Han Fang

tables:
  redb_basic_properties:
    columns:
      - sha256
      - md5
      - sha1
      - parent_sha256
      - child_sha256
      - child_architecture
      - child_filetype
      - filesize
      - file_entropy
      - filetype
      - filetype_mime
      - filetype_magika
      - is_fat
      - first_seen
    column_types:
      sha256: String
      md5: String
      sha1: String
      parent_sha256: String
      child_sha256: Array(String)
      child_architecture: Array(String)
      child_filetype: Array(String)
      filesize: UInt64
      file_entropy: Float64
      filetype: String
      filetype_mime: String
      filetype_magika: String
      is_fat: Bool
      first_seen: DateTime64(3, 'UTC')
    search_fields:
      - parent_sha256
      - child_sha256
      - filesize
      - file_entropy
      - filetype
      - filetype_mime
      - filetype_magika
      - is_fat
      - first_seen

  redb_hashes:
    columns:
      - sha256
      - md5
      - sha1
      - ssdeep_hash
      - tlsh_hash
      - authentihash
      - imphash
      - impfuzzy
      - typerefhash
      - richhash
      - richpe_hash
      - richpv_hash
      - richpv_hash_sorted
      - import_hash
      - export_hash
      - section_hash
      - symbol_hash
      - dynamic_hash
      - macho_dylib_hash
      - macho_import_hash
      - macho_export_hash
      - macho_entitlement_hash
      - macho_symhash
      - permhash
    column_types:
      sha256: String
      md5: String
      sha1: String
      ssdeep_hash: String
      tlsh_hash: String
      authentihash: String
      imphash: String
      impfuzzy: String
      typerefhash: String
      richhash: String
      richpe_hash: String
      richpv_hash: String
      richpv_hash_sorted: String
      import_hash: String
      export_hash: String
      section_hash: String
      symbol_hash: String
      dynamic_hash: String
      macho_dylib_hash: String
      macho_import_hash: String
      macho_export_hash: String
      macho_entitlement_hash: String
      macho_symhash: String
      permhash: String
    search_fields:
      - ssdeep_hash
      - tlsh_hash
      - authentihash
      - imphash
      - impfuzzy
      - typerefhash
      - richhash
      - richpe_hash
      - richpv_hash
      - richpv_hash_sorted
      - import_hash
      - export_hash
      - section_hash
      - symbol_hash
      - dynamic_hash
      - macho_dylib_hash
      - macho_import_hash
      - macho_export_hash
      - macho_entitlement_hash
      - macho_symhash
      - permhash
      
  redb_capa:
    columns:
      - sha256
      - md5
      - sha1
      - capa_dump
      - attack_dump
      - mbc_dump
    column_types:
      sha256: String
      md5: String
      sha1: String
      capa_dump: JSON
      attack_dump: JSON
      mbc_dump: JSON

  redb_capa_capabilities:
    columns:
      - sha256
      - md5
      - sha1
      - namespace
      - capability
    column_types:
      sha256: String
      md5: String
      sha1: String
      namespace: String
      capability: String
    search_fields:
      - namespace
      - capability

  redb_capa_attack:
    columns:
      - sha256
      - md5
      - sha1
      - tactic
      - technique
      - technique_id
    column_types:
      sha256: String
      md5: String
      sha1: String
      tactic: String
      technique: String
      technique_id: String
    search_fields:
      - tactic
      - technique
      - technique_id

  redb_capa_mbc:
    columns:
      - sha256
      - md5
      - sha1
      - objective
      - behavior
      - behavior_id
    column_types:
      sha256: String
      md5: String
      sha1: String
      objective: String
      behavior: String
      behavior_id: String
    search_fields:
      - objective
      - behavior
      - behavior_id

  redb_malcontent:
    columns:
      - sha256
      - analysis_date
      - malcontent_version
      - malcontent_risk_score
      - malcontent_risk_level
      - malcontent_json
    column_types:
      sha256: String
      analysis_date: DateTime64(3, 'UTC')
      malcontent_version: LowCardinality(String)
      malcontent_risk_score: UInt8
      malcontent_risk_level: LowCardinality(String)
      malcontent_json: JSON

