Data points collected during scanning
This article provides a summary of data points that are collected during Movere scanning.
Active Directory data points
The following data points are collected during an Active Directory scan.
Devices
| Datapoint Name | Description |
|---|---|
| device_FQDN | FQDN of the device. For example: 'SQLSERVER1.IO.PRIV' |
| device_DN | The distinguished name of the device. For example: 'CN=DC1,OU=Domain Controllers,DC=io,DC=priv in Active Directory' |
| device_Domain | The Active Directory domain for the device. For example: 'IO.PRIV' |
| device_dNSHostName | Name of the device registered in DNS. For example: 'SQLSERVER1.IO.PRIV' |
| device_userAccountControl | Flags that control the behavior of each device account in Active Directory. For example: Domain Controller = 532480 |
| device_sAMAccountName | Devices samAccountName in Active Directory. For example: 'SQLSERVER1' |
| device_operatingSystem | Device operating system registered in Active Directory. For example: Windows Server 2003 |
| device_LogonCount | The number of time each device has logged into the queried domain controller. Upper limit of 65535. |
| device_lastLogon | The date/time the device last logged into the domain. |
| device_pwdLastSet | The date/time the device last changed its password in the domain. |
| device_whenCreated | The date/time the device was joined to the domain. |
| device_Description | The devices description in Active Directory. |
Domains
| Name | Description |
|---|---|
| domain_ShortName | The Active Directory domain short name. For example: 'io' |
| domain_LongName | The domain long name. For example: 'io.priv' |
| domain_DN | The domain distinguished name in Active Directory. For example: 'DC=IO,DC=PRIV' |
| domain_maxPwdAge | The maximum number of days a password to reset a password for it to remain active in the domain. |
| domain_whenCreated | The date/time the Active Directory domain was created. |
| domain_whenChanged | The date a change last occurred in the domain. For example: when the password with a trusted domain was reset. |
System Center Configuration Manager
This information is collected if the environment includes System Center Configuration Manager.
| Name | Description |
|---|---|
| SCCM_DN | The distinguished name for each Configuration Manager site server in Active Directory. For example: 'CN=SMS-MP-UL1-SCCMMGR.IO.PRIV,CN=System Management,CN=System,DC=io,DC=priv' |
| SCCM_cn | Common name of the Configuration Manager site server in Active Directory. |
| SCCM_Domain | The Active Directory domain for the Configuration Manager site server. |
| SCCM_dNSHostName | The DNS host name in Active Directory for the Configuration Manager site server. |
| SCCM_whenCreated | The date/time the the Configuration Manager site server object was created in Active Directory. |
| SCCM_mSSMSSiteCode | The site code for the Configuration Manager site server. For example: 'UL1'. |
Trust
| Name | Description |
|---|---|
| trust_DN | Trusted domain distinguished name in Active Directory. For example: 'CN=US.MOVERE.IO,CN=System,DC=MOVERE,DC=IO'. |
| trust_cn | Trusted domain common name. For example: 'CN=US.MOVERE.IO'. |
| trust_Direction | One-way or two-way direction. |
| trust_Partner | The domain that the selected domain either trustso, r is trusted by. For example: 'MOVERE.IO'. |
| trust_Type | Domain trust type. For example: Transitive. |
| trust_ShortName | Trusted domain short name. For example: 'US'. |
| trust_whenCreated | The date/time when the domain trust was created. |
| trust_whenChanged | The date/time a change last occurred to a domain trust. For example: when the trust password was reset. |
User
By default Movere collects user information. You can indicate that no user information should be collected, by specifying the -nouser command when you run a scan from the command line. Learn more.
| Name | Description |
|---|---|
| user_DN | User distinguished name. For example: 'CN=Andrew Ireland,CN=user,DC=io,DC=priv in Active Directory'. |
| user_name | User full name in Active Directory. For example: 'Andrew Ireland'. |
| user_cn | User common name in Active Directory. For example: 'Andrew Ireland'. |
| user_description | The user description in Active Directory. |
| user_displayName | The user display name in Active Directory. For example: 'Andrew Ireland'. Standard User = 512. |
| user_sAMAccountName | User logon name in Active Directory. For example: 'aireland'. |
| user_sn | User last name. For example: 'Ireland'. |
| user_mail | user email address. For example: 'aireland@movere.io'. |
| user_msExchHomeServerName | Exchange Server currently housing the user Exchange mailbox. |
| user_givenName | User first name. For example: 'Andrew'. |
| user_co | If used, specifies the user country/region. For example: 'United States'. |
| user_title | If used, represents the user job title. For example: 'Manager'. |
| user_department | If used, specifies the user department. For example: 'Finance'. |
| user_company | If used, represents the user company. For example: 'Movere'. |
| user_whenCreated | The date/time the user was added to the Active Directory domain. |
| user_accountExpires | If used, represents the date the user account will be disabled, and access prohibited to the Active Directory domain. |
| user_LogonCount | The number of times each user object has logged into the queried domain controller. Upper limit of 65535. |
| user_employeeid | If used, represents the user employee ID. |
| user_employeeNumber | If used, represents the user employee number. |
| user_employeeType | If used, represents the user employee type. For example: staff, vendor, contractor, temp, consultant etc. |
| user_lastlogon | The date/time a user last logged into Active Directory. This is a replicated timestamp that's accurate to within a week of the extraction date. |
| user_pwdlastset | The date/time the user last reset their password in the Active Directory domain. |
| user_domain | The Active Directory domain for the user. |
Window inventory scanning
The following datapoints are collected when initiating a Windows inventory scan.
CRM
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| crmuser_DataStore | Microsoft SQL Server housing the Dynamics CRM database. |
| crmuser_OrganizationName | The Dynamics CRM organization name for which the user is a member. |
| crmuser_FullName | The user's full name as it appears in Dynamics CRM. |
| crmuser_EmailAddress | The user email address as it appears in Dynamics CRM. |
| crmuser_DomainUser | The Dynamics CRM user domain login name. |
| crmuser_DomainName | The Active Directory domain that the Dynamics CRM user is a member of. |
| crmuser_CreatedOn | The date/time the Dynamics CRM user account was created. |
| crmuser_AccountDisabled | Identifies user accounts that have been disabled in Dynamics CRM. |
| crmuser_AccessLevel | Dynamics CRM user access level. For example: Administrative, Read-Only, Read-Write. |
| crmuser_CALType | Dynamics CRM CAL type. For example: Administrative, Basic, Enterprise, Professional, Essential. |
| crmversion_Version | Dynamics CRM Server version. |
| crmversion_LatestActivityDate | The date data was last written to the CRM SQL database. |
Exchange Server
The following datapoints are collected when Exchange is scanned.
| Name | Description |
|---|---|
| exchange activesync_FirstSyncTime | The first time a user's ActiveSync device synchronized with an on-premisesises Exchange Server. |
| exchange activesync_LastSuccessSync | The last time a user's ActiveSync device successfully synchronized with an on-premises Exchange Server. |
| exchange activesync_DeviceType | Type of device used to synchronize with an on-premises Exchange Server. |
| exchange activesync_DeviceID | The ID of the ActiveSync device. |
| exchange activesync_DeviceUserAgent | The ActiveSync device agent. For example: Apple-iPhone. |
| exchange activesync_DeviceModel | The ActiveSync device model. For example: iPhone. |
| exchange activesync_DeviceFriendlyName | The ActiveSync device name. For example: iPhone 6 Plus. |
| exchange activesync_DeviceOS | The ActiveSync device operating system. For example: iOS 10.2. |
| exchange activesync_Identity | The ActiveSync device Exchange identity. For example: io. priv/user/Andrew Ireland/ExchangeActiveSyncDevices/iPhone. |
| exchange activesync_DevicePolicyApplied | The Exchange ActiveSync policy applied to the ActiveSync device. |
| exchange activesync_MailboxGuid | The Exchange mailbox GUID to which the ActiveSync device connects. |
| exchange activesyncpolicy_DeviceEncryptionEnabled | ActiveSync device encryption policy setting. |
| exchange activesyncpolicy_AllowStorageCard | ActiveSync device storage card policy setting. |
| exchange activesyncpolicy_AllowCamera | ActiveSync device camera policy setting. |
| exchange activesyncpolicy_RequireDeviceEncryption | ActiveSync device encryption requirement policy setting. |
| exchange activesyncpolicy_AllowUnsignedApplications | ActiveSync device unsigned applications policy setting. |
| exchange activesyncpolicy_AllowUnsignedInstallationPackages | ActiveSync device unsigned installation packages policy setting. |
| exchange activesyncpolicy_AllowWiFi | ActiveSync device Wifi policy setting. |
| exchange activesyncpolicy_AllowTextMessaging | ActiveSync device text messaging policy setting. |
| exchange activesyncpolicy_AllowPOPIMAPEmail | ActiveSync device POP-IMAP email policy setting. |
| exchange activesyncpolicy_AllowIrDA | ActiveSync device IrDA policy setting. |
| exchange activesyncpolicy_RequireManualSyncWhenRoaming | ActiveSync device roaming sync policy setting. |
| exchange activesyncpolicy_AllowDesktopSync | ActiveSync device desktop sync policy setting. |
| exchange activesyncpolicy_AllowBrowser | ActiveSync device browser policy setting. |
| exchange activesyncpolicy_AllowConsumerEmail | ActiveSync device consumer email policy setting. |
| exchange activesyncpolicy_AllowRemoteDesktop | ActiveSync device remote desktop policy setting. |
| exchange activesyncpolicy_AllowInternetSharing | ActiveSync device Internet sharing policy setting. |
| exchange activesyncpolicy_AllowBluetooth | ActiveSync device Bluetooth policy setting. |
| exchange activesyncpolicy_Identity | ActiveSync policy ID. |
| exchange activesyncpolicy_Guid | ActiveSync policy GUID. |
| exchange activesyncpolicy_WhenChanged | When the ActiveSync policy was last changed. |
| exchange activesyncpolicy_WhenCreated | When the ActiveSync policy was created. |
| exchange activesyncpolicy_Name | ActiveSync policy name. |
