatus	varchar	Yes
createdBy	varchar	No
createdAt	varchar	No
updatedAt	varchar	No

webhook_delivery_log (WebhookDeliveryLog)

WebhookDeliveryLog — VFP Phase 10 Webhook Delivery Tracking Records every outbound webhook delivery attempt, including the payload sent, response received, retry count, and final status. Used for debu

Column	Type	Nullable	Notes
id	uuid	No	PK
webhookId	varchar	No
event	varchar	No
payload	jsonb	No
responseStatus	integer	Yes
responseBody	text	Yes
status	varchar	No
attempts	integer	No
error	text	Yes
deliveredAt	timestamp	Yes
createdAt	varchar	No

---

Generated on 2026-04-05T09:31:31.171Z