  redb_malcontent_behaviors_mv:
    columns:
      - sha256
      - analysis_date
      - malcontent_version
      - malcontent_risk_score
      - malcontent_risk_level
      - malcontent_behavior_id
      - malcontent_rule_name
      - malcontent_description
      - malcontent_behavior_risk_score
      - malcontent_behavior_risk_level
      - malcontent_rule_url
      - malcontent_match_strings
    column_types:
      sha256: String
      analysis_date: DateTime64(3, 'UTC')
      malcontent_version: LowCardinality(String)
      malcontent_risk_score: UInt8
      malcontent_risk_level: LowCardinality(String)
      malcontent_behavior_id: String
      malcontent_rule_name: String
      malcontent_description: String
      malcontent_behavior_risk_score: UInt8
      malcontent_behavior_risk_level: LowCardinality(String)
      malcontent_rule_url: String
      malcontent_match_strings: Array(String)
    search_fields:
      - malcontent_behavior_id
      - malcontent_rule_name
      - malcontent_description
      - malcontent_behavior_risk_score
      - malcontent_behavior_risk_level
      - malcontent_risk_score
      - malcontent_risk_level

  redb_malcontent_behavior_categories_mv:
    columns:
      - malcontent_behavior_category
      - malcontent_rule_name
      - malcontent_behavior_risk_level
      - sample_count
    column_types:
      malcontent_behavior_category: String
      malcontent_rule_name: String
      malcontent_behavior_risk_level: LowCardinality(String)
      sample_count: UInt64
    search_fields:
      - malcontent_behavior_category
      - malcontent_rule_name
      - malcontent_behavior_risk_level

  redb_die:
    columns:
      - sha256
      - md5
      - sha1
      - die_info
    column_types:
      sha256: String
      md5: String
      sha1: String
      die_info: JSON

  redb_die_mv:
    columns:
      - sha256
      - md5
      - sha1
      - compiler
      - compiler_full
      - format
      - format_full
      - installer
      - installer_full
      - joiner
      - joiner_full
      - language
      - language_full
      - library
      - library_full
      - linker
      - linker_full
      - operation_system
      - operation_system_full
      - packer
      - packer_full
      - protector
      - protector_full
      - sfx
      - sfx_full
      - sign_tool
      - sign_tool_full
      - stub
      - stub_full
      - tool
      - tool_full
      # - has_overlay
      # - has_resources
      - is_packed
    column_types:
      sha256: String
      md5: String
      sha1: String
      compiler: String
      compiler_full: String
      format: String
      format_full: String
      installer: String
      installer_full: String
      joiner: String
      joiner_full: String
      language: String
      language_full: String
      library: String
      library_full: String
      linker: String
      linker_full: String
      operation_system: String
      operation_system_full: String
      packer: String
      packer_full: String
      protector: String
      protector_full: String
      sfx: String
      sfx_full: String
      sign_tool: String
      sign_tool_full: String
      stub: String
      stub_full: String
      tool: String
      tool_full: String
      # has_overlay: Bool
      # has_resources: Bool
      is_packed: Bool
    search_fields:
      - compiler
      - compiler_full
      - format
      - format_full
      - installer
      - installer_full
      - joiner
      - joiner_full
      - language
      - language_full
      - library
      - library_full
      - linker
      - linker_full
      - operation_system
      - operation_system_full
      - packer
      - packer_full
      - protector
      - protector_full
      - sfx
      - sfx_full
      - sign_tool
      - sign_tool_full
      - stub
      - stub_full
      - tool
      - tool_full
      - is_packed

