Skip to main content

File System Access Data Collector Schema

Overview​

This is a comprehensive schema documentation for the NAA 11.6 File System Access Data Collector (FSAA). The FSAA data collector audits Windows and NFS file systems for permissions, ownership, content, activity, and sensitive-data classification. FSAA scans Windows servers, NetApp / EMC / Dell filers, and Linux/Unix hosts; normalizes the security model into a unified per-host identity space; and writes the results to the central database.

This documentation covers four collector modules that share one schema:

  • SA_FSAA_ — File System Access Analyzer: file / folder / share inventory, NTFS and share permissions, file-content statistics (sizing, types, ages), ownership, and tags.
  • SA_FSAC_ — File System Activity Collector: file-system audit events (read / add / update / delete / permission-change / rename), aggregated daily activity, permission-change details, and exception detection.
  • SA_FSDLP_ — Sensitive Data / Data Loss Prevention: detected matches against DLP criteria, with per-match excerpts and subject-profile linkage.
  • SA_FSDFS_ — DFS Namespace mapping: DFS namespaces and links, plus the mapping from DFS paths to the underlying physical shares.

Data model overview​

Every core data table is partitioned by host: each table has a HOST INT column that is a foreign key to SA_FSAA_Hosts.ID with ON DELETE CASCADE. Removing a host from SA_FSAA_Hosts therefore atomically purges every collected row for that host across all four modules (FSAA, FSAC, FSDLP, DFS).

Within a host, the canonical secondary keys are:

  • Resources — folders / files / shares — keyed by bigint ID (table SA_FSAA_Resources).
  • Trustees — security principals seen in ACLs — keyed by int ID (table SA_FSAA_Trustees).
  • Gates — entry points such as SMB shares and NFS exports — keyed by int ID (table SA_FSAA_Gates).
  • RightsProxyID — a shared dedup key on SA_FSAA_Rights so that many resources sharing identical ACLs all reference one set of permission rows.
  • GatesProxyID — analogous dedup pointer from a resource to the gates that grant access to it.
  • TagProxyID — analogous dedup pointer from a resource to its set of file tags.

Cross-module integration​

SA_FSAA_Resources carries AccessID, ActivityID, and DLPID columns that link a resource into its corresponding rows in the Activity (FSAC) and DLP (FSDLP) tables. Reports that combine permissions, activity, and sensitive-data findings — for example the Open Access and Least Privileged Access reports — join across those columns.

Table Relationship Diagrams (ERD)​

Core Data Collection Tables​

FSAA Tables​

Activity Collector Tables (SA_FSAC_*)​

Sensitive Data Tables (SA_FSDLP_*)​

DFS Namespace Tables (SA_FSDFS_*)​

Views​

FSAA Views​

Activity Views (SA_FSAC_*)​

Sensitive Data Views (SA_FSDLP_*)​

Enumeration & Lookup Values Reference​

Functions & Stored Procedures​

FSAA Functions​

Activity Collector Functions (SA_FSAC_*)​

DFS Functions (SA_FSDFS_*)​

Index Reference​

Foreign Key Reference​