Schema Compare

Compare fields across tables.

Select up to three tables and compare shared fields, types, and descriptions side by side.

Field Comparison

Field	DeviceProcessEvents	DeviceFileEvents	DeviceNetworkEvents
`ActionType` Shared	string Type of activity that triggered the event.	string Type of file activity that triggered the event.	string Type of network activity that triggered the event.
`DeviceId` Shared	string Unique identifier for the device in the service.	string Unique identifier for the device in the service.	string Unique identifier for the device in the service.
`DeviceName` Shared	string Fully qualified domain name of the device.	string Fully qualified domain name of the device.	string Fully qualified domain name of the device.
`FileName` Partial	string Name of the file that the recorded action was applied to.	string Name of the file that the recorded action was applied to.	Not present
`FolderPath` Partial	Not present	string Folder containing the file that the recorded action was applied to.	Not present
`InitiatingProcessAccountSid` Shared	string Security identifier of the account context that initiated the process.	string Security identifier of the account that ran the process responsible for the event.	string Security identifier of the account that ran the process responsible for the network event.
`InitiatingProcessCommandLine` Partial	Not present	string Command line used to run the process responsible for the event.	Not present
`LocalIP` Partial	Not present	Not present	string Source IP address used during communication.
`ProcessCommandLine` Partial	string Command line used to create the new process.	Not present	Not present
`Protocol` Partial	Not present	Not present	string Protocol used during the communication.
`RemoteIP` Partial	Not present	Not present	string IP address that the device connected to.
`RemotePort` Partial	Not present	Not present	int TCP port on the remote device that was connected to.
`RemoteUrl` Partial	Not present	Not present	string URL or fully qualified domain name that was connected to.
`SHA1` Partial	Not present	string SHA-1 hash of the file that the recorded action was applied to.	Not present
`SHA256` Partial	Not present	string SHA-256 hash of the file that the recorded action was applied to.	Not present
`Timestamp` Shared	datetime Date and time when the event was recorded.	datetime Date and time when the event was recorded.	datetime Date and time when the event was recorded.