| exchange activesyncpolicy_IsValid | ActiveSync policy validity. |
| exchange activesyncpolicy_IsDefault | ActiveSync policy priority. |
| exchange activesyncpolicy_IsDefaultPolicy | ActiveSync policy global priority. |
| ExchangeCluster_Name | Exchange cluster name. |
| ExchangeCluster_Servers | Exchange cluster members. |
| ExchangeCluster_WitnessServer | Exchange cluster witness server. |
| ExchangeCluster_Identity | Exchange cluster name. |
| ExchangeCluster_WhenCreated | The date that the Exchange cluster was created. |
| ExchangeDlpPolicy_Name | Exchange Data Loss Prevention (DLP) policy name. |
| ExchangeDlpPolicy_State | Exchange Data Loss Prevention (DLP) policy state. For example: Enabled |
| ExchangeDlpPolicy_Mode | Exchange Data Loss Prevention (DLP) policy mode. For example: Audit |
| ExchangeDlpPolicy_Description | Exchange Data Loss Prevention (DLP) policy description. |
| ExchangeDlpPolicy_IsValid | Exchange Data Loss Prevention (DLP) policy validity. |
| ExchangeDlpPolicy_WhenChanged | Exchange Data Loss Prevention (DLP) policy last changed date. |
| ExchangeServer_Name | Exchange Server name. |
| ExchangeServer_Domain | The Active Directory domain in which the Exchange Server resides. |
| ExchangeServer_Edition | Exchange Server edition. |
| ExchangeServer_Fqdn | Exchange Server FQDN. |
| ExchangeServer_IsHubTransportServer | Whether the Exchange Server is a hub transport server. |
| ExchangeServer_IsClientAccessServer | Whether the Exchange Server is a client access server. |
| ExchangeServer_IsEdgeServer | Whether the Exchange Server is an edge server. |
| ExchangeServer_IsMailboxServer | Whether the Exchange Server is a mailbox server. |
| ExchangeServer_IsUnifiedMessagingServer | Whether the Exchange Server is a unified messaging server. |
| ExchangeServer_Identity | The Exchange Server NetBIOS name. |
| ExchangeServer_IsValid | The Exchange Server validity. |
| ExchangeServer_AdminDisplayVersion | The Exchange Server admin console version. |
| ExchangeServer_WhenCreated | When the Exchange Server was created. |
| ExchangeServer_IsExchangeTrialEdition | Whether the Exchange Server is a trial installation. |
| ExchangeServer_IsExpiredExchangeTrialEdition | Whether the Exchange Server trial period expired. |
| ExchangeServer_RemainingTrialPeriod | Number of remaining days left in the Exchange Server trial. |
| ExchangeJournalRule_Recipient | Exchange journal recipient. |
| ExchangeJournalRule_Scope | Exchange journal scope. |
| ExchangeJournalRule_Enabled | Exchange journal rule enabled. |
| ExchangeJournalRule_Name | Exchange journal rule name. |
| ExchangeJournalRule_IsValid | Exchange journal rules validity. |
| ExchangeJournalRule_WhenChanged | Exchange journal rules last change date. |
| ExchangeMBSearch_Name | The name of the mailbox search policy name. |
| ExchangeMBSearch_CreatedBy | User account used to create the mailbox search policy. |
| ExchangeMBSearch_sourcemailboxes | Whether the mailbox is searched to place items on hold. |
| ExchangeMBSearch_Status | Search status. For example: not started. |
| ExchangeMBSearch_ItemHoldPeriod | The period of time search items remain on hold. |
| ExchangeMBSearch_LastModifiedTime | The last time the search policy was changed. |
| ExchangeMBSearch_IsValid | Whether the search policy is valid. |
| ExchangeMBSearch_InPlaceHoldEnabled | Whether in-place hold policy is enabled. |
| ExchangeMBSearch_InPlaceHoldIdentity | The unique ID for the in-place hold policy. |
| ExchangeMBStatistics_DeletedItemCount | The number of deleted items in the mailbox account. |
| ExchangeMBStatistics_ItemCount | The number of items in the mailbox account. |
| ExchangeMBStatistics_LastLogonTime | The last logon to the mailbox. |
| ExchangeMBStatistics_MailboxGuid | The mailbox GUID. |
| ExchangeMBStatistics_StorageLimitStatus | The mailbox storage limit status. |
| ExchangeMBStatistics_TotalDeletedItemSize | The size of the deleted items in the mailbox account. |
| ExchangeMBStatistics_TotalItemSize | The size of the items in the mailbox account. |
| ExchangeMBStatistics_IsValid | Whether the mailbox is valid. |
| ExchangeRetentionPolicy_Name | The retention policy name. |
| ExchangeRetentionPolicy_Identity | The retention policy unique ID. |
| ExchangeRetentionPolicy_WhenChanged | When the retention policy was last changed. |
| ExchangeRetentionPolicy_WhenCreated | When the retention policy was created. |
| ExchangeRetentionPolicy_IsValid | Whether the retention policy is valid. |
| ExchangeRetentionPolicy_RetentionPolicyTagLinks | Retention policy tags. For example: Never Delete |
| ExchangeRetentionTags_MessageClassDisplayName | Message class name. For example: All Mailbox Content |
| ExchangeRetentionTags_RetentionEnabled | Whether the retention policy is enabled. |
| ExchangeRetentionTags_RetentionAction | Retention action setting. For example: DeleteAndAllowRecovery |
| ExchangeRetentionTags_AgeLimitForRetention | Age limit for retention. For example: 30 days |
| ExchangeRetentionTags_TriggerForRetention | Trigger for retention. For example: WhenDelivered |
| ExchangeRetentionTags_JournalingEnabled | Whether journaling is enabled. |
| ExchangeRetentionTags_RTType | Retention type. For example: Personal |
| ExchangeRetentionTags_Comment | Comments applied to the retention tag. |
| ExchangeRetentionTags_Name | Retention tag name. For example: One Month Delete |
| ExchangeRetentionTags_Identity | Retention tag identity. For example: One Month Delete |
| ExchangeRetentionTags_WhenChanged | When the retention tag was last changed. |
| ExchangeRetentionTags_WhenCreated | When the retention tag was created. |
| ExchangeRetentionTags_IsValid | Whether the retention tag is valid. |
| ExchangeVersion_Version | Exchange Server version. |
| ExchangeVersion_LatestActivityDate | The last time activity occurred on the Exchange server. |
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| ExchangeMailbox_Database | Exchange Server database name. |
| ExchangeMailbox_ExchangeGuid | Exchange mailbox GUID. |
| ExchangeMailbox_ExchangeUserAccountControl | Exchange mailbox User Account Control value. |
| ExchangeMailbox_ForwardingAddress | Forwarding address(es) assigned to the mailbox. |
| ExchangeMailbox_IsMailboxEnabled | Whether the mailbox is enabled. |
| ExchangeMailbox_IsResource | Whether it's a resource mailbox. |
| ExchangeMailbox_IsLinked | Whether it's a linked mailbox. |
| ExchangeMailbox_IsShared | Whether it's a shared mailbox. |
| ExchangeMailbox_SamAccountName | user logon name. |
| ExchangeMailbox_ServerName | The Exchange Server on which the mailbox resides. |
| ExchangeMailbox_UMEnabled | Whether the mailbox is enabled for Unified Messaging. |
| ExchangeMailbox_HiddenFromAddressListsEnabled | Whether the mailbox is hidden from the address list. |
| ExchangeMailbox_MaxSendSize | Maximum size email that can be sent from the mailbox. |
| ExchangeMailbox_MaxReceiveSize | Maximum size email that can be received from the mailbox. |
| ExchangeMailbox_ExchangeVersion | Version of the Exchange Server on which the mailbox resides. |
| ExchangeMailbox_RecipientType | Mailbox recipient type. For example: user mailbox. |
| ExchangeMailbox_RecipientTypeDetails | Mailbox recipient type details. |
| ExchangeMailbox_WindowsEmailAddress | The mailbox email address. |
| ExchangeMailbox_Identity | The mailbox identity. For example: io.priv/user/Andrew Ireland |
| ExchangeMailbox_Guid | The Exchange mailbox GUID. |
| ExchangeMailbox_WhenCreated | The date the mailbox was created. |
| ExchangeMailbox_IsValid | Whether the mailbox is valid. |
| ExchangeMailbox_ArchiveDatabase | The mailbox archive database. |
| ExchangeMailbox_ArchiveName | The mailbox archive name. |
| ExchangeMailbox_ArchiveStatus | The mailbox archive status. |
| ExchangeMailbox_RetentionPolicy | Retention policy applied to the mailbox. |
| ExchangeMailbox_InPlaceHolds | In place holds applied to the mailbox. |
| CASMailbox_PrimarySmtpAddress | User's primary SMTP email address. |
| CASMailbox_SamAccountName | User logon name. |
| CASMailbox_ServerName | Exchange Server currently housing the user Exchange mailbox. |
| CASMailbox_DisplayName | The user display name. For example: Andrew Ireland |
| CASMailbox_ActiveSyncMailboxPolicy | Exchange ActiveSync policy applied to the mailbox. |
| CASMailbox_ActiveSyncMailboxPolicyIsDefaulted | Exchange ActiveSync default policy applied to the mailbox. |
| CASMailbox_ActiveSyncEnabled | Exchange ActiveSync enabled on the mailbox. |
| CASMailbox_HasActiveSyncDevicePartnership | An ActiveSync relationship to the mailbox exists. |
| CASMailbox_OWAEnabled | The mailbox is enabled for Outlook Web Access. |
| CASMailbox_Identity | The mailbox identity. For example: io.priv/user/Andrew Ireland |
| CASMailbox_IsValid | The mailbox validity. |
| CASMailbox_Guid | The Exchange mailbox GUID. |
| CASMailbox_WhenCreated | The date the mailbox was created. |
Lync/Skype for Business
| Name | Description |
|---|---|
| LyncArchive_Description | Lync/Skype archive policy description. |
| LyncArchive_ArchiveInternal | Whether the archive is internal. For example: TRUE |
| LyncArchive_ArchiveExternal | Whether the archive is external. For example: FALSE |
| LyncArchive_ScopeClass | The archive scope. For example: GLOBAL |
| LyncArchive_Identity | The archive identity. For example: GLOBAL |
| LyncConf_AllowIPAudio | Lync/Skype conference policy: Allow IP audio |
| LyncConf_AllowIPVideo | Lync/Skype conference policy: Allow IP video |
| LyncConf_Description | Lync/Skype conference policy description. |
| LyncConf_AllowParticipantControl | Lync/Skype conference policy: Allow participant control |
| LyncConf_AllowAnnotations | Lync/Skype conference policy: Allow annotations |
| LyncConf_DisablePowerPointAnnotations | Lync/Skype conference policy: Disable PowerPoint annotations |
| LyncConf_AllowUserToScheduleMeetingsWithAppSharing | Lync/Skype conference policy: Allow user to schedule meetings with application sharing |
| LyncConf_AllowAnonymoususerToDialOut | Lync/Skype conference policy: Allow anonymous user to dial out |
| LyncConf_AllowAnonymousParticipantsInMeetings | Lync/Skype conference policy: Allow anonymous participants in meetings |
| LyncConf_AllowExternaluserToSaveContent | Lync/Skype conference policy: Allow external user to save content |
| LyncConf_AllowExternalUserControl | Lync/Skype conference policy: Allow external user control |
| LyncConf_AllowExternaluserToRecordMeeting | Lync/Skype conference policy: Allow external user to record meeting |
