Documentation

Document shape

Every document has three parts:

Part	Holds
Main	The identity and properties of the cryptographic object itself. The fields present depend on the document type.
`sourceProperties`	Where the material was found — host, port, path, cloud region, keystore label, vault URI.
`scanProperties`	The discovery context — which sensor ran, when, from which host, under which task.

Field names are camelCase throughout. Names are case-sensitive: a query against a field spelled differently from the stored key returns no documents rather than an error, so a mis-spelled field reads as an empty result rather than a failure.

Document types

The type field selects which set of main fields applies. The sub-kind discriminator, where one exists, is always spelled subType.

`type`	`subType` values	Represents
`key`	—	A cryptographic key: secret, private or public
`certificate`	—	An X.509 certificate
`protocol`	`ssh`; absent for TLS	A protocol endpoint and its negotiated or advertised algorithms
`binary`	`app`, `lib`, `static`, `firmware`, `driver`, `jvm`, `dotnet`	A compiled artefact carrying cryptographic material or dependencies
`signature`	`codesign`, `cms`, `gpg`, `jar`, `rpm`	A code or content signature
`sourcecode`	`file`, `callgraph`, `summary`	A source file's cryptographic findings, its call graph, or a scan summary
`file`	—	A discovered file of cryptographic interest
`status`	—	A sensor status record
`error`	—	A sensor error record

Fields common to every type

Field	Type	Required	Meaning
`discoverID`	string	Yes	Identifier assigned at discovery. Unique per sighting.
`discoverTime`	string	Yes	When the material was discovered, ISO 8601 UTC.
`type`	string	Yes	Document type, from the table above.
`subType`	string	Per type	Sub-kind discriminator where the type defines one.
`sourceProperties`	object	Yes	Where it was found.
`scanProperties`	object	Yes	How it was found.
`tags`	list of integer	No	Tag identifiers applied to this material.
`refID`	list of string	No	`discoverID` values of related documents.

Timestamps are stored in UTC and localised only for display.

Key documents

Required: discoverID, discoverTime, type, keyType, state, algorithm, securedBy, sourceProperties, scanProperties.

Field	Type	Meaning
`keyType`	enum	`secret_key`, `private_key`, `public_key`
`algorithm`	string	Bare primitive family: `AES`, `RSA`, `ECDSA`, `ML-KEM`. Never carries a size, mode or padding.
`algorithmRef`	string	Compound reference, slash-joined: `AES/256`, `RSA/2048`, `ECDSA/secp256r1/256`. This is the value policy and scoring resolve against.
`size`	integer or null	Key size in bits. Null when the source API does not report it — common for post-quantum and opaque cloud keys.
`state`	enum	`PreActivation`, `Active`, `Suspended`, `Deactivated`, `Compromised`, `Destroyed`, `Unknown`
`securedBy`	string	How the key is protected: `HSM`, `TPM`, `Software`, `SGX`, `aws-kms`, `azure-kv`, `gcp-kms`, `None`
`creation_date`	string	Key creation time, where the source reports it.
`activation_date`	string	Key activation time, where the source reports it.
`publicKey`	string	PEM-encoded SubjectPublicKeyInfo, when the public half is available.
`publicKeySha256`	string	Hex SHA-256 of the DER SubjectPublicKeyInfo.

publicKeySha256 is the cross-protocol key identity. It is what lets a certificate discovered in one place be matched to its private key discovered in another, and it is the field key-reuse detection groups on. Two unrelated keys that both stored an empty or absent value here would be read as the same key, which is why a key whose hash cannot be computed is skipped at ingestion rather than stored with a blank one.

Certificate documents

Required: discoverID, discoverTime, type, algorithm, sourceProperties, scanProperties.

Field	Type	Meaning
`subject`	string	Certificate subject distinguished name.
`issuer`	string	Issuer distinguished name.
`validFrom`	string	Start of the validity window.
`validTo`	string	End of the validity window. This drives every expiry report.
`algorithm`	string	Signature or key algorithm family.
`algorithmRef`	string	Compound algorithm reference.
`size`	integer	Key size in bits.
`serialNumber`	string	Certificate serial number.
`keyUsage`	integer	Key-usage bit field.
`certificationLevel`	array	Chain position and related classification.
`publicKeySha256`	string	Hash of the certificate's public key — the join to a key document.
`certSha256`	string	Hash of the certificate itself — the certificate's own identity.

Protocol documents

Two shapes, distinguished by subType.

TLS — subType is absent. Required: discoverID, discoverTime, type, cipherSuites, sourceProperties, scanProperties.

Field	Type	Meaning
`cipherSuites`	array	Cipher suites advertised or negotiated by the endpoint.

SSH — subType is ssh. Required: discoverID, discoverTime, type, subType, sshCipherSuite, sourceProperties, scanProperties.

Field	Type	Meaning
`sshCipherSuite`	object	Key-exchange, host-key, cipher and MAC algorithm lists from the handshake, plus optional session properties.