  redb_pe_features:
    columns:
      - sha256
      - md5
      - sha1
      - dos_header
      # - dos_header_raw
      - nt_header
      # - nt_header_raw
      - optional_header
      # - optional_header_raw
      - file_header
      # - file_header_raw
      - magic_raw
      - magic_hex
      - entry_point
      - entry_point_hex
      - major_linker_version
      - minor_linker_version
      - target_machine
      - architecture
      - compilation_time
      - compilation_time_utc
      - is_dotnet
      - is_signed
      - has_overlay
      - number_of_sections
      - number_of_imports
      - number_of_exports
      - number_of_resources
      - type
      - dbg_struct
      # - dbg_struct_raw
      - dbg_timestamp
      - dbg_timestamp_utc
      - dbg_pdb_info
      - dbg_pdb_info_raw
      - tls_struct
      # - tls_struct_raw
      - export_timestamp
      - export_timestamp_utc
      - export_library_name
      - export_library_name_raw
      - rich_header_dump
      - rich_header_parsed
      - version_info
      # - version_info_raw
      - export_symbols_list
      - tls_callbacks
      - tls_callbacks_hex
    column_types:
      sha256: String
      md5: String
      sha1: String
      dos_header: String
      nt_header: String
      optional_header: String
      file_header: String
      magic_raw: UInt16
      magic_hex: String
      entry_point: UInt32
      entry_point_hex: String
      major_linker_version: UInt8
      minor_linker_version: UInt8
      target_machine: String
      architecture: Enum8('x86' = 1, 'Itanium' = 2, 'x64' = 3)
      compilation_time: UInt64
      compilation_time_utc: DateTime
      is_dotnet: Bool
      is_signed: Bool
      has_overlay: Bool
      number_of_sections: UInt16
      number_of_imports: UInt16
      number_of_exports: UInt16
      number_of_resources: UInt16
      type: Enum8('DLL' = 1, 'EXE' = 2, 'DRIVER' = 3)
      dbg_struct: String
      dbg_timestamp: UInt64
      dbg_timestamp_utc: DateTime
      dbg_pdb_info: String
      dbg_pdb_info_raw: String
      tls_struct: String
      export_timestamp: UInt64
      export_timestamp_utc: DateTime
      export_library_name: String
      export_library_name_raw: String
      rich_header_dump: JSON
      rich_header_parsed: Array(String)
      version_info: Array(String)
      export_symbols_list: Array(String)
      tls_callbacks: Array(UInt64)
      tls_callbacks_hex: Array(String)
    search_fields:
      - dos_header
      # - dos_header_raw
      - nt_header
      # - nt_header_raw
      - optional_header
      # - optional_header_raw
      - file_header
      # - file_header_raw
      - magic_raw
      - magic_hex
      - entry_point
      - entry_point_hex
      - major_linker_version
      - minor_linker_version
      - target_machine
      - architecture
      - compilation_time
      - compilation_time_utc
      - is_dotnet
      - is_signed
      - has_overlay
      - number_of_sections
      - number_of_imports
      - number_of_exports
      - number_of_resources
      - type
      - dbg_struct
      # - dbg_struct_raw
      - dbg_timestamp
      - dbg_timestamp_utc
      - dbg_pdb_info
      - dbg_pdb_info_raw
      - tls_struct
      # - tls_struct_raw
      - export_timestamp
      - export_timestamp_utc
      - export_library_name
      - export_library_name_raw
      - rich_header_dump
      - rich_header_parsed
      - version_info
      # - version_info_raw
      - export_symbols_list
      - tls_callbacks
      - tls_callbacks_hex

  redb_pe_imports:
    columns:
      - sha256
      - md5
      - sha1
      - library_name
      - function_name
    column_types:
      sha256: String
      md5: String
      sha1: String
      library_name: String
      function_name: String
    search_fields:
      - library_name
      - function_name

  redb_pe_sections:
    columns:
      - sha256
      - md5
      - sha1
      - section_name
      - section_name_b64
      - section_entropy
      - section_sha256
      - section_md5
      - section_size
      - section_v_addr
      - section_v_addr_hex
      - section_v_size
      - section_pointer_to_raw_data
      - section_pointer_to_raw_data_hex
    column_types:
      sha256: String
      md5: String
      sha1: String
      section_name: String
      section_name_b64: String
      section_entropy: Float64
      section_sha256: String
      section_md5: String
      section_size: UInt64
      section_v_addr: UInt64
      section_v_addr_hex: String
      section_v_size: UInt64
      section_pointer_to_raw_data: UInt64
      section_pointer_to_raw_data_hex: String
    search_fields:
      - section_name
      - section_name_b64
      - section_entropy
      - section_sha256
      - section_md5
      - section_size
      - section_v_addr
      - section_v_addr_hex
      - section_v_size
      - section_pointer_to_raw_data
      - section_pointer_to_raw_data_hex

  redb_pe_resources:
    columns:
      - sha256
      - md5
      - sha1
      - resource_type
      - resource_entropy
      - resource_sha256
      - resource_filetype
      - resource_magika
      - resource_language
      - resource_sub_lang
      - resource_size
      - resource_rva
    column_types:
      sha256: String
      md5: String
      sha1: String
      resource_type: String
      resource_entropy: Float64
      resource_sha256: String
      resource_filetype: String
      resource_magika: String
      resource_language: String
      resource_sub_lang: String
      resource_size: UInt64
      resource_rva: UInt64
    search_fields:
      - resource_type
      - resource_entropy
      - resource_sha256
      - resource_filetype
      - resource_magika
      - resource_language
      - resource_sub_lang
      - resource_size
      - resource_rva

  redb_pe_overlays:
    columns:
      - sha256
      - md5
      - sha1
      - overlay_size
      - overlay_entropy
      - overlay_offset
      - overlay_mimetype
      - overlay_type
      - overlay_magika
      - overlay_sha256
      - overlay_sha1
      - overlay_md5
    column_types:
      sha256: String
      md5: String
      sha1: String
      overlay_size: UInt64
      overlay_entropy: Float64
      overlay_offset: UInt64
      overlay_mimetype: String
      overlay_type: String
      overlay_magika: String
      overlay_sha256: String
      overlay_sha1: String
      overlay_md5: String
    search_fields:
      - overlay_size
      - overlay_entropy
      - overlay_offset
      - overlay_mimetype
      - overlay_type
      - overlay_magika
      - overlay_sha256
      - overlay_sha1
      - overlay_md5

