How to Extract Data from PA File Sight

Data for PA File Sight is stored in a database, and some customers want to access that data for additional uses. This is fairly easy to do. Reading data is fine. We recommend NOT writing to the databases.

SQLite or MS SSQL?

Before you go much further, you need to know if you are using the embedded SQLite databases, or a MS SQL Server database. This can be seen in the Database Settings dialog. Your application will either use the same or a similar connection string to connect to the MS SQL Server database, or one of the many available connectors for the SQLite databases.

File Access Records

The File Access Records are stored in a few key tables:

Table Name	Contains
FileSightFindings	The main table that lists file activity monitored by the File Sight monitor. IDs in this table will refer to the FileSightUsers, FileSightSourceComputerIPs, FileSightComputers and other tables.
FileSightFindingsExtra	If there was a File Sight Endpoint involved with the fiel I/O, this table lists the information available from the Endpoint. The ExtraInfoKey field will be used to link records from this table to the FileSightFindings table.
FSRCBlocked	This table lists activities that were blocked/alerted on by the Trusted Application Monitors, and any rules that were running on end-user computers that are using the File Sight Endpoint.
FSRCWarnings	This table lists warnings from the Trusted Application Monitors. These are mostly performance and configuration related.