| LyncConf_AllowPolls | Lync/Skype conference policy: Allow polls |
| LyncConf_EnableDialInConferencing | Lync/Skype conference policy: Enable dial in conferencing |
| LyncConf_EnableAppDesktopSharing | Lync/Skype conference policy: Enable application desktop sharing |
| LyncConf_AllowConferenceRecording | Lync/Skype conference policy: Allow conference recording |
| LyncConf_EnableP2PRecording | Lync/Skype conference policy: Enable peer-to-peer recording |
| LyncConf_EnableFileTransfer | Lync/Skype conference policy: Enable file transfer |
| LyncConf_EnableP2PFileTransfer | Lync/Skype conference policy: Enable peer-to-peer file transfer |
| LyncConf_EnableP2PVideo | Lync/Skype conference policy: Enable peer-to-peer video |
| LyncConf_EnableDataCollaboration | Lync/Skype conference policy: Enable data collaboration |
| LyncConf_MaxVideoConferenceResolution | Lync/Skype conference policy: Maximum video conference resolution |
| LyncConf_MaxMeetingSize | Lync/Skype conference policy: Maximum meeting size |
| LyncConf_AudioBitRateKb | Lync/Skype conference policy: Audio bit rate in kilobits |
| LyncConf_VideoBitRateKb | Lync/Skype conference policy: Video bit rate in kilobits |
| LyncConf_AppSharingBitRateKb | Lync/Skype conference policy: Application sharing bit rate in kilobits |
| LyncConf_FileTransferBitRateKb | Lync/Skype conference policy: File transfer bit rate in kilobits |
| LyncConf_ScopeClass | Lync/Skype conference policy scope class. For example: Global |
| LyncConf_Identity | Lync/Skype conference policy: Identity. For example: Global |
| LyncExternal_Description | Lync/Skype external policy description |
| LyncExternal_EnableFederationAccess | Lync/Skype external policy: Enable federation access |
| LyncExternal_EnablePublicCloudAccess | Lync/Skype external policy: Enable public cloud access |
| LyncExternal_EnablePublicCloudAudioVideoAccess | Lync/Skype external policy: Enable public cloud audio video access |
| LyncExternal_EnableOutsideAccess | Lync/Skype external policy: Enable outside access |
| LyncExternal_ScopeClass | Lync/Skype external policy scope class. For example: Global |
| LyncExternal_Identity | Lync/Skype external policy: Identity. For example: Global |
| LyncMobility_Description | Lync/Skype mobility policy description |
| LyncMobility_EnableOutsideVoice | Lync/Skype mobility policy: Enable outside voice |
| LyncMobility_EnableMobility | Lync/Skype mobility policy: Enable mobility |
| LyncMobility_ScopeClass | Lync/Skype mobility policy scope class. For example: Global |
| LyncMobility_Identity | Lync/Skype mobility policy: Identity. For example: Global |
| LyncServer_Site | Lync/Skype site name |
| LyncServer_FQDN | Lync/Skype server fully qualified domain name |
| LyncServer_Identity | Lync/Skype server device name |
| LyncServer_Services | Lync/Skype server service(s). For example: Central Management Database |
| LyncServer_Computers | Lync/Skype site servers |
| LyncVersion_Version | Lync/Skype Server version |
| LyncVersion_LatestActivityDate | The last time activity occurred on the Lync/Skype server |
| LyncVoice_Identity | Lync/Skype voice policy: Identity. For example: Global |
| LyncVoice_Description | Lync/Skype voice policy description |
| LyncVoice_AllowSimulRing | Lync/Skype voice policy: Allow simultaneous ring |
| LyncVoice_AllowCallForwarding | Lync/Skype voice policy: Allow all forwarding |
| LyncVoice_AllowPSTNReRouting | Lync/Skype voice policy: Allow PSTN re-routing |
| LyncVoice_Name | Lync/Skype voice policy name |
| LyncVoice_DefaultPolicy | Lync/Skype voice policy: Is this the default policy? |
| LyncVoice_EnableDelegation | Lync/Skype voice policy: Enable delegation |
| LyncVoice_EnableTeamCall | Lync/Skype voice policy: Enable team all |
| LyncVoice_EnableCallTransfer | Lync/Skype voice policy: Enable call transfer |
| LyncVoice_EnableCallPark | Lync/Skype voice policy: Enable call park |
| LyncVoice_EnableMaliciousCallTracing | Lync/Skype voice policy: Enable malicious call tracing |
| LyncVoice_EnableBWPolicyOverride | Lync/Skype voice policy: Enable bandwidth policy override |
| LyncVoice_PreventPSTNTollBypass | Lync/Skype voice policy: Prevent PSTN toll bypass |
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| LyncUser_SamAccountName | Lync/Skype user: samAccountName in Active Directory |
| LyncUser_UserPrincipalName | Lync/Skype user email address |
| LyncUser_AudioVideoDisabled | Lync/Skype user: Audio video disabled |
| LyncUser_IPPBXSoftPhoneRoutingEnabled | Lync/Skype user: IP PBX soft phone routing enabled |
| LyncUser_RemoteCallControlTelephonyEnabled | Lync/Skype user: Remote call control telephony enabled |
| LyncUser_HostedVoiceMail | Lync/Skype user: Hosted voicemail |
| LyncUser_EnabledForFederation | Lync/Skype user: Enabled for federation |
| LyncUser_EnabledForInternetAccess | Lync/Skype user: Enabled for Internet access |
| LyncUser_PublicNetworkEnabled | Lync/Skype user: Public network enabled |
| LyncUser_EnterpriseVoiceEnabled | Lync/Skype user: Enterprise voice enabled |
| LyncUser_EnabledForRichPresence | Lync/Skype user: Enabled for rich presence |
| LyncUser_SipAddress | Lync/Skype user: Sip address |
| LyncUser_Enabled | Lync/Skype user: State |
| LyncUser_TargetRegistrarPool | Lync/Skype user: Target registrar pool |
| LyncUser_VoicePolicy | Lync/Skype user: Voice policy assigned |
| LyncUser_MobilityPolicy | Lync/Skype user: Mobility policy assigned |
| LyncUser_ConferencingPolicy | Lync/Skype user: Conferencing policy assigned |
| LyncUser_RegistrarPool | Lync/Skype user: Registrar pool |
| LyncUser_ArchivingPolicy | Lync/Skype user: Archiving policy assigned |
| LyncUser_ExternalAccessPolicy | Lync/Skype user: External access policy assigned |
| LyncUser_Guid | Lync/Skype user: GUID |
| LyncUser_WhenCreated | Lync/Skype user: When created |
| LyncUser_IsValid | Lync/Skype user: Is the account valid? |
| LyncUserLastLogon_Guid | Lync/Skype user: GUID |
| LyncUserLastLogon_LastNewRegisterTime | Lync/Skype user: Last logon timestamp |
SharePoint Server information
| Name | Description |
|---|---|
| SharePointFarm_ConfigD | SQL Server in which SharePoint farm data is stored. |
| SharePointFarm_MaxOSVersion | The highest operating system version on which the SharePoint farm runs on. For example: 2012 |
| SharePointFarm_MaxSPVersion | The highest SharePoint version in the SharePoint farm. For example: 2016 |
| SharePointFarm_MaxSPEdition | The highest SharePoint edition in the SharePoint farm. For example: Enterprise |
| SharePointFarmPS_ConfigDB | SQL Server in which Project Server data is stored. |
| SharePointFarmPS_MaxOSVersion | The highest operating system version on which the Project Server runs. For example: 2012 |
| SharePointFarmPS_MaxSPVersion | The highest SharePoint version on which the Project Server runs. For example: 2016 |
| SharePointFarmPS_MaxSPEdition | The SharePoint edition on which the Project Server is running. For example: Enterprise Project Server only runs on SharePoint Enterprise |
| SharePointFeatures_SiteId | The SharePoint site Site ID. |
| SharePointFeatures_WebId | The SharePoint site Web ID. |
| SharePointFeatures_FeatureId | Are SharePoint Enterprise features enabled? |
| SharePointFeatures_TimeActivated | The date SharePoint Enterprise features were enabled on the site. |
| SharePointSites_WebId | The SharePoint sites web ID. |
| SharePointSites_SiteId | The SharePoint sites site ID. |
| SharePointSites_ParentId | The SharePoint sites parent ID. |
| SharePointSites_Edition | Are SharePoint Enterprise features enabled? |
| SharePointSites_Members | Does the SharePoint site has its own members list? |
| SharePointSites_FullURL | The full URL address for the SharePoint site. For example: http://sharepoint/sites/IO |
| SharePointSites_WebTitle | The SharePoint site display name. For example: IO SharePoint |
| SharePointSites_TimeCreated | The date that the SharePoint site was created. |
| SharePointSites_RequestAccessEmail | The user email contact to request access to the SharePoint site. |
| SharePointSites_bEntByParenting | Is there an Enterprise feature enabled child site utilizing this sites membership list? |
| SharePointSiteVersions_SiteId | The SharePoint Server Site ID. |
| SharePointSiteVersions_VersionId | The SharePoint Server version ID. |
| SharePointSiteVersions_Version | The SharePoint Server version. For example: 15.0.2.0 |
| SharePointSiteVersions_MOSS/WSS | The SharePoint Server feature set i.e. full install versus foundation only |
| SharePointVersion_Version | The SharePoint Server version. For example: 16.0.6.0 |
| SharePointVersion_LatestActivityDate | The date of the last activity in the SharePoint Servers SQL configuration database. |
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| SharePointUserList_tp_SiteId | The SharePoint site Site ID. |
| SharePointUserList_tp_Id | The SharePoint user site specific ID. |
| SharePointUserList_tp_Login | The SharePoint user login name. |
| SharePointUserList_tp_Type | The SharePoint user connection type. |
| SharePointUserList_tp_Domain | The SharePoint user domain. |
| SharePointUserList_tp_Title | The SharePoint user display name. |
| SharePointUserList_Last_Accessed | The date the user last accessed the SharePoint site. |
| SharePointMembers_WebId | The SharePoint sites Web ID. |
| SharePointMembers_UserId | The SharePoint user site specific ID. |
| SharePointMembers_SiteId | The SharePoint site Site ID. |
| SharePointMembers_tp_Login | The SharePoint user login name. |
| SharePointMembers_tp_Type | he SharePoint user connection type. |
| SharePointMembers_tp_Domain | The domain of the SharePoint user. |
| SharePointMembers_tp_Title | The SharePoint user display name. |
Software Asset Management (SAM)
| Name | Description |
|---|---|
| SAMWinHotFix_Caption | Windows hotfix title. For example: KB3200970 |
| SAMWinHotFix_Description | Web link to the Windows hotfix. For example: https://support.microsoft.com/?kbid=3200970 |
| SAMWinHotFix_HotFix ID | Windows hotfix type. For example: Security Update |
| SAMWinFeatures_ID | Windows feature identifier. |
| SAMWinFeatures_Parent ID | Windows feature parent identifier. |
| SAMWinFeatures_Caption | Windows feature title. For example: IIS Management Console |
| SAMWinProcess_Process Name | Windows process name. For example: CcmExec |
| SAMWinProcess_File Path | Windows process path. For example: C:\Windows\CCM\CcmExec.exe |
| SAMWinProcess_Product Name | Windows product name. For example: System Center Configuration Manager |
| SAMWinProcess_Product Version | Windows product version. For example: 5.00.8412.1000 |