  redb_pe_signatures:
    columns:
      - sha256
      - md5
      - sha1
      - signature_verified
      - date_signed
      - number_of_certificates
      - spcSpOpusInfo_program_name
      - spcSpOpusInfo_more_info
    column_types:
      sha256: String
      md5: String
      sha1: String
      signature_verified: Bool
      date_signed: DateTime64
      number_of_certificates: UInt8
      spcSpOpusInfo_program_name: String
      spcSpOpusInfo_more_info: String
    search_fields:
      - signature_verified
      - date_signed
      - number_of_certificates
      - spcSpOpusInfo_program_name
      - spcSpOpusInfo_more_info

  redb_pe_certificates:
    columns:
      - sha256
      - md5
      - sha1
      - certificate_type
      - certificate_algorithm
      - certificate_issuer
      - certificate_subject
      - certificate_serial_number
      - certificate_serial_formatted
      - certificate_thumbprint
      - certificate_valid_from
      - certificate_valid_to
    column_types:
      sha256: String
      md5: String
      sha1: String
      certificate_type: Enum8('signer' = 1, 'countersigner' = 2, 'chain' = 3)
      certificate_algorithm: String
      certificate_issuer: String
      certificate_subject: String
      certificate_serial_number: String
      certificate_serial_formatted: String
      certificate_thumbprint: String
      certificate_valid_from: DateTime64
      certificate_valid_to: DateTime64
    search_fields:
      - certificate_type
      - certificate_algorithm
      - certificate_issuer
      - certificate_subject
      - certificate_serial_number
      - certificate_serial_formatted
      - certificate_thumbprint
      - certificate_valid_from
      - certificate_valid_to

  redb_pe_dotnet:
    columns:
      - sha256
      - md5
      - sha1
      - dotnet
      - dotnet_str
    column_types:
      sha256: String
      md5: String
      sha1: String
      dotnet: JSON
      dotnet_str: String
    search_fields:
      - dotnet

  redb_pe_inconsistency_tests:
    columns:
      - sha256
      - md5
      - sha1
      - test_rich_header_checksum
      - test_rich_header_duplicate
      - test_rich_header_linker
      - test_rich_header_import_count
      - test_dotnet_data_dir_hidden
      - test_dotnet_extra_data
      - test_dotnet_fake_types
      - test_dotnet_invalid_type_ref
      - test_dotnet_fake_datastreams
      - test_dotnet_extra_module_table
      - test_dotnet_extra_assembly_table
      - test_dotnet_invalid_strings_stream
      - test_dotnet_streams_mixed_case
      - test_dotnet_method_def_invalid_table
      - test_dotnet_max_len_exceeding_strings
    column_types:
      sha256: String
      md5: String
      sha1: String
      test_rich_header_checksum: Bool
      test_rich_header_duplicate: Bool
      test_rich_header_linker: Bool
      test_rich_header_import_count: Bool
      test_dotnet_data_dir_hidden: Bool
      test_dotnet_extra_data: Bool
      test_dotnet_fake_types: Bool
      test_dotnet_invalid_type_ref: Bool
      test_dotnet_fake_datastreams: Bool
      test_dotnet_extra_module_table: Bool
      test_dotnet_extra_assembly_table: Bool
      test_dotnet_invalid_strings_stream: Bool
      test_dotnet_streams_mixed_case: Bool
      test_dotnet_method_def_invalid_table: Bool
      test_dotnet_max_len_exceeding_strings: Bool
    search_fields:
      - test_rich_header_checksum
      - test_rich_header_duplicate
      - test_rich_header_linker
      - test_rich_header_import_count
      - test_dotnet_data_dir_hidden
      - test_dotnet_extra_data
      - test_dotnet_fake_types
      - test_dotnet_invalid_type_ref
      - test_dotnet_fake_datastreams
      - test_dotnet_extra_module_table
      - test_dotnet_extra_assembly_table
      - test_dotnet_invalid_strings_stream
      - test_dotnet_streams_mixed_case
      - test_dotnet_method_def_invalid_table
      - test_dotnet_max_len_exceeding_strings

  redb_extra_findings:
    columns:
      - sha256
      - md5
      - sha1
      - context
      - finding
    column_types:
      sha256: String
      md5: String
      sha1: String
      context: String
      finding: Array(JSON)
    search_fields:
      - context
      - finding

