Руководство Разработчика для Cisco Cisco Firepower Management Center 4000
8-2
FireSIGHT System Database Access Guide
Chapter 8 Schema: User Activity Tables
discovered_users
discovered_users Joins
The following table describes the joins you can perform on the
rua_user
table.
discovered_users Sample Query
The following query returns up to 25 discovered user records that were generated since a specified date
and time.
and time.
SELECT user_id, ip_address, email, name, last_seen_sec, last_updated_sec
FROM discovered_users
WHERE last_seen_sec >= UNIX_TIMESTAMP("2011-10-01 00:00:00")
LIMIT 0, 25;
ip_address
This field has been deprecated and returns
null
for all queries.
ipaddr
A binary representation of the IPv4 or IPv6 address for the host where the user login was
detected.
detected.
last_name
The last name for the user.
last_seen_sec
The UNIX timestamp of the date and time the system last reported a login for the user.
last_updated_sec
The UNIX timestamp of the date and time the user’s information was last updated.
name
The name for the user.
phone
The phone number for the user.
rna_service
Field deprecated in Version 5.0. Returns
null
for all queries.
user_id
The internal identification number of the user who last logged onto the host.
Table 8-2
discovered_users Fields (continued)
Field
Description
Table 8-3
discovered_users Joins
You can left join on this field...
With other tables that have join type of...
user_id