| SAMWinProcess_Company Name | Products publisher. For example: Microsoft Corporation |
| SAMWinProcess_File Description | Processes description. For example: Host Process for Microsoft Configuration Manager |
| SAMWinProcess_Legal Copyright | Copyright details. For example: Copyright (C) Microsoft Corporation. All rights reserved. |
| SAMWinProcess_Legal Trademarks | Trademarks. For example: SAMWinProcess_Comments - Process comments. For example: Citrix XenServer Windows Guest Agent |
| SAMIISSites_Site Name | IIS site name. For example: Movere.Qlik.Api |
| SAMIISSites_Bindings | Bindings details. For example: [https] *:443: |
| SAMIISSites_Auto Start | Auto start enabled. |
| SAMIISSites_State | Site state. For example: Started |
| SAMIISSites_App Path | IIS app path. For example: /SMS_MP |
| SAMIISSites_App Pool Name | IIS app pool name. For example: SMS Management Point Pool |
| SAMIISSites_App Virtual Path | IIS app virtual path. For example: /_wpresources |
| SAMIISSites_App Physical Path | IIS app physical path. For example: C:\Program Files\SMS_CCM\SMS_MP |
| SAMIISSites_Web Config Found | IIS app configuration found. SAMIISAppPools_App Pool Name - IIS app pool name. For example: MSExchangeMapiMailboxAppPool |
| SAMIISAppPools_Managed Runtime Version | Version. For example: v4.0 |
| SAMIISAppPools_Managed Pipeline Mode | Pipeline mode. For example: Integrated |
| SAMIISAppPools_State | IIS app pool state. For example: Started |
| SAMIISAppPools_Enable 32 Bit | Is 32 bit enabled. |
| SAMIISAppPools_Identity | App pool identity. For example: LocalSystem |
| SAMIISAppPools_Worker Process IDs | Process identifier. |
| SAMDotNetComponents_File Path | Component file path. For example: C:\Program Files\Microsoft SQL Server\120\DTS\Binn |
| SAMDotNetComponents_File Name | Component file name. For example: ISServerExec.exe |
| SAMDotNetComponents_File Version | Component file version. For example: 12.0.2000.8 ((SQL14_RTM).140220-1752) |
| SAMDotNetComponents_Product Name | Product that component is part of. For example: Microsoft SQL Server |
| SAMDotNetComponents_Product Version | Product version. For example: 12.0.2000.8 |
| SAMDotNetComponents_Copyright | Copyright details. For example: Microsoft Corp. All rights reserved. |
| SAMDotNetComponents_Company | Products publisher. For example: Microsoft Corporation |
| SAMDotNetComponents_Description | Component description. For example: SSIS Execution Process |
| SAMDotNetComponents_Date Modified | Date modified. |
| SAMDotNetConfigFiles_File Path | Component configuration file path. For example: C:\Program Files\Microsoft SQL Server\120\DTS\Binn |
| SAMDotNetConfigFiles_File Name | Component configuration file name. For example: MsDtsSrvr.exe.config |
| SAMDotNetConfigFiles_App Setings Key Count | Key Count |
| SAMDotNetConfigFiles_App Settings Secrets Found | Secrets Found |
| SAMDotNetConfigFiles_App Settings Key Names | Key Names |
| SAMDotNetConfigFiles_Dot Net Version | .Net version. For example: 4.6.2 |
| SAMDotNetConnectionStrings_File Path | .Net connection string. For example: C:\Program Files\SMS_CCM\EnrollmentPoint |
| SAMDotNetConnectionStrings_Connection String Name | .Net connection string name. For example: Default |
| SAMDotNetConnectionStrings_Server Name | Connection server. For example: SCCMSQL.io.priv |
| SAMDotNetConnectionStrings_Database Name | Database name. For example: CM_UL1 |
| SAMDotNetConnectionStrings_Provider Name | Provider name. For example: System.Data.SqlClient |
| SAMDotNetConnectionStrings_Is Secure | Connection is secure |
| SAMDatabase_DataSource | The frontend Windows Server a SQL Server DSN record was found on |
| SAMDatabase_DBServer | The SQL Server the DSN record is pointing to |
| SAMDatabase_DBName | The database housing the technology the DSN record is pointing to |
| SAMDatabase_DBType | The technology the DSN record relates to. For example: SCCM |
| SAMDatabase_Version | The version of technology the DSN SAMGeo_City - The name of the city the ISP provider returned for the device |
| SAMGeo_Country | The name of the country the ISP provider returned for the device |
| SAMGeo_CountryCode | The country code the ISP provider returned for the device |
| SAMGeo_Latitude | The latitude the ISP provider returned for the device |
| SAMGeo_Longitude | The longitude the ISP provider returned for the device |
| SAMHDD_PhysicalDrive | The devices physical storage drive type. For example: SCSI Disk Device |
| SAMHDD_LogicalDriveLetter | The devices logical drive letter |
| SAMHDD_LogicalDriveName | The devices logical drive name |
| SAMHDD_FileSystem | The devices storage file system. For example: NTFS |
| SAMHDD_TotalSize | The total size of the devices drive |
| SAMHDD_FreeSize | The remaining space on the devices drive |
| SAMMSAppsFound_MSAppType | Microsoft product(s) installed on the device |
| SAMMSAppsFound_Edition | The edition of the Microsoft product(s) installed |
| SAMMSAppsFound_ProductVer | The version of the Microsoft product(s) installed |
| SAMNetwork_MACAddress | The MAC address for each network card installed in the device |
| SAMNetwork_IPAddress | The IP address for each network card installed in the device |
| SAMNetwork_SubnetMask | The subnet mask for each network card installed in the device |
| SAMOSActivation_ActivationString | How and if the devices Windows operating system was activated |
| SAMServices_Name | The name of the services (and processes) installed on Windows Server and (Linux) devices |
| SAMServices_State | The state of each service when scanned |
| SAMServices_CreationDate | The date each service was created on the device |
| SAMServices_SvcPath | The services install path |
| SAMSoftware_RegistryKey | The installed product's registry key |
| SAMSoftware_InstallDate | The installed product's installation date |
| SAMSoftware_Version | The installed product's version |
| SAMSoftware_Publisher | The installed product's publisher |
| SAMSoftware_DisplayName | The installed products display name |
| SAMSoftware_LastRunDate | The date the installed product was last run |
| SAMSQLAG_Instance | The SQL Server instance name |
| SAMSQLAG_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQLAG_Database | The SQL database the availability group setting applies toSAMSQLAG_SyncState - The database's synchronization state. For example: SYNCHRONIZED |
| SAMSQLAG_AvailabilityGroup | The SQL availably group name |
| SAMSQLAG_PrimaryReplica | The primary replica of the SQL database |
| SAMSQLAG_PrimaryRecoveryHealth | The state of the primary replica. For example: ONLINE |
| SAMSQLAG_Role | The SQL Servers role in the availability group. For example: PRIMARY |
| SAMSQLAG_SyncHealth | The availably groups synchronization health. For example: HEALTHY |
| SAMSQLAG_PrimaryAllowConn | Does the primary replica allow connections. For example: YES |
| SAMSQLAG_SecondaryAllowConn | Do the secondary replicas all connections. For example: READ_ONLY |
| SAMSQL-Alias_Alias | The SQL Servers alias if one has been specified |
| SAMSQL-Alias_Actual | The SQL Servers FQDN and the port number SQL is using. For example: SCCMSQL.IO.PRIV,1433 |
| SAMSQL-BIFeatures_Instance | The SQL Server instance name |
| SAMSQL-BIFeatures_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-BIFeatures_Version | The full SQL Server version. For example: 11.3.6020.0 |
| SAMSQL-BIFeatures_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQL-BIFeatures_Features | The SQL business intelligence features installed in the instance. For example: Analysis_Server_Full=3 |
| SAMSQL-BIFeatures_Component | The SQL business intelligence component installed in the instance. For example: AS |
| SAMSQL-CPU_Instance | The SQL Server instance name |
| SAMSQL-CPU_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-CPU_LogicalCPUs | The number of logical CPUs visible to the SQL Server |
| SAMSQL-CPU_HTRatio | The hyper threading ratio. For example: 1 |
| SAMSQL-CPU_SQLCPU | The number of CPUs visible to the SQL Server |
| SAMSQL-DB_Instance | The SQL Server instance name |
| SAMSQL-DB_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-DB_Database | The SQL database name |
| SAMSQLServerDatabases_SystemDB | Is the SQL database a system database |
| SAMSQL-DB_State | The SQL database state. For example: ONLINE |
| SAMSQL-DB_Date | The date the SQL database was created |
| SAMSQL-DB_DbSize | The SQL database data size |
| SAMSQL-DB_LogSize | The SQL database log size |
| SQLDBsReceived_Database | The name of the SQL database queried by Movere. For example: vCenter |
| SQLDBsReceived_LatestActivityDate | The date of the last activity to occur in the SQL database |
| SAMSQL-Hist_Instance | The SQL Server instance name |
| SAMSQL-Hist_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-Hist_AvgReads | The total number of reads performed since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_AvgWrites | The total number of writes performed since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_AvgConnections | The total number of connections to the SQL Server since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_UptimeDays | The number of days since the SQL Server was last rebooted |
| SAMSQL-LS_Instance | The SQL Server instance name |
| SAMSQL-LS_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-LS_PrimaryServer | The primary SQL Server in the log shipping configuration |
| SAMSQL-LS_PrimaryDatabase | The primary database in the log shipping configuration |
| SAMSQL-LS_SecondaryServer | The secondary SQL Server in the log shipping configuration |
| SAMSQL-LS_SecondaryDatabase | The secondary database in the log shipping configuration |
| SAMSQL-MR_Instance | The SQL Server instance name |
| SAMSQL-MR_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-MR_Database | The SQL database being mirrored |
| SAMSQL-MR_State | The state of the synchronization. For example: SYNCHRONIZED |
| SAMSQL-MR_Role | The SQL Servers role in a mirrored configuration. For example: PRINCIPAL |
| SAMSQL-MR_Partner | The SQL Servers partner in the mirrored configuration |
| SAMSQL-MR_Witness | The SQL Server witness in the mirrored configuration |
| SAMSQLServerInstances_Instance | The SQL Server instance name |
| SAMSQLServerInstances_Port | The port number the SQL instance is using. For example: 1433 |
| SAMSQLServerInstances_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQLServerInstances_AllNodes | If clustered, the SQL nodes in the cluster |
| SAMSQLServerInstances_ActiveNode | If clustered, the active SQL node in the cluster |