  # code_binja_decompiled_functions_references:
  #   columns:
  #     - sha256
  #     - md5
  #     - sha1
  #     - decompiled_function_hash
  #     - decompiled_function_name
  #     - decompiled_function_prototype
  #     - decompiled_function_address
  #   column_types:
  #     sha256: String
  #     md5: String
  #     sha1: String
  #     decompiled_function_hash: String
  #     decompiled_function_name: String
  #     decompiled_function_prototype: String
  #     decompiled_function_address: UInt64
  #   search_fields:
  #     - decompiled_function_hash
  #     - decompiled_function_name
  #     - decompiled_function_address

  # code_binja_decompiled_functions_content:
  #   columns:
  #     - decompiled_function_hash
  #     - decompiled_function
  #     - decompiled_function_lower
  #     - function_type
  #   column_types:
  #     decompiled_function_hash: String
  #     decompiled_function: String
  #     decompiled_function_lower: String
  #     function_type: Enum8('USER'=1, 'LIBRARY'=2, 'THUNK'=3, 'EXTERNAL'=4, 'UNKNOWN'=5)
  #   search_fields:
  #     - decompiled_function_hash
  #     - decompiled_function

  # code_binja_disassembled_functions_content:
  #   columns:
  #     - disassembled_function_hash
  #     - disassembled_function
  #     - fully_normalized_disassembly
  #     - api_normalized_disassembly
  #     - category_normalized_disassembly
  #   column_types:
  #     disassembled_function_hash: String
  #     disassembled_function: String
  #     fully_normalized_disassembly: String
  #     api_normalized_disassembly: String
  #     category_normalized_disassembly: String
  #   search_fields:
  #     - disassembled_function_hash
  #     - disassembled_function
  #     - fully_normalized_disassembly
  #     - api_normalized_disassembly
  #     - category_normalized_disassembly

  # code_binja_disassembled_functions_references:
  #   columns:
  #     - sha256
  #     - sha1
  #     - md5
  #     - disassembled_function_hash
  #     - fully_normalized_disassembly_hash
  #     - api_normalized_disassembly_hash
  #     - category_normalized_disassembly_hash
  #     - disassembled_function_name
  #     - disassembled_function_address
  #     - ssdeep_disassembly
  #     - tlsh_disassembly
  #     - ssdeep_fully_normalized
  #     - tlsh_fully_normalized
  #   column_types:
  #     sha256: String
  #     sha1: String
  #     md5: String
  #     disassembled_function_hash: String
  #     fully_normalized_disassembly_hash: String
  #     api_normalized_disassembly_hash: String
  #     category_normalized_disassembly_hash: String
  #     disassembled_function_name: String
  #     disassembled_function_address: UInt64
  #     ssdeep_disassembly: String
  #     tlsh_disassembly: String
  #     ssdeep_fully_normalized: String
  #     tlsh_fully_normalized: String
  #   search_fields:
  #     - disassembled_function_hash
  #     - fully_normalized_disassembly_hash
  #     - api_normalized_disassembly_hash
  #     - category_normalized_disassembly_hash
  #     - disassembled_function_name
  #     - disassembled_function_address
  #     - ssdeep_disassembly
  #     - tlsh_disassembly
  #     - ssdeep_fully_normalized
  #     - tlsh_fully_normalized

  code_binja_decompiled_functions_references:
    columns:
      - sha256
      - md5
      - sha1
      - decompiled_function_hash
      - disassembled_function_hash
      - decompiled_function_name
      - decompiled_function_prototype
      - decompiled_function_address
      - functions_caller
      - functions_call
    column_types:
      sha256: String
      md5: String
      sha1: String
      decompiled_function_hash: String
      disassembled_function_hash: String
      decompiled_function_name: String
      decompiled_function_prototype: String
      decompiled_function_address: UInt64
      functions_caller: Array(String)
      functions_call: Array(String)
    search_fields:
      - decompiled_function_name
      - decompiled_function_address

  code_binja_decompiled_functions_content:
    columns:
      - decompiled_function_hash
      - decompiled_function
      - function_type
      - flattened_score
      - mba_score
    column_types:
      decompiled_function_hash: String
      decompiled_function: String
      function_type: Enum8('USER'=1, 'LIBRARY'=2, 'THUNK'=3, 'EXTERNAL'=4, 'UNKNOWN'=5)
      flattened_score: Float64
      mba_score: Float64
    search_fields:
      - decompiled_function_hash
      - decompiled_function
      - flattened_score
      - mba_score