Querying for TLS means subType != ssh, not subType == tls. TLS documents carry no subType at all.

Binary documents

Required: discoverID, discoverTime, type, family, sourceProperties, scanProperties.

Field	Type	Meaning
`family`	string	Binary format family.
`subType`	enum	`app`, `lib`, `static`, `firmware`, `driver`, `jvm`, `dotnet`
`properties.codeSignature`	object	Signature state.

codeSignature is three-state, not a boolean. A signer with an empty error means signed and verified; no signer means unsigned; a signer with an error means a signature that is present and did not verify. Reading it as a boolean misfiles the third case, which is the one that matters.

Signature documents

Required: discoverID, discoverTime, type, algorithmRef, algorithm, verificationStatus, sourceProperties, scanProperties, refID, contentHash.

Field	Type	Meaning
`verificationStatus`	string	Outcome of signature verification.
`contentHash`	string	Hash of the signed content.
`refID`	array	The binary or file documents this signature covers.

Source-code documents

Required: type, subType. Three sub-kinds work together:

`subType`	Holds
`file`	One scanned source file and every cryptographic finding in it.
`callgraph`	The call relationships for one scan, used to build export dependencies.
`summary`	Aggregate counts for one scan.

Each finding in a file document carries the crypto parameters resolved at one call site:

Field	Type	Meaning
`algorithm`	string	Bare primitive family, same contract as every other document type.
`algorithmRef`	string	Compound reference. Absent when no algorithm was resolved.
`algorithmExpression`	string	The raw source expression naming the algorithm, where it could not be resolved statically — for example `get_cipher_fce()`.
`algorithmResolution`	enum	How the algorithm was determined: `literal`, `named-constant`, `field-access`, `expression`, `variable`, `unresolved`, `propagated`, and others.
`primitiveKind`	string	The kind of construction when a call names something that is not an algorithm — `OS-CSPRNG`, `TLS`, `X.509`, `JWT`, `AEAD`, `KeyStore`.

algorithmExpression and primitiveKind are not algorithm identities. Neither is resolved against the ranking tables and neither is ever allowed by a policy. They are retained because they are informative, but a query that treats them as algorithms will chart them as their own bars and inflate every distinct-algorithm count.

`sourceProperties`

Where the material was found. Which fields are present depends on the sensor class.

Field	Type	Present for
`host`	string	Agent-based sensors. Cloud sensors use `region` and `resourceId` instead.
`port`	integer	Network sensors — SSH, TLS, HTTPS.
`path`	string	Filesystem and keystore sensors.
`origin`	string	Source-code sensors: the repository.
`region`	string	Cloud sensors.
`resourceId`	string	Cloud sensors: the resource ARN or URI.
`banner`	string	SSH: the raw server banner.
`software`	string	SSH: parsed server software name.
`softwareVersion`	string	SSH: server software version.
`protocolVersion`	string	SSH: protocol version from the banner.

For a source-code scan, sourceProperties.host is the repository, not the machine that ran the scan. The scanning machine is scanProperties.scanHost.

`scanProperties`

Field	Type	Meaning
`extension`	string	The sensor that produced the document.
`config`	string	The named configuration or scan label.
`scanTime`	string	When the scan ran.
`scanHost`	string	The host that ran the scan. Omitted for cloud sensors, which run centrally.
`tags`	list of integer	Tags carried from the agent's configuration.

Inventory record fields

The fields below exist on the stored inventory record rather than on sensor output. They are added by the platform during deduplication and analysis.

Field	Meaning
`canonicalID`	The deduplication identity. Every sighting of one real-world object carries the same value, and that is what makes them one record.
`deployments`	Every distinct place the material has been seen, each with its own first-seen and last-seen time.
`tags`	The union of the host and task tags across the material's footprint.
`historyVersion`	Incremented each time a change entry is appended.
`lastSeenTime`	The most recent sighting across all deployments.
`status`	Whether the material is currently present, or has been resolved by a full scan that did not find it.

Collections

Collection	Holds
`CryptoMaterial`	The consolidated inventory — one record per canonical identity.
`CMDeposit`	Raw sensor output awaiting deduplication. Transient.
`CMCollectRuns`	One record per ingestion call, with requested, inserted, updated and skipped counts.
`CMHistories`	Append-only change history. Held in the audit database.
`AuditLog`	Append-only record of operator actions. Held in the audit database.
`CMTags`	Tag definitions, keyed by `tagId`.
`CMTagScopes`	Named, reusable tag expressions.
`HostsInfo`	Target hosts, their credentials (encrypted) and their submission certificates.
`TaskDeployment`	Discovery tasks.
`AnalyticRules`	Scoring rules, the algorithm ranking tables and policies.
`SensorSchema`	Registered sensor configuration schemas.

tagId names one tag definition; every reference to tags is a list called tags. The definition in CMTags is keyed tagId; hosts, tasks, materials, history states and rule scopes all reference them through a tags list of integers.

CBOM Secure

Data Model Reference