| SAMSQLServerInstances_Version | The SQL Server instance version. For example: 2016 |
| SAMSQLServerInstances_FullVersion | The SQL Server instance full version. For example: 13.0.1601.5 |
| SAMSQLServerInstances_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQLServerInstances_DBCount | The number of databases in the SQL instance |
| SAMSQLServerInstances_LogShipping | In the SQL instance participating in a log shipping configuration |
| SAMSQLServerInstances_Mirroring | In the SQL instance participating in a mirroring configuration |
| SAMSQLServerInstances_AVGroup | In the SQL instance participating in a SQL availability group configuration |
| SAMSQLServerServices_Instance | The SQL service instance name |
| SAMSQLServerServices_Type | The SQL service type. For example: Reporting Service |
| SAMSQLServerServices_State | The SQL service state. For example: Running |
| SAMSQLServerServices_CreationDate | The date the SQL service was created on the device |
| SAMSQLServerServices_Path | The path the SQL service was created in |
| SAMSQL-Ver_Instance | The SQL Server instance name |
| SAMSQL-Ver_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-Ver_Version | The full SQL Server version. For example: 11.3.6020.0 |
| SAMSQL-Ver_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQL-Ver_Port | The port number the SQL instance is using. For example: 1433 |
| SAMSQL-Ver_ActiveNode | If clustered, the active SQL node in the cluster |
| SAMSQL-Ver_AllNodes | If clustered, the SQL nodes in the cluster |
| SAMSystem_FQDN | The devices fully qualified domain name |
| SAMSystem_OS | The devices operating system |
| SAMSystem_NetBIOS | The devices NetBIOS name |
| SAMSystem_PID | The devices operating system product ID |
| SAMSystem_OSActivationMethod | How and if the devices Windows operating system was activated |
| SAMSystem_SerialNo | The devices serial number |
| SAMSystem_UUID | The devices Universally Unique Identifier |
| SAMSystem_RegOrg | The organization the device is registered to |
| SAMSystem_Make | The devices make. For example: Hewlett-Packard |
| SAMSystem_Model | The devices model. For example: HP Pavilion dv5 |
| SAMSystem_Domain | he Active Directory domain the device resides in |
| SAMSystem_TotalRAM | The total amount of RAM installed in the device |
| SAMSystem_AvailableRAM | The amount of unused RAM installed in the device when it was last inventoried |
| SAMSystem_CPUModel | The devices CPU model. For example: Intel Core2 Duo T9400 @ 2.53GHz |
| SAMSystem_CPUCount | The number of processors installed in the device |
| SAMSystem_CPUCores | The number of cores installed in the device |
| SAMSystem_Is 64 Bit | Systems processor architecture |
| SAMSystem_Service Pack | Windows service pack installed on the system (if applicable) |
| SAMSystem_Boot Time | Last time the Windows system was started |
| SAMSystem_ScanDate | The date the device was last inventoried |
| SAMSystem_SWLines | The number of software title entries retrieved from the device when last inventoried |
| SAMSystem_SWFlags | Product titles found on the device that require follow up. For example: Exchange |
| SAMSystem_PrefUser | The primary user of the device based upon the highest number of login per user |
| SAMSystem_PrefUserDomain | The domain the primary user of the device is a member of |
| SAMSystem_OriginalCPUModel | The raw CPU model returned including legal symbols and additional spacing. For example: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz |
| SAMVersion_LatestActivityDate | The last time the device was successfully inventoried |
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| SAMSoftwareLastUse_Caption | The name of the Microsoft product |
| SAMSoftwareLastUse_Version | The version of the Microsoft product |
| SAMSoftwareLastUse_LastUse | The date the Microsoft product or component was last used |
| SAMSoftwareLastUse_InstallState | The Microsoft product's installation state |
| SAMSoftwareLastUse_IsInstalled | Is the Microsoft product installed |
| SAMSoftwareLastUse_User | The login name of the last user of the device |
| SAMSoftwareLastUse_UserDomain | The domain the last user of the device is a member of |
| SAMUser_UserName | User names connected to the device |
| SAMUser_UserDomain | The domain the user(s) who have connected to the device are a member of |
| SAMUser_ConnectionMethod | The type of connect each user has made to the device. For example: Interactive |
| SAMUser_LogonDateTime | The date/time the connection was made |
| SAMUser_TotalMins | The total number of minutes connected |
| SAMUser_TotalLogons | The total number of logons |
| SAMSystem_RegUser | The user the device is registered to |
| SAMSystem_LastUser | The last user of the device before it was last inventoried |
| SAMSystem_LastUserDomain | The domain the last user of the device belongs to |
System Center DPM
| Name | Description |
|---|---|
| SysCntDPMManaged_FQDN | The fully qualified domain name of the device being backed up by DPM |
| SysCntDPMManaged_BackupState | The state of the last backup performed. For example: Succeeded |
| SysCntDPMManaged_CompletionDate | The date the last backup was performed |
| SysCntDPMVersion_Version | The DPM Servers version. For example: 5.0.158.0 |
| SysCntDPMVersion_LatestActivityDate | The date of the last activity to occur in the DPM SQL database |
| SysCntOMManaged_FQDN | The fully qualified domain name of the device being monitored by SCOM |
| SysCntOMManaged_GroupName | The group the device belongs to in SCOM. For example: All Windows Computers |
| SysCntOMManaged_IsDeleted_OM | Has the device been deleted from SCOM |
| SysCntOMManaged_LastModified | When were the SCOM configuration applied to the device last modified |
| SysCntOMVersion_Version | The SCOM Servers version. For example: 7.2.11719.0 |
| SysCntOMVersion_LatestActivityDate | The date of the last activity to occur in the SCOM SQL database |
Oracle information
| Name | Description |
|---|---|
| Oracle_Instance | This is the DB_UNIQUE_NAME for the oracle instance. |
| Oracle_Version | Version of the oracle instance. |
| Oracle_Path | The oracle instance is saved in this location. |
| Oracle_AutoStart | If set to Y, the oracle instance will start automatically when the system boots up. |
Windows (actual resource consumption scan)
The following datapoints are collected when a user performs a Windows actual resource consumption scan.
SQL information
The SQL information is collected during actual resource consumption scan only if a user configures to do so in the console or the config file.
| Name | Description |
|---|---|
| arcsqlcpuhour_CpuIdlePercent | Percentage of the CPU that is arcsqlcpuhour_CpuOtherPercent Percentage of the CPU that being utilized by services other than SQL Server |
| arcsqlcpuhour_EventDatetimeUtc | The UTC date / time the consumption date was collected |
| arcsqlcpuio_CpuTimeMs | CPU time used by SQL in millisecond intervals |
| arcsqlcpuio_CpuPercent | The percentage of the CPU being consumed by SQL |
| arcsqlcpuio_TotalIoMb | Total SQL related I/O in Mb |
| arcsqlcpuio_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
| arcsqldbconnections_ClientAddress | The IP address of the device connecting to the SQL database NOTE: Not considered External PII because this IP address is specific to servers not workstations. |
| arcsqldbconnections_ProgramName | The program being used to connect to the SQL database |
| arcsqldbconnections_HostName | The name of the device connecting to the SQL database |
| arcsqldbconnections_LoginName | The user/service account being used to connect to the SQL database |
| arcsqldbconnections_ConnectionCount | The number of connections the program connecting to the SQL database is creating |
| arcsqldbconnections_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
| arcsqldbstats_SizeOnDiskMb | The SQL database size on disk in Mb |
| arcsqldbstats_UsedMb | The amount of space the SQL database is actually using versus its size on disk in Mb |
| arcsqldbstats_IsData | The amount of the SQL database that is data versus log |
| arcsqldbstats_ReadMb | The quantity of SQL database reads that have occurred since last reboot in Mb |
| arcsqldbstats_WrittenMb | The quantity of SQL database writes that have occurred since last reboot in Mb |
| arcsqldbstats_NumberOfReads | The total number of SQL database reads that have occurred since last reboot |
| arcsqldbstats_NumberOfWrites | The total number of SQL database writes that have occurred since last reboot |
| arcsqldbstats_IoStallReadMs | SQL IO stall reads in milliseconds |
| arcsqldbstats_IoStallWriteMs | SQL IO stall writes in milliseconds |
| arcsqldbstats_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
| arcsqldrivestats_Drive | The SQL drive letter |
| arcsqldrivestats_VolumeMountPoint | The SQL mount point |
| arcsqldrivestats_FileSystemType | The SQL file system type |
| arcsqldrivestats_LogicalVolumeName | The SQL logical volume name |
| arcsqldrivestats_TotalSizeGb | The total drive size in Gb |
| arcsqldrivestats_UsedSizeGb | The amount of the drive used in Gb |
| arcsqldrivestats_ReadLatencyMs | SQL read latency in milliseconds |
| arcsqldrivestats_WriteLatencyMs | SQL write latency in milliseconds |
| arcsqldrivestats_OverallLatencyMs | SQL overall latency in milliseconds |
| arcsqldrivestats_AverageBytesPerRead | SQL average bytes per read |
| arcsqldrivestats_AverageBytesPerWrite | SQL average bytes per write |
| arcsqldrivestats_AverageBytesPerTransfer | SQL average bytes per transfer |
| arcsqldrivestats_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| arcsqldbconnections_LoginName | The user/service account being used to connect to the SQL database. |
Windows disk information
| Name | Description |
|---|---|
| arcwindisk_DiskQueueLength | Disk queue length when the scan was performed. |
| arcwindisk_AvgDiskQueueLength | Average disk queue length when the scan was performed. |
| arcwindisk_ReadMbPerSec | Disk reads in Mb per second. |
| arcwindisk_WriteMbPerSec | Disk writes in Mb per second. |
| arcwindisk_ReadDiskLatency | The disks read latency. |
| arcwindisk_WriteDiskLatency | The disks write latency. |
| arcwindisk_KbPerTransfer | The size of the data moved to disk in Kb per transfer. |
| arcwindisk_ArcDatetimeUtc | The UTC date / time the consumption date was collected. |
Windows event log information
The following datapoints are not collected by default. Users need to check the Collect PII flag in the options tab to enable bots to collect these datapoints.