  code_binja_disassembled_functions_content:
    columns:
      - disassembled_function_hash
      - disassembled_function
      - disassembled_function_no_addresses
      - function_type
      - instructions_count
      - instructions_types
      - control_flow_count
      - memory_access_pattern
      - register_usage
      - data_references_count
      - opcode_frequency_vector
      - api_calls_vector
      - max_block_size
      - num_calls
      - stack_size
      - instruction_type_ratios
      - instruction_embedding
    column_types:
      disassembled_function_hash: String
      disassembled_function: String
      disassembled_function_no_addresses: String
      function_type: Enum8('USER'=1, 'LIBRARY'=2, 'THUNK'=3, 'EXTERNAL'=4, 'UNKNOWN'=5)
      instructions_count: UInt32
      instructions_types: Array(String)
      control_flow_count: UInt32
      memory_access_pattern: Array(String)
      register_usage: Array(String)
      data_references_count: UInt32
      opcode_frequency_vector: Array(Float32)
      api_calls_vector: Array(Float32)
      max_block_size: UInt32
      num_calls: UInt32
      stack_size: Int32
      instruction_type_ratios: Array(Float32)
      instruction_embedding: Array(Float32)
    search_fields:
      - disassembled_function_hash
      - disassembled_function

  code_binja_disassembled_functions_references:
    columns:
      - sha256
      - sha1
      - md5
      - disassembled_function_hash
      - decompiled_function_hash
      - disassembled_function_name
      - disassembled_function_address
      - tlsh_disassembly
      - tlsh_llil
    column_types:
      sha256: String
      sha1: String
      md5: String
      disassembled_function_hash: String
      decompiled_function_hash: String
      disassembled_function_name: String
      disassembled_function_address: UInt64
      tlsh_disassembly: String
      tlsh_llil: String
    search_fields:
      - disassembled_function_name
      - disassembled_function_address
      - tlsh_disassembly
      - tlsh_normalized

  # APK Code Analysis Tables (decompiled Java + smali disassembly)
  code_apk_decompiled_methods_references:
    columns:
      - sha256
      - decompiled_method_hash
      - smali_method_hash
      - decompiled_class_name
      - decompiled_method_name
      - decompiled_method_signature
      - decompiled_method_prototype
      - functions_caller
      - functions_call
      - analysis_date
    column_types:
      sha256: FixedString(64)
      decompiled_method_hash: FixedString(64)
      smali_method_hash: Nullable(FixedString(64))
      decompiled_class_name: LowCardinality(String)
      decompiled_method_name: LowCardinality(String)
      decompiled_method_signature: String
      decompiled_method_prototype: String
      functions_caller: Array(String)
      functions_call: Array(String)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - decompiled_class_name
      - decompiled_method_name
      - decompiled_method_prototype

  code_apk_decompiled_methods_content:
    columns:
      - decompiled_method_hash
      - decompiled_method
      - decompiled_method_type
      - decompiled_has_string_encryption
      - decompiled_has_reflection_calls
      - decompiled_excessive_goto_count
      - analysis_date
    column_types:
      decompiled_method_hash: FixedString(64)
      decompiled_method: String
      decompiled_method_type: Enum8('USER'=1, 'LIBRARY'=2, 'UNKNOWN'=5)
      decompiled_has_string_encryption: UInt8
      decompiled_has_reflection_calls: UInt8
      decompiled_excessive_goto_count: UInt8
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - decompiled_method_hash
      - decompiled_method
      - decompiled_method_type

  code_apk_smali_methods_references:
    columns:
      - sha256
      - smali_method_hash
      - decompiled_method_hash
      - smali_class_name
      - smali_method_name
      - smali_method_signature
      - analysis_date
    column_types:
      sha256: FixedString(64)
      smali_method_hash: FixedString(64)
      decompiled_method_hash: Nullable(FixedString(64))
      smali_class_name: LowCardinality(String)
      smali_method_name: LowCardinality(String)
      smali_method_signature: String
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - smali_class_name
      - smali_method_name

  code_apk_smali_methods_content:
    columns:
      - smali_method_hash
      - smali_method
      - smali_method_type
      - smali_instructions_count
      - smali_register_count
      - smali_has_string_encryption
      - smali_has_reflection_calls
      - smali_excessive_goto_count
      - smali_flattened_score
      - smali_mba_score
      - analysis_date
    column_types:
      smali_method_hash: FixedString(64)
      smali_method: String
      smali_method_type: Enum8('USER'=1, 'LIBRARY'=2, 'UNKNOWN'=5)
      smali_instructions_count: UInt32
      smali_register_count: UInt16
      smali_has_string_encryption: UInt8
      smali_has_reflection_calls: UInt8
      smali_excessive_goto_count: UInt8
      smali_flattened_score: Float64
      smali_mba_score: Float64
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - smali_method_hash
      - smali_method
      - smali_method_type
      - smali_instructions_count
      - smali_flattened_score
      - smali_mba_score

