When you build a widget or a query in Interno you pick a table and its fields. This guide explains how Interno organises the data that arrives from your connected tools, what the shared system fields mean, and how to find the right field without knowing the table layout by heart.
ZCN_<TYPE> — for example ZCN_DEVICES or ZCN_USERS.ZCN_DEVICES may hold endpoints reported by your EDR, your patch manager and your directory all at once.These seven columns are added to every ZCN_ table, whichever connector produced the row.
| Field | What it means |
|---|---|
ZCN_SOURCE | The tool the record came from. Filter or group by this to scope a widget to one product. |
ZCN_CATEGORY | The category of that source. Rows uploaded through Manual Ingestion carry manual. |
ZCN_COLLECTED_AT | When the record was collected. Use it on the time axis of a trend. |
ZCN_COLLECTION_ID | Identifier of the scan, or the manual upload, that produced the record. |
ZCN_ID | Unique record identifier. |
ZCN_IS_LATEST | Marks the most recent snapshot of a record. Filter to 1 to avoid counting history. |
ZCN_CREDENTIAL_ID | The integration credential that collected the record. For integrations added recently this is the connector's identifier and the name you gave the credential, joined by ~. Rows uploaded through Manual Ingestion carry manual. |
The tables below are the data types Interno's connectors declare. You will only have the ones your connected tools supply.
| Table | Contains |
|---|---|
ZCN_DEVICES | Endpoints and hosts, with their attributes |
ZCN_USERS | User accounts and identities |
ZCN_VULNERABILITIES | Vulnerabilities from vulnerability-management tools |
ZCN_INCIDENTS | Security incidents |
ZCN_ALERTS | Alerts raised by tools |
ZCN_DETECTIONS | Detections from EDR/XDR |
ZCN_CASES | Investigation cases |
ZCN_FINDINGS | Posture and scanner findings |
ZCN_PATCHES | Patch records |
ZCN_SOFTWARES | Installed software |
ZCN_AGENTS | Installed security agents |
ZCN_DOMAINS | Domains |
ZCN_POLICIES | Security and firewall policies |
ZCN_ADDRESSES / ZCN_ADDRESS_GROUPS | Network address objects and groups |
ZCN_INTERFACES | Network interfaces |
ZCN_SERVICE_GROUPS / ZCN_CUSTOM_SERVICES | Firewall service definitions and groups |
ZCN_EVENTS | Normalised security events |
ZCN_LOGSOURCES | Log sources reported by a SIEM |
ZCN_PLAYBOOKS | Automation playbooks |
ZCN_THREAT_INTEL_SOURCES | Threat-intelligence feeds |
| Table | Connectors declared as feeding it |
|---|---|
ZCN_DEVICES | Arcon PAM, Bitdefender, Check Point Next Generation Firewalls (NGFW), Crowdstrike Falcon, Cyberark PAM, Forcepoint DLP, HPE Aruba ClearPass Policy Manager, IBM Guardium, IBM QRadar, Kaspersky Security Center, Kibana, LogRhythm, ManageEngine Endpoint Central, ManageEngine Patch Manager Plus, Micro Focus Service Management Automation X, Microsoft 365, Microsoft Active Directory, Microsoft Defender ATP, Microsoft Intune, Palo Alto Networks Cortex XDR, SentinelOne, Sophos XDR, Tenable Nessus, Tenable Security Center, Trend Micro |
ZCN_USERS | Arcon PAM, Cyberark PAM, IBM QRadar, Microsoft 365, Microsoft Active Directory |
ZCN_VULNERABILITIES | IBM QRadar, Microsoft Defender ATP, SentinelOne, Tenable Nessus, Tenable Security Center |
ZCN_INCIDENTS | Bitdefender, Crowdstrike Falcon, Forcepoint DLP, IBM QRadar, LogRhythm, Micro Focus Service Management Automation X, Palo Alto Networks Cortex XDR, Sophos XDR |
ZCN_FINDINGS | AWS CSPM, AWS ScoutSuite, Microsoft Azure CSPM |
ZCN_DETECTIONS | AWS GuardDuty, Trend Micro |
ZCN_ALERTS | Sophos XDR, Trend Micro |
ZCN_CASES | LogRhythm, Securaa |
ZCN_PLAYBOOKS | LogRhythm, Securaa, Trend Micro |
ZCN_PATCHES | Bitdefender, ManageEngine Patch Manager Plus |
ZCN_SOFTWARES | ManageEngine Endpoint Central, Microsoft Intune, SentinelOne |
ZCN_DOMAINS | Akamai Kona WAF, Cloudflare WAF |
ZCN_AGENTS | IBM Guardium |
ZCN_EVENTS | Iraje PAM |
ZCN_LOGSOURCES / ZCN_THREAT_INTEL_SOURCES | IBM QRadar |
ZCN_INTERFACES / ZCN_POLICIES / ZCN_ADDRESSES / ZCN_ADDRESS_GROUPS / ZCN_SERVICE_GROUPS / ZCN_CUSTOM_SERVICES | Fortigate Firewall |
The same names are what you pick in the Source dropdown of Manual Ingestion and, once data has arrived, in the Source: dropdown of Asset Inventory.