| Name | Description |
|---|---|
| arcwineventlog_LogName | Name of the log that event data is being collected from. |
| arcwineventlog_Category | The event task category. |
| arcwineventlog_Source | The logs source. |
| arcwineventlog_EventId | The event ID. |
| arcwineventlog_EventDate | The date the event occurred. |
| arcwineventlog_UserName | The user/service name corresponding to the event. |
| arcwineventlog_Message | The events detailed message. |
| arcwineventlog_ArcDatetimeUtc | The UTC date / time the consumption date was collected. |
Windows netstat information
| Name | Description |
|---|---|
| arcwinnetstat_LocalAddress | The local IP address of the netstat connection NOTE: Not considered External PII because this IP address is specific to servers not workstations. |
| arcwinnetstat_ForeignAddress | The foreign address of the netstat connection NOTE: Considered External PII because connections will include both servers and workstations. |
| arcwinnetstat_ForeignPort | The port number the foreign address is using |
| arcwinnetstat_State | The state of the connection when the scan was performed |
| arcwinnetstat_ProcessName | The name of the process being connected to and its install path |
| arcwinnetstat_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
Windows network information
| Name | Description |
|---|---|
| arcwinnetwork_SendMbPerSec | The amount of data sent from the device in Mb per second since the previous scan |
| arcwinnetwork_ReceiveMbPerSec | he amount of data received by the device in Mb per second since the previous scan |
| arcwinnetwork_TotalMbSent | The total amount of data sent from the device in Mb |
| arcwinnetwork_TotalMbReceived | The total amount of data received by the device in Mb |
| arcwinnetwork_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
Windows process information
| Name | Description |
|---|---|
| arcwinprocess_ProcessName | The name of the process consuming CPU and memory resources |
| arcwinprocess_ProcessPath | The install path of the process consuming CPU and memory resources |
| arcwinprocess_ProcessVersion | The version of the process consuming CPU and memory resources |
| arcwinprocess_MemoryMb | The amount of memory being consumed by the process in Mb |
| arcwinprocess_CpuPercent | The percentage of the CPU being consumed by the process |
| arcwinprocess_ArcDatetimeUtc | The UTC date / time the consumption date was collected |
Microsoft 365/M365 scanning
The M365 scan or M365 scan collects user information, information about Office products in a subscription, mailboxes, equivalent of exchange online, and information about mobile devices connected to Exchange online.
| Name | Description |
|---|---|
| M365Mailboxes_Guid | Microsoft 365 subscription ID |
| M365Mailboxes_ExchangeGuid | Microsoft 365 Exchange mailbox GUID |
| M365Mailboxes_DisplayName | Microsoft 365 mailbox: Display name |
| M365Mailboxes_DeliverToMailboxAndForward | Microsoft 365 mailbox: The deliver to mailbox address, and forwarding address if used |
| M365Mailboxes_LitigationHoldEnabled | Microsoft 365 mailbox: Litigation hold enabled |
| M365Mailboxes_LitigationHoldDate | Microsoft 365 mailbox: Litigation hold start date |
| M365Mailboxes_LitigationHoldDuration | Microsoft 365 mailbox: Litigation hold duration |
| M365Mailboxes_RetentionPolicy | Microsoft 365 mailbox: Retention policy applied to the mailbox |
| M365Mailboxes_RetentionHoldEnabled | Microsoft 365 mailbox: Retention hold enabled |
| M365Mailboxes_ExchangeUserAccountControl | Microsoft 365 mailbox: Exchange mailbox user account control |
| M365Mailboxes_IsMailboxEnabled | Microsoft 365 mailbox: Is the mailbox enabled |
| M365Mailboxes_Languages | Microsoft 365 mailbox: Language |
| M365Mailboxes_IsResource | Microsoft 365 mailbox: Is resource mailbox |
| M365Mailboxes_IsLinked | Microsoft 365 mailbox: Is a linked mailbox |
| M365Mailboxes_IsShared | Microsoft 365 mailbox: Is a shared mailbox |
| M365Mailboxes_IsRootPublicFolderMailbox | Microsoft 365 mailbox: Is a root public folder mailbox |
| M365Mailboxes_ResetPasswordOnNextLogon | Microsoft 365 mailbox: Password must be reset at next logon |
| M365Mailboxes_ResourceType | Microsoft 365 mailbox: Resource type |
| M365Mailboxes_RoomMailboxAccountEnabled | Microsoft 365 mailbox: Room account enabled |
| M365Mailboxes_UserPrincipalName | Microsoft 365 mailbox: User principal name |
| M365Mailboxes_UMEnabled | Microsoft 365 mailbox: Is the mailbox enabled for Unified Messaging |
| M365Mailboxes_WindowsLiveID | Microsoft 365 mailbox: Windows Live ID |
| M365Mailboxes_MicrosoftOnlineServicesID | Microsoft 365 mailbox: Microsoft Online Services ID |
| M365Mailboxes_WhenMailboxCreated | Microsoft 365 mailbox: When created |
| M365Mailboxes_UsageLocation | Microsoft 365 mailbox: Usage location |
| M365Mailboxes_IsInactiveMailbox | Microsoft 365 mailbox: Is inactive |
| M365Mailboxes_AccountDisabled | Microsoft 365 mailbox: Account is disabled |
| M365Mailboxes_IsDirSynced | Microsoft 365 mailbox: Account is synchronized with a on-premises Active Directory domain |
| M365Mailboxes_Alias | Microsoft 365 mailbox: Account alias |
| M365Mailboxes_GrantSendOnBehalfTo | Microsoft 365 mailbox: user with right to send messages from the mailbox on behalf of the owner |
| M365Mailboxes_HiddenFromAddressListsEnabled | Microsoft 365 mailbox: Is the mailbox hidden from address list |
| M365Mailboxes_PrimarySmtpAddress | Microsoft 365 mailbox: user primary SMTP email address |
| M365Mailboxes_RecipientTypeDetails | Microsoft 365 mailbox: Mailbox recipient type. For example: user mailbox |
| M365Mailboxes_WindowsEmailAddress | Microsoft 365 mailbox: Windows email address |
| M365Mailboxes_Identity | Microsoft 365 mailbox: User identity |
| M365Mailboxes_IsValid | Microsoft 365 mailbox: Is the mailbox valid |
| M365Mailboxes_Name | Microsoft 365 mailbox user name |
| M365Mailboxes_WhenChangedUTC | Microsoft 365 mailbox: When last changed |
| M365Mailboxes_WhenCreatedUTC | Microsoft 365 mailbox: When created |
| M365Mailboxes_Id | Microsoft 365 mailbox: user ID |
| M365MailboxStatistics_OwnerADGuid | Microsoft 365 subscription ID |
| M365MailboxStatistics_MailboxGuid | Microsoft 365 mailbox: The mailbox GUID |
| M365MailboxStatistics_DisplayName | Microsoft 365 mailbox: Display name |
| M365MailboxStatistics_ItemCount | Microsoft 365 mailbox: The number of items in the mailbox account |
| M365MailboxStatistics_DeletedItemCount | Microsoft 365 mailbox: The number of deleted items in the mailbox account |
| M365MailboxStatistics_TotalItemSize | Microsoft 365 mailbox: The size of the items in the mailbox account |
| M365MailboxStatistics_TotalDeletedItemSize | Microsoft 365 mailbox: The size of the deleted items in the mailbox account |
| M365MailboxStatistics_LastLogoffTime | Microsoft 365 mailbox: The last time the mailbox was logged off |
| M365MailboxStatistics_LastLogonTime | Microsoft 365 mailbox: The last time the mailbox was logged into |
| M365MailboxStatistics_MailboxType | Microsoft 365 mailbox: Mailbox type. For example: user mailbox |
| M365MailboxStatistics_MailboxTypeDetail | Microsoft 365 mailbox: Mailbox type details |
| M365MailboxStatistics_IsDatabaseCopyActive | Microsoft 365 mailbox: Is the database copy active |
| M365MailboxStatistics_IsQuarantined | Microsoft 365 mailbox: Is the mailbox quarantined |
| M365MailboxStatistics_IsArchiveMailbox | Microsoft 365 mailbox: Is the mailbox archived |
| M365MailboxStatistics_IsMoveDestination | Microsoft 365 mailbox: Move destination |
| M365MailboxStatistics_IsValid | Microsoft 365 mailbox: Is the mailbox valid? |
| M365MobileDevices_Guid | Microsoft 365 mobile device: The Microsoft 365 Exchange mailbox GUID that the ActiveSync device connects to |
| M365MobileDevices_DisplayName | Microsoft 365 mobile device: The ActiveSync devices name. For example: iPhone 6 Plus |
| M365MobileDevices_Identity | Microsoft 365 mobile device: The ActiveSync devices Microsoft 365 identity. For example: Andrew Ireland\ExchangeActiveSyncDevices\iPhone |
| M365MobileDevices_DeviceId | Microsoft 365 mobile device: The ActiveSync devices ID |
| M365MobileDevices_DeviceType | Microsoft 365 mobile device: Type of device used to synchronize with M365 Exchange Server |
| M365MobileDevices_FriendlyName | Microsoft 365 mobile device: The ActiveSync devices name. For example: iPhone 6 Plus |
| M365MobileDevices_DeviceModel | Microsoft 365 mobile device: The ActiveSync devices model. For example: iPhone |
| M365MobileDevices_DeviceUserAgent | Microsoft 365 mobile device: The ActiveSync devices agent. For example: Apple-iPhone |
| M365MobileDevices_DeviceOS | Microsoft 365 mobile device: The ActiveSync devices operating system. For example: iOS 10.2 |
| M365MobileDevices_DeviceOSLanguage | Microsoft 365 mobile device: The ActiveSync devices operating system language. For example: en-US |
| M365MobileDevices_IsManaged | Microsoft 365 mobile device: Is the device managed by Exchange |
| M365MobileDevices_DeviceAccessState | Microsoft 365 mobile device: Is the device allowed to synchronize with the mailbox |
| M365MobileDevices_IsCompliant | Microsoft 365 mobile device: Is the device compliant with the M365 ActiveSync policies |
| M365MobileDevices_IsDisabled | Microsoft 365 mobile device: Has the ActiveSync relationship been disabled |
| M365MobileDevices_FirstSyncTime | Microsoft 365 mobile device: The first time a user ActiveSync device synchronized with Microsoft 365 Exchange Server |
| M365MobileDevices_ClientType | Microsoft 365 mobile device: The protocol the device uses to connect to M365. For example: EAS |
| M365MobileDevices_IsValid | Microsoft 365 mobile device: Is the device valid? |
| M365user_Uid | The user ID in Microsoft 365 |
| M365user_DisplayName | The user display name. For example: Andrew Ireland |
| M365user_FirstName | The user first name. For example: Andrew |
| M365user_LastName | The user last name. For example: Ireland |
| M365user_SignInName | The email address with which the user signs into Microsoft 365. |
| M365user_UserPrincipalName | The user principal name, typically the same as their sign in name |
| M365user_PreferredLanguage | The user preferred language |
| M365user_Licenses | The M365 subscription(s) assigned to the user |
| M365user_Title | The user job title |
| M365user_Department | If used, specifies the user department. For example: Finance |
| M365user_Company | The user company |
| M365user_City | The user city |
| M365user_State | The user state |
| M365user_Country | The user country/region as selected in Microsoft 365 |
| M365user_UserType | The type of user account. For example: member |
| M365user_SoftDeletionTimestamp | If present, represents the date the account was marked for deletion |
| M365user_StrongPasswordRequired | Does the account require a strong password |
| M365user_UsageLocation | The user country/region of usage. For example: US |
| M365user_LastPasswordChangeTimestamp | The date the user last reset their password |
| M365user_PasswordNeverExpires | If true then the user password is set to never expire |
| M365user_PasswordResetNotRequiredDuringActivate | If set then the user password is not required when activating a subscription |
| M365user_IsLicensed | Has the user been assigned a license to access M365 |
| M365user_ValidationStatus | The account validation state. For example: Healthy |
| M365user_WhenCreated | The date the user account was created |
Windows vCenter Server/vCenter Server Appliance
The following datapoints are collected when a user initiates a Windows vCenter Server scan or vCenter Server Appliance scan. These data points are also collected when we run an inventory scan on a Hyper-V Server, System Center VMM server, or on a XenServer.