  code_apk_method_similarity_metrics:
    columns:
      - smali_method_hash
      - ssdeep_smali
      - tlsh_smali
      - ssdeep_smali_normalized
      - tlsh_smali_normalized
      - minhash
      - analysis_date
    column_types:
      smali_method_hash: FixedString(64)
      ssdeep_smali: Nullable(String)
      tlsh_smali: Nullable(FixedString(72))
      ssdeep_smali_normalized: Nullable(String)
      tlsh_smali_normalized: Nullable(FixedString(72))
      minhash: Array(UInt8)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - ssdeep_smali
      - tlsh_smali
      - ssdeep_smali_normalized
      - tlsh_smali_normalized

  code_apk_cfg_methods:
    columns:
      - smali_method_hash
      - cfg_topology_hash
      - block_count
      - edge_count
      - cfg_instructions_count
      - call_count
      - cyclomatic_complexity
      - loop_count
      - max_depth
      - max_fan_out
      - md_index_topdown
      - md_index_bottomup
      - prime_product_smali
      - cfg_feature_tlsh
      - wl_minhash
      - bb_features
      - cfg_adjacency
      - analysis_date
    column_types:
      smali_method_hash: FixedString(64)
      cfg_topology_hash: FixedString(16)
      block_count: UInt16
      edge_count: UInt16
      cfg_instructions_count: UInt32
      call_count: UInt16
      cyclomatic_complexity: UInt16
      loop_count: UInt16
      max_depth: UInt16
      max_fan_out: UInt16
      md_index_topdown: UInt64
      md_index_bottomup: UInt64
      prime_product_smali: UInt64
      cfg_feature_tlsh: Nullable(FixedString(72))
      wl_minhash: Array(UInt8)
      bb_features: Array(Array(UInt16))
      cfg_adjacency: Array(UInt32)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - cfg_topology_hash
      - block_count
      - edge_count
      - cfg_instructions_count
      - cyclomatic_complexity
      - loop_count

  code_apk_analysis_errors:
    columns:
      - sha256
      - class_name
      - method_name
      - error_location
      - error_message
      - error_type
      - error_hash
      - status
      - analysis_date
    column_types:
      sha256: FixedString(64)
      class_name: Nullable(String)
      method_name: Nullable(String)
      error_location: LowCardinality(String)
      error_message: Nullable(String)
      error_type: Nullable(String)
      error_hash: FixedString(32)
      status: Enum8('new'=1, 'investigating'=2, 'fixed'=3, 'wontfix'=4)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - error_location
      - error_type
      - status

  # Strings table for string:"value" search functionality
  code_binja_strings_by_binary:
    columns:
      - sha256
      - string
      - string_raw
      - string_encoding
      - string_offset
      - string_length
      - string_raw_length
      - string_entropy
    column_types:
      sha256: FixedString(64)
      string: String
      string_raw: String
      string_encoding: String
      string_offset: UInt64
      string_length: UInt32
      string_raw_length: UInt32
      string_entropy: Float32
    search_fields:
      - string
      - string_encoding
      - string_length
      - string_entropy

  # Generic text-content table for any text-based artefact (JS today;
  # PowerShell, Python, plain text, email bodies, extracted PDF/Office text in
  # the future). One row per sha256. content_type carries the magika label so
  # callers can filter without joining to redb_basic_properties.
  code_text_content:
    columns:
      - sha256
      - content_type
      - text_raw
      - text_normalized
      - normalizer_used
      - analysis_date
    column_types:
      sha256: FixedString(64)
      content_type: LowCardinality(String)
      text_raw: String CODEC(ZSTD(3))
      text_normalized: Nullable(String) CODEC(ZSTD(3))
      normalizer_used: Nullable(String)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - content_type
      - normalizer_used

