SQL Data Collector Schema
Overview
This is a comprehensive schema documentation for the NAA 11.6 SQL Server Data Collector. The SQL Server Data Collector is a component of the NAA 11.6 platform that discovers, audits, and reports on SQL Server instances, databases, principals, permissions, audit events, and sensitive data across the enterprise.
Schema Categories
The tables fall into two categories:
-
Core Data Collection Tables (44 tables) — Normalized tables populated directly by data collectors. These contain raw audit data with full foreign key relationships. Includes shared infrastructure tables (
SA_SQL_Instances,SA_SQL_Patches) used across all database collector modules. -
Reporting / Summary Tables (59 tables) — Denormalized, report-ready tables populated by analysis jobs. These use human-readable column names (e.g.,
"Instance","Database","Permission").
Core Data Collection Tables
- SA_SQLServer_Instances
- SA_SQLServer_Databases
- SA_SQLServer_EventDatabases
- SA_SQLServer_Schemas
- SA_SQLServer_Objects
- SA_SQLServer_Columns
- SA_SQLServer_ServerPrincipalTypes
- SA_SQLServer_DatabasePrincipalTypes
- SA_SQLServer_ServerPrincipals
- SA_SQLServer_DatabasePrincipals
- SA_SQLServer_EventServerPrincipals
- SA_SQLServer_EventDatabasePrincipals
- SA_SQLServer_SqlLogins
- SA_SQLServer_ServerRoleMembers
- SA_SQLServer_DatabaseRoleMembers
- SA_SQLServer_EffectiveRoleMembership
- SA_SQLServer_PermissionNames
- SA_SQLServer_PermissionClasses
- SA_SQLServer_PermissionStates
- SA_SQLServer_ServerPermissions
- SA_SQLServer_DatabasePermissions
- SA_SQLServer_AsymmetricKeys
- SA_SQLServer_AuditInformation
- SA_SQLServer_AuditFiles
- SA_SQLServer_AuditClassType
- SA_SQLServer_AuditActions
- SA_SQLServer_Statements
- SA_SQLServer_AdditionalInformation
- SA_SQLServer_UserEvents
- SA_SQLServer_Events
- SA_SQLServer_ExpressionDependencies
- SA_SQLServer_SDD_Criteria
- SA_SQLServer_SDD_InstanceCriteria
- SA_SQLServer_SDD_DatabaseCriteria
- SA_SQLServer_SDD_ResourceTypes
- SA_SQLServer_SDD_Resources
- SA_SQLServer_SDD_Matches
- SA_SQLServer_SDD_MatchHits
- SA_SQLServer_SDD_MatchHits_SubjectProfile
- SA_SQLServer_SDD_ScanHistory
- SA_SQLServer_SDD_SupportedDataTypes
- SA_SQL_Patches
- SA_SQL_Instances
- SA_SQL_PasswordIssues_LIST
Reporting Tables
Activity
- SA_SQLServer_Activity_Details
- SA_SQLServer_Activity_UserDatabaseSummary
- SA_SQLServer_Activity_UserInstanceSummary
Authentication
Control Server
- SA_SQLServer_ControlServer_Details
- SA_SQLServer_ControlServer_DomainUsers
- SA_SQLServer_ControlServer_InstanceSummary
Database Principals
Database Size
Direct Permissions
- SA_SQLServer_DirectPermissions_DatabaseDetails
- SA_SQLServer_DirectPermissions_DatabaseSummary
- SA_SQLServer_DirectPermissions_SchemaDetails
- SA_SQLServer_DirectPermissions_SchemaSummary
- SA_SQLServer_DirectPermissions_ServerDetails
- SA_SQLServer_DirectPermissions_ServerSummary
Domain User Permissions
Effective Role Members
Instance Summary
Logons
Password Issues
Permission Changes
Public Permissions
- SA_SQLServer_PublicPermissions_Details
- SA_SQLServer_PublicPermissions_DatabaseSummary
- SA_SQLServer_PublicPermissions_InstanceSummary
- SA_SQLServer_PublicPermissions_NonDefault
Role Members
Security Assessment
Sensitive Data
- SA_SQLServer_SensitiveData_Details
- SA_SQLServer_SensitiveData_DatabaseSummary
- SA_SQLServer_SensitiveData_EnterpriseSummary
Sensitive Data Activity
Sensitive Data Permissions
Server Permissions
Server Principals
SysAdmins
- SA_SQLServer_SysAdmins_Details
- SA_SQLServer_SysAdmins_DomainUsers
- SA_SQLServer_SysAdmins_InstanceSummary
Unusual Activity
User Logins
Best Practices
CMD Shell
Linked Servers
Views
- SA_SQLServer_FullEventsView
- SA_SQLServer_ServerPrincipalsView
- SA_SQLServer_SqlLoginsView
- SA_SQLServer_DatabasePrincipalsView
- SA_SQLServer_PermissionsView
- SA_SQLServer_RoleMembersView
- SA_SQLServer_SqlDatabaseView
- SA_SQLServer_DailyLogonsView
- SA_SQLServer_SDD_ResourcesView
- SA_SQLServer_SDD_MatchesView
- SA_SQLServer_SDD_MatchHitsView
- SA_SQLServer_SensitiveDataPermissionsView
- SA_SQLServer_SDD_MatchHits_SubjectProfileView
- SA_SQLServer_SensitiveDataFullPermissionsView
- SA_SQLServer_EffectiveRoleMembershipView
- SA_SQL_SDD_MatchesView
- SA_SQL_SDD_MatchHitsView
Enumeration & Lookup Values Reference
- Server Principal Types
- Database Principal Types
- Permission States
- Permission Classes
- Permission Names
- Audit Class Types
- Audit Actions (Common)
- SDD Resource Types
- SDD Match Location Bitmask
- Membership Source
- Database Type
Table Relationship Diagrams (ERD)
- High-Level Overview
- Instance & Database Hierarchy
- Principals & Permissions
- Audit Events
- Sensitive Data Discovery (SDD)