VM configuration (cluster/host/guest)
| Name | Description |
|---|---|
| VirtualGuest_ClusterName | The physical host cluster the virtual guest resides in |
| VirtualGuest_HostName | The physical host the virtual guest currently resides on |
| VirtualGuest_GuestUUID | The virtual guests Universally Unique Identifier |
| VirtualGuest_GuestUUID_Link | The virtual guests serial number |
| VirtualGuest_GuestName | The virtual guests display name |
| VirtualGuest_GuestDNS | Name of the virtual guest as registered in DNS |
| VirtualGuest_State | The virtual guests current state. For example: Powered On |
| VirtualGuest_Memory | The amount of memory currently assigned to the virtual guest |
| VirtualGuest_VirtualCPU | The number of virtual CPUs currently assigned to the virtual guest |
| VirtualGuest_GuestOS | The virtual guests operating system as selected on the physical host |
| VirtualGuest_Description | The virtual guests description as entered on the physical host |
| VirtualGuest_HostCount | The number of physical hosts the virtual guest has run on within the past 30 days |
| VirtualHost_HostName | The physical hypervisor hosts name |
| VirtualHost_ClusterName | The cluster the physical hypervisor host resides in |
| VirtualHost_CPUModel | The physical hypervisor hosts CPU model. For example: Intel Xeon X5675 @ 3.07GHz |
| VirtualHost_CPUs | The number of processors installed in the physical hypervisor host |
| VirtualHost_TotalCores | The number of cores installed in the physical hypervisor host |
| VirtualHost_TotalThreads | The total number of processing threads available on the physical host |
| VirtualHost_HyperThreading | Has hyper threading been enabled on the physical host |
| VirtualHost_VmotionEnabled | Does the physical hypervisor host vmotion enabled |
| VirtualHost_SupportsLiveMigration | Does the physical hypervisor host support live migrations |
| VirtualHost_OperatingSystem | The physical hypervisor hosts operating system. For example: VMware ESXi 6.0.0 build-3620759 |
| VirtualHost_ClusterNodeStatus | The current status of the node in the cluster |
| VirtualHost_Memory | he total amount of memory installed in the physical hypervisor host |
| VirtualMovement_GuestName | The virtual guests display name |
| VirtualMovement_DNSName | Name of the virtual guest as registered in DNS |
| VirtualMovement_ClusterName | The physical host cluster the virtual guest resides in |
| VirtualMovement_GuestUUID | The virtual guests Universally Unique Identifier |
| VirtualMovement_CurrentHost | The physical host the virtual guest moved from |
| VirtualMovement_TargetHost | The physical host the virtual guest moved to |
| VirtualMovement_MigrationCompleted | The date/time the virtual guest moved from the source host to the target host |
| VirtualMovement_EventType | The migration event type. For example: vim.event.VmMigratedEvent |
| VirtualMovement_CmdletName | The cmdlet triggering the migration event. For example: Move-SCVirtualMachine |
| VirtualNetwork_ClusterName | The physical host cluster the virtual guest resides in |
| VirtualNetwork_HostName | The physical host the virtual guest currently resides on |
| VirtualNetwork_GuestName | The virtual guests display name |
| VirtualNetwork_GuestUUID | The virtual guests Universally Unique Identifier |
| VirtualNetwork_MACAddress | The virtual guests MAC address |
| VirtualNetwork_IPAddress | The virtual guests IP address(es) NOTE: Not considered External PII because this IP address is specific to servers not workstations. |
| VirtualNetwork_IPSubnet | The virtual guests IP subnet |
| VirtualPowerEvent_EventTimestamp | The date/time the virtual guest was powered on / off |
| VirtualPowerEvent_PowerDate | The date/time the virtual guest was powered on / off |
| VirtualPowerEvent_GuestName | The virtual guests display name |
| VirtualPowerEvent_GuestUUID | The virtual guests Universally Unique Identifier |
| VirtualPowerEvent_HostName | The physical host the virtual guest was on when the power on/off event occurred |
| VirtualPowerEvent_Event | The type of event. For example: vim.event.DrsVmPoweredOnEvent |
| VirtualPowerEvent_CmdletName | The cmdlet triggering the powered on/off event. For example: Start-SCVirtualMachine |
| VirtualPowerEvent_ClusterName | The physical host cluster the virtual guest resides in |
| VirtualVersion_Version | The version of the hypervisor technology managing the virtual guest. For example: VirtualCenter Database 6.0 |
| VirtualVersion_LatestActivityDate | The date of the last activity to occur in the hypervisor management database |
Linux inventory scan
The following datapoints are collected when a user initiates a Linux inventory scan.
Software Asset Management (SAM)
| Name | Description |
|---|---|
| SAMDatabase_DataSource | The frontend Windows Server a SQL Server DSN record was found on |
| SAMDatabase_DBServer | The SQL Server the DSN record is pointing to |
| SAMDatabase_DBName | The database housing the technology the DSN record is pointing to |
| SAMDatabase_DBType | The technology the DSN record relates to. For example: SCCM |
| SAMDatabase_Version | The version of technology the DSN SAMGeo_City - The name of the city the ISP provider returned for the device |
| SAMGeo_Country | The name of the country the ISP provider returned for the device |
| SAMGeo_CountryCode | The country code the ISP provider returned for the device |
| SAMGeo_Latitude | The latitude the ISP provider returned for the device |
| SAMGeo_Longitude | The longitude the ISP provider returned for the device |
| SAMHDD_PhysicalDrive | The devices physical storage drive type. For example: SCSI Disk Device |
| SAMHDD_LogicalDriveLetter | The devices logical drive letter |
| SAMHDD_LogicalDriveName | The devices logical drive name |
| SAMHDD_FileSystem | The devices storage file system. For example: NTFS |
| SAMHDD_TotalSize | The total size of the devices drive |
| SAMHDD_FreeSize | The remaining space on the devices drive |
| SAMMSAppsFound_MSAppType | Microsoft product(s) installed on the device |
| SAMMSAppsFound_Edition | The edition of the Microsoft product(s) installed |
| SAMMSAppsFound_ProductVer | The version of the Microsoft product(s) installed |
| SAMNetwork_MACAddress | The MAC address for each network card installed in the device |
| SAMNetwork_IPAddress | The IP address for each network card installed in the device |
| SAMNetwork_SubnetMask | The subnet mask for each network card installed in the device |
| SAMOSActivation_ActivationString | How and if the devices Windows operating system was activated |
| SAMServices_Name | The name of the services (and processes) installed on Windows Server and (Linux) devices |
| SAMServices_State | The state of each service when scanned |
| SAMServices_CreationDate | The date each service was created on the device |
| SAMServices_SvcPath | The services install path |
| SAMSoftware_RegistryKey | The installed product's registry key |
| SAMSoftware_InstallDate | The installed product's installation date |
| SAMSoftware_Version | The installed product's version |
| SAMSoftware_Publisher | The installed product's publisher |
| SAMSoftware_DisplayName | The installed products display name |
| SAMSoftware_LastRunDate | The date the installed product was last run |
| SAMSoftwareLastUse_Caption | The name of the Microsoft product |
| SAMSoftwareLastUse_Version | The version of the Microsoft product |
| SAMSoftwareLastUse_LastUse | The date the Microsoft product or component was last used |
| SAMSoftwareLastUse_InstallState | The Microsoft product's installation state |
| SAMSoftwareLastUse_IsInstalled | Is the Microsoft product installed |
| SAMSoftwareLastUse_User | The login name of the last user of the device |
| SAMSoftwareLastUse_UserDomain | The domain the last user of the device is a member of |
| SAMSQLAG_Instance | The SQL Server instance name |
| SAMSQLAG_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQLAG_Database | The SQL database the availability group setting applies toSAMSQLAG_SyncState - The database's synchronization state. For example: SYNCHRONIZED |
| SAMSQLAG_AvailabilityGroup | The SQL availably group name |
| SAMSQLAG_PrimaryReplica | The primary replica of the SQL database |
| SAMSQLAG_PrimaryRecoveryHealth | The state of the primary replica. For example: ONLINE |
| SAMSQLAG_Role | The SQL Servers role in the availability group. For example: PRIMARY |
| SAMSQLAG_SyncHealth | The availably groups synchronization health. For example: HEALTHY |
| SAMSQLAG_PrimaryAllowConn | Does the primary replica allow connections. For example: YES |
| SAMSQLAG_SecondaryAllowConn | Do the secondary replicas all connections. For example: READ_ONLY |
| SAMSQL-Alias_Alias | The SQL Servers alias if one has been specified |
| SAMSQL-Alias_Actual | The SQL Servers FQDN and the port number SQL is using. For example: SCCMSQL.IO.PRIV,1433 |
| SAMSQL-BIFeatures_Instance | The SQL Server instance name |
| SAMSQL-BIFeatures_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-BIFeatures_Version | The full SQL Server version. For example: 11.3.6020.0 |
| SAMSQL-BIFeatures_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQL-BIFeatures_Features | The SQL business intelligence features installed in the instance. For example: Analysis_Server_Full=3 |
| SAMSQL-BIFeatures_Component | The SQL business intelligence component installed in the instance. For example: AS |
| SAMSQL-CPU_Instance | The SQL Server instance name |
| SAMSQL-CPU_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-CPU_LogicalCPUs | The number of logical CPUs visible to the SQL Server |
