Data querying in Devo

All data structures defined for the Endpoint Agent use the following tagging structure: box.devo_ea.category.subcategory. It is, therefore, the root tag from which all subtables are made accessible.

From version 1.2.0 onwards, the product name is changed to Endpoint Agent and the structures in Devo change as follows:

box.devo_ua → box.devo_ea
devo.ua → devo.ea

The following table summarizes the current implementation of data structures and their associated tagging.

Module	Root data structure	Data tables

Module	Root data structure	Data tables
Configuration audit	`box.devo_ea.configuration`	`box.devo_ea.configuration.system_info` `box.devo_ea.configuration.users` `box.devo_ea.configuration.groups` `box.devo_ea.configuration.operating_system` `box.devo_ea.configuration.disk_info` `box.devo_ea.configuration.network` `box.devo_ea.configuration.win_software`
Performance monitoring	`box.devo_ea.performance`	`box.devo_ea.performance.cpu_mem` `box.devo_ea.performance.disk_io` `box.devo_ea.performance.disk_usage` `box.devo_ea.performance_network`
Status monitoring	`box.devo_ea.status`	`box.devo_ea.status.listening_ports` `box.devo_ea.status.process_open_sockets` `box.devo_ea.status.processes` `box.devo_ea.status.users_loggedin`
Events - Windows	`box.devo_ea.events_windows`	`box.devo_ea.events_windows.application` `box.devo_ea.events_windows.powershell` `box.devo_ea.events_windows.security` `box.devo_ea.events_windows.system`
Events - Unix	`box.devo_ea.events_linux`	`box.devo_ea.events_linux`
Events - Sysmon	`box.devo_ea.events_windows`	`box.devo_ea.events_windows.sysmon`
Files logger	`box.devo_ea.files`	`box.devo_ea.files.dns_windows` `box.devo_ea.files.iis` Custom tables
Custom queries	`box_devo_ea.unknown`	Custom tables

macOS users

Since macOS 10.15, there is a new Event System in macOS systems (Unified Logging System) that deprecates the existing ASL. The data existing in ASL can still be queried but due to the lack of reliability it is not consumed by default. The Endpoint Agent does not support consuming data from the new API for Unified Logging System and it will be supported in future versions. Other queries not related to Unified Logging System can be done normally.

The following union tables in the Devo platform contain data coming from the structures depicted above:

Union tables	Data tables

Union tables	Data tables
`box.all.win`	`box.devo_ea.events_windows`
`auth.all`	`box.devo_ea.events_windows`
`auth.unix`	`box.devo_ea.events_linux`
`network.dns`	`box.devo_ea.files.dns_windows`

Besides that, the Endpoint Agent solution sends real-time analytics and diagnostics information of the managers, agents, and extensions deployed in a given environment. The targeted data structures are the following:

Module	Root data structure	Data tables

Module	Root data structure	Data tables
Manager telemetry and diagnostics	`devo.ea.manager`	`devo.ea.manager.status`
Agent telemetry and diagnostics	`devo.ea.agent`	`devo.ea.agent.status`
Extensions telemetry and diagnostics	`devo.ea.extensions`	`devo.ea.extensions.fetchfiles_config` `devo.ea.extensions.fetchfiles_info`

Devo v7.10.0

Data querying in Devo

Analytics

Related content