When you build a widget or a query in Interno you pick a table and its fields. This guide explains how Interno organises the data that arrives from your connected tools, what the shared system fields mean, and how to find the right field without knowing the table layout by heart.
ZCN_<TYPE> — for example ZCN_DEVICES or ZCN_USERS.ZCN_DEVICES may hold endpoints reported by your EDR, your patch manager and your directory all at once.These seven columns are added to every ZCN_ table, whichever connector produced the row.
| Field | What it means |
|---|---|
ZCN_SOURCE | The tool the record came from. Filter or group by this to scope a widget to one product. |
ZCN_CATEGORY | The category of that source. |
ZCN_COLLECTED_AT | When the record was collected. Use it on the time axis of a trend. |
ZCN_COLLECTION_ID | Identifier of the collection run that produced the record. |
ZCN_ID | Unique record identifier. |
ZCN_IS_LATEST | Marks the most recent snapshot of a record. Filter to 1 to avoid counting history. |
ZCN_CREDENTIAL_ID | The integration whose credentials collected the record. |
The tables below are the data types Interno's connectors declare. You will only have the ones your connected tools supply.
| Table | Contains |
|---|---|
ZCN_DEVICES | Endpoints and hosts, with their attributes |
ZCN_USERS | User accounts and identities |
ZCN_VULNERABILITIES | Vulnerabilities from vulnerability-management tools |
ZCN_INCIDENTS | Security incidents |
ZCN_ALERTS | Alerts raised by tools |
ZCN_DETECTIONS | Detections from EDR/XDR |
ZCN_CASES | Investigation cases |
ZCN_FINDINGS | Posture and scanner findings |
ZCN_PATCHES | Patch records |
ZCN_SOFTWARES | Installed software |
ZCN_AGENTS | Installed security agents |
ZCN_DOMAINS | Domains |
ZCN_POLICIES | Security and firewall policies |
ZCN_ADDRESSES / ZCN_ADDRESS_GROUPS | Network address objects and groups |
ZCN_INTERFACES | Network interfaces |
ZCN_SERVICES / ZCN_SERVICE_GROUPS / ZCN_CUSTOM_SERVICES | Service definitions and groups |
ZCN_EVENTS | Normalised security events |
ZCN_LOGSOURCES | Log sources reported by a SIEM |
ZCN_PLAYBOOKS | Automation playbooks |
ZCN_THREAT_INTEL_SOURCES | Threat-intelligence feeds |
You do not have to know the table layout. In the widget builder, click Browse data dictionary to open the Data Dictionary drawer.
TABLE.COLUMN underneath. Where the source provides it you also see a description, example values, an approximate row count and when it was last synced. Fields with nothing recorded read *"No description yet"*.If nothing matches, the drawer says *"No fields match ..."* and suggests trying a field or table name.
The builder has three tabs:
| Tab | Use it to |
|---|---|
| Query | Build the query by picking tables, fields, filters, aggregations, grouping, ordering and a limit. |
| SQL | Write the query yourself. |
| AI | Describe what you want in plain language and have it drafted for you. Available when you are building a widget. |
If you select only category-style fields, the builder offers a tip: *"You picked category fields. Add a Count so the chart shows totals per value instead of repeated rows."* Click Apply Count to take the suggestion, or dismiss it.
ZCN_SOURCE.ZCN_IS_LATEST = 1.ZCN_COLLECTED_AT on the time axis.A table I expected is not in the list → No connected connector contributes that data type yet. Connect the relevant integration under Admin > Integrations and let it complete a scan.
A field is empty for some rows → Fields vary by source; not every connector supplies every column. Filter by ZCN_SOURCE to a tool that populates it.
My counts look too high → You are counting historical snapshots. Add ZCN_IS_LATEST = 1.
A field in the dictionary shows "No description yet" → Descriptions come from the source metadata. The field still works; use the example values and the raw TABLE.COLUMN name to judge what it holds.
The AI tab is not showing → The AI tab appears when you are building a widget. It is not offered for the other builder modes.
Need more help? Contact support@zeron.one