| SAMSQL-CPU_HTRatio | The hyper threading ratio. For example: 1 |
| SAMSQL-CPU_SQLCPU | The number of CPUs visible to the SQL Server |
| SAMSQL-DB_Instance | The SQL Server instance name |
| SAMSQL-DB_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-DB_Database | The SQL database name |
| SAMSQLServerDatabases_SystemDB | Is the SQL database a system database |
| SAMSQL-DB_State | The SQL database state. For example: ONLINE |
| SAMSQL-DB_Date | The date the SQL database was created |
| SAMSQL-DB_DbSize | The SQL database data size |
| SAMSQL-DB_LogSize | The SQL database log size |
| SQLDBsReceived_Database | The name of the SQL database queried by Movere. For example: vCenter |
| SQLDBsReceived_LatestActivityDate | The date of the last activity to occur in the SQL database |
| SAMSQL-Hist_Instance | The SQL Server instance name |
| SAMSQL-Hist_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-Hist_AvgReads | The total number of reads performed since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_AvgWrites | The total number of writes performed since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_AvgConnections | The total number of connections to the SQL Server since last reboot divided by the number of days since last reboot |
| SAMSQL-Hist_UptimeDays | The number of days since the SQL Server was last rebooted |
| SAMSQL-LS_Instance | The SQL Server instance name |
| SAMSQL-LS_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-LS_PrimaryServer | The primary SQL Server in the log shipping configuration |
| SAMSQL-LS_PrimaryDatabase | The primary database in the log shipping configuration |
| SAMSQL-LS_SecondaryServer | The secondary SQL Server in the log shipping configuration |
| SAMSQL-LS_SecondaryDatabase | The secondary database in the log shipping configuration |
| SAMSQL-MR_Instance | The SQL Server instance name |
| SAMSQL-MR_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-MR_Database | The SQL database being mirrored |
| SAMSQL-MR_State | The state of the synchronization. For example: SYNCHRONIZED |
| SAMSQL-MR_Role | The SQL Servers role in a mirrored configuration. For example: PRINCIPAL |
| SAMSQL-MR_Partner | The SQL Servers partner in the mirrored configuration |
| SAMSQL-MR_Witness | The SQL Server witness in the mirrored configuration |
| SAMSQLServerInstances_Instance | The SQL Server instance name |
| SAMSQLServerInstances_Port | The port number the SQL instance is using. For example: 1433 |
| SAMSQLServerInstances_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQLServerInstances_AllNodes | If clustered, the SQL nodes in the cluster |
| SAMSQLServerInstances_ActiveNode | If clustered, the active SQL node in the cluster |
| SAMSQLServerInstances_Version | The SQL Server instance version. For example: 2016 |
| SAMSQLServerInstances_FullVersion | The SQL Server instance full version. For example: 13.0.1601.5 |
| SAMSQLServerInstances_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQLServerInstances_DBCount | The number of databases in the SQL instance |
| SAMSQLServerInstances_LogShipping | In the SQL instance participating in a log shipping configuration |
| SAMSQLServerInstances_Mirroring | In the SQL instance participating in a mirroring configuration |
| SAMSQLServerInstances_AVGroup | In the SQL instance participating in a SQL availability group configuration |
| SAMSQLServerServices_Instance | The SQL service instance name |
| SAMSQLServerServices_Type | The SQL service type. For example: Reporting Service |
| SAMSQLServerServices_State | The SQL service state. For example: Running |
| SAMSQLServerServices_CreationDate | The date the SQL service was created on the device |
| SAMSQLServerServices_Path | The path the SQL service was created in |
| SAMSQL-Ver_Instance | The SQL Server instance name |
| SAMSQL-Ver_Cluster | The SQL cluster name if the instance is clustered |
| SAMSQL-Ver_Version | The full SQL Server version. For example: 11.3.6020.0 |
| SAMSQL-Ver_Edition | The SQL instance edition. For example: Enterprise |
| SAMSQL-Ver_Port | The port number the SQL instance is using. For example: 1433 |
| SAMSQL-Ver_ActiveNode | If clustered, the active SQL node in the cluster |
| SAMSQL-Ver_AllNodes | If clustered, the SQL nodes in the cluster |
| SAMSystem_FQDN | The devices fully qualified domain name |
| SAMSystem_OS | The devices operating system |
| SAMSystem_NetBIOS | The devices NetBIOS name |
| SAMSystem_PID | The devices operating system product ID |
| SAMSystem_OSActivationMethod | How and if the devices Windows operating system was activated |
| SAMSystem_SerialNo | The devices serial number |
| SAMSystem_UUID | The devices Universally Unique Identifier |
| SAMSystem_RegOrg | The organization the device is registered to |
| SAMSystem_RegUser | The user the device is registered to |
| SAMSystem_Make | The devices make. For example: Hewlett-Packard |
| SAMSystem_Model | The devices model. For example: HP Pavilion dv5 |
| SAMSystem_Domain | he Active Directory domain the device resides in |
| SAMSystem_TotalRAM | The total amount of RAM installed in the device |
| SAMSystem_AvailableRAM | The amount of unused RAM installed in the device when it was last inventoried |
| SAMSystem_CPUModel | The devices CPU model. For example: Intel Core2 Duo T9400 @ 2.53GHz |
| SAMSystem_CPUCount | The number of processors installed in the device |
| SAMSystem_CPUCores | The number of cores installed in the device |
| SAMSystem_LastUser | The last user of the device before it was last inventoried |
| SAMSystem_LastUserDomain | The domain the last user of the device belongs to |
| SAMSystem_Is 64 Bit | Systems processor architecture |
| SAMSystem_Service Pack | Windows service pack installed on the system (if applicable) |
| SAMSystem_Boot Time | Last time the Windows system was started |
| SAMSystem_ScanDate | The date the device was last inventoried |
| SAMSystem_SWLines | The number of software title entries retrieved from the device when last inventoried |
| SAMSystem_SWFlags | Product titles found on the device that require follow up. For example: Exchange |
| SAMSystem_PrefUser | The primary user of the device based upon the highest number of login per user |
| SAMSystem_PrefUserDomain | The domain the primary user of the device is a member of |
| SAMSystem_OriginalCPUModel | The raw CPU model returned including legal symbols and additional spacing. For example: Intel(R) Core(TM)2 Duo CPU T9400 @ 2.53GHz |
| SAMUser_UserName | User names connected to the device |
| SAMUser_UserDomain | The domain the user(s) who have connected to the device are a member of |
| SAMUser_ConnectionMethod | The type of connect each user has made to the device. For example: Interactive |
| SAMUser_LogonDateTime | The date/time the connection was made |
| SAMUser_TotalMins | The total number of minutes connected |
| SAMUser_TotalLogons | The total number of logons |
| SAMVersion_LatestActivityDate | The last time the device was successfully inventoried |
Linux actual resource consumption scan
The following data is collect when a user performs a Linux actual resource consumption scan.
Linux disk information
| Name | Description |
|---|---|
| arclinuxdisk_ReadMbPerSec | isk reads in MB per second. |
| arclinuxdisk_WriteMbPerSec | Disk writes in MB per second. |
| arclinuxdisk_KbPerTransfer | The size of the data moved to disk in KB per transfer. |
| arclinuxdisk_DiskUsePercent | Total disk use percentage. |
| arclinuxdisk_ArcDatetimeUtc | he UTC date / time the consumption date was collected. |
Linux netstat information
| Name | Description |
|---|---|
| arclinuxnetstat_LocalAddress | The local IP address of the netstat connection NOTE: Not considered External PII because this IP address is specific to servers not workstations. |
| arclinuxnetstat_ForeignAddress | he foreign address of the netstat connection NOTE: Considered External PII because connections will include both servers and workstations. |
| arclinuxnetstat_LocalPort | The port number the local address is using |
| arclinuxnetstat_ForeignPort | The port number the foreign address is using |
| arclinuxnetstat_State | The state of the connection when the scan was performed |
| arclinuxnetstat_ProcessName | The name of the process being connected to and its install path |
| arclinuxnetstat_ArcDatetimeUtc | The UTC date / time the consumption date was collected. |
Linux network information
| Name | Description |
|---|---|
| arclinuxnetwork_SendMbPerSec | The amount of data sent from the d evice in MB per second since the previous scan. |
| arclinuxnetwork_ReceiveMbPerSec | The amount of data received by the device in MB per second since the previous scan. |
| arclinuxnetwork_TotalMbSent | The total amount of data sent from the device in MB. |
| arclinuxnetwork_TotalMbReceived | The total amount of data received by the device in MB. |
| arclinuxnetwork_ArcDatetimeUtc | The UTC date / time the consumption date was collected. |
Linux process information
| Name | Description |
|---|---|
| arclinuxprocess_ProcessName | The name of the process consuming CPU and memory resources. |
| arclinuxprocess_ProcessPath | he install path of the process consuming CPU and memory resources. |
| arclinuxprocess_MemoryMb | The amount of memory being consumed by the process in MB. |
| arclinuxprocess_CpuPercent | The percentage of the CPU being consumed by the process. |
| arclinuxprocess_ArcDatetimeUtc | The UTC date / time the consumption date was collected. |
Next steps
Review resource consumption data views.