Fields vary by connector, but these are the ones most sources supply.
| Table | Commonly populated fields |
|---|---|
ZCN_DEVICES | DEVICE_ID, HOSTNAME, INTERNAL_IP, MACHINE_DOMAIN, OPERATING_SYSTEM_NAME, OPERATING_SYSTEM_TYPE, OPERATING_SYSTEM_VERSION |
ZCN_USERS | USER_ID, NAME, EMAIL, USER_NAME, LOGIN_NAME, USER_GROUPS, USER_TYPE |
ZCN_VULNERABILITIES | VULNERABILITY_ID, NAME, DESCRIPTION, CVE_ID, CVE_PUBLISH_DATE, CVSS_BASE_SCORE, EPSS_SCORE, SEVERITY_QUALITATIVE, SEVERITY_QUANTITATIVE, DETECTION_TIME, FIRST_SEEN_TIME, SOFTWARE_NAME, SOFTWARE_VENDOR_NAME, SOFTWARE_VERSION, DEVICE_ID, HOSTNAME, INTERNAL_IPS |
ZCN_INCIDENTS | INCIDENT_ID, STATE, STATUS, SEVERITY_QUANTITATIVE, TACTICS, TECHNIQUES, FIRST_SEEN, LAST_SEEN, DEVICE_ID, HOSTNAME |
ZCN_FINDINGS | FINDINGS_ID, TITLE, DESCRIPTION, MESSAGE, SEVERITY_QUALITATIVE, STATUS_CODE, TIME, CLOUD_PROVIDER, CLOUD_REGION, ACCOUNT_NAME, ACCOUNT_UID, RESOURCE_NAME, RESOURCE_UID, RESOURCE_TYPE, REMEDIATION_DESC, RISK_DETAILS |
ZCN_DETECTIONS | DETECTION_ID, TITLE, DESCRIPTION, STATUS, SEVERITY_QUALITATIVE, SEVERITY_QUANTITATIVE, CONFIDENCE_QUALITATIVE, CONFIDENCE_QUANTITATIVE, FIRST_SEEN, LAST_SEEN |
ZCN_ALERTS | DEVICE_ID, HOSTNAME, MESSAGE, SEVERITY_QUALITATIVE, WHEN_CREATED |
ZCN_PATCHES | PATCH_ID, NAME, PATCH_CATEGORY, PATCH_RELEASED_TIME, DEPLOYMENT_STATUS, SEVERITY_QUANTITATIVE, SOFTWARE_VENDOR_NAME, DEVICE_ID, HOSTNAME |
ZCN_SOFTWARES | SOFTWARE_ID, SOFTWARE_NAME, SOFTWARE_VERSION, DEVICE_ID, HOSTNAME |
ZCN_DOMAINS | DOMAIN_ID, DOMAIN_NAME, STATUS, WHEN_CREATED |
ZCN_CASES | CASE_ID, DESCRIPTION, STATUS, OWNER_NAME, DATE_CREATED, DATE_UPDATED |
ZCN_PLAYBOOKS | PLAYBOOK_ID, NAME, DESCRIPTION, OWNER_NAME, LAST_UPDATED_BY, DATE_CREATED, DATE_UPDATED |
For the complete list for your own data, open the table in Assets → Asset Inventory or use the Data Dictionary drawer described next. Columns whose names end in a double underscore, such as NOTES__, are custom columns added through a Manual Ingestion workbook.
You do not have to know the table layout. In the widget builder, click Browse data dictionary to open the Data Dictionary drawer.
TABLE.COLUMN underneath. Where the source provides it you also see a description, example values, an approximate row count and when it was last synced. Fields with nothing recorded read "No description yet".If nothing matches, the drawer says "No fields match ..." and suggests trying a field or table name.
The builder has three tabs:
| Tab | Use it to |
|---|---|
| Query | Build the query by picking tables, fields, filters, aggregations, grouping, ordering and a limit. |
| SQL | Write the query yourself. |
| AI | Describe what you want in plain language and have it drafted for you. Available when you are building a widget. |
If you select only category-style fields, the builder offers a tip: "You picked category fields. Add a Count so the chart shows totals per value instead of repeated rows." Click Apply Count to take the suggestion, or dismiss it.
ZCN_SOURCE.ZCN_IS_LATEST = 1.ZCN_COLLECTED_AT on the time axis.A table I expected is not in the list → No connected connector contributes that data type yet. Check the table above for a connector that feeds it, connect it under Admin > Integrations and let it complete a scan. See How to Configure Connectors/Integrations.
A field is empty for some rows → Fields vary by source; not every connector supplies every column. Filter by ZCN_SOURCE to a tool that populates it.
My counts look too high → You are counting historical snapshots. Add ZCN_IS_LATEST = 1.
A field in the dictionary shows "No description yet" → Descriptions come from the source metadata. The field still works; use the example values and the raw TABLE.COLUMN name to judge what it holds.
The AI tab is not showing → The AI tab appears when you are building a widget. It is not offered for the other builder modes.
Need more help? Contact support@zeron.one