  # ELF Binary Tables
  redb_elf_features:
    columns:
      - sha256
      - md5
      - sha1
      - ei_class
      - ei_data
      - ei_version
      - ei_osabi
      - ei_abiversion
      - e_type
      - e_machine
      - e_version
      - e_entry
      - e_flags
      - ei_class_str
      - ei_data_str
      - ei_osabi_str
      - e_type_str
      - e_machine_str
      - is_64bit
      - is_stripped
      - is_pie
      - has_canary
      - has_nx
      - has_relro
      - has_fortify
      - number_of_segments
      - number_of_sections
      - number_of_symbols
      - number_of_dynamic_symbols
      - number_of_relocations
      - number_of_dependencies
      - build_id
      - gnu_hash_present
      - has_debug_info
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      ei_class: UInt8
      ei_data: UInt8
      ei_version: UInt8
      ei_osabi: UInt8
      ei_abiversion: UInt8
      e_type: UInt8
      e_machine: UInt16
      e_version: UInt32
      e_entry: UInt64
      e_flags: UInt32
      ei_class_str: String
      ei_data_str: String
      ei_osabi_str: String
      e_type_str: String
      e_machine_str: String
      is_64bit: UInt8
      is_stripped: UInt8
      is_pie: UInt8
      has_canary: UInt8
      has_nx: UInt8
      has_relro: UInt8
      has_fortify: UInt8
      number_of_segments: UInt16
      number_of_sections: UInt16
      number_of_symbols: UInt32
      number_of_dynamic_symbols: UInt32
      number_of_relocations: UInt32
      number_of_dependencies: UInt16
      build_id: String
      gnu_hash_present: UInt8
      has_debug_info: UInt8
    search_fields:
      - ei_class_str
      - ei_data_str
      - ei_osabi_str
      - e_type_str
      - e_machine_str
      - e_entry
      - is_64bit
      - is_stripped
      - is_pie
      - has_canary
      - has_nx
      - has_relro
      - has_fortify
      - number_of_segments
      - number_of_sections
      - number_of_symbols
      - number_of_dynamic_symbols
      - number_of_relocations
      - number_of_dependencies
      - build_id
      - gnu_hash_present
      - has_debug_info

  redb_elf_segments:
    columns:
      - sha256
      - md5
      - sha1
      - segment_type
      - segment_type_str
      - segment_flags
      - segment_flags_str
      - segment_offset
      - segment_offset_hex
      - segment_vaddr
      - segment_paddr
      - segment_filesz
      - segment_memsz
      - segment_align
      - segment_entropy
      - segment_sha256
      - segment_md5
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      segment_type: UInt8
      segment_type_str: String
      segment_flags: UInt32
      segment_flags_str: Array(String)
      segment_offset: UInt64
      segment_offset_hex: String
      segment_vaddr: UInt64
      segment_paddr: UInt64
      segment_filesz: UInt64
      segment_memsz: UInt64
      segment_align: UInt64
      segment_entropy: Float64
      segment_sha256: FixedString(64)
      segment_md5: FixedString(32)
    search_fields:
      - segment_type_str
      - segment_offset
      - segment_vaddr
      - segment_filesz
      - segment_memsz
      - segment_entropy
      - segment_sha256
      - segment_md5

  redb_elf_sections:
    columns:
      - sha256
      - md5
      - sha1
      - section_name
      - section_type
      - section_type_str
      - section_flags
      - section_flags_str
      - section_addr
      - section_offset
      - section_offset_hex
      - section_size
      - section_link
      - section_info
      - section_addralign
      - section_entsize
      - section_entropy
      - section_sha256
      - section_md5
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      section_name: String
      section_type: UInt8
      section_type_str: String
      section_flags: UInt64
      section_flags_str: Array(String)
      section_addr: UInt64
      section_offset: UInt64
      section_offset_hex: String
      section_size: UInt64
      section_link: UInt32
      section_info: UInt32
      section_addralign: UInt64
      section_entsize: UInt64
      section_entropy: Float64
      section_sha256: FixedString(64)
      section_md5: FixedString(32)
    search_fields:
      - section_name
      - section_type_str
      - section_addr
      - section_offset
      - section_size
      - section_entropy
      - section_sha256
      - section_md5

  redb_elf_dependencies:
    columns:
      - sha256
      - md5
      - sha1
      - dependency_name
      - dependency_type
      - dependency_type_str
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      dependency_name: String
      dependency_type: UInt8
      dependency_type_str: String
    search_fields:
      - dependency_name
      - dependency_type_str

  redb_elf_symbols:
    columns:
      - sha256
      - md5
      - sha1
      - symbol_name
      - symbol_value
      - symbol_size
      - symbol_type
      - symbol_type_str
      - symbol_bind
      - symbol_bind_str
      - symbol_visibility
      - symbol_visibility_str
      - symbol_section_index
      - symbol_section_index_str
      - is_dynamic
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      symbol_name: String
      symbol_value: UInt64
      symbol_size: UInt64
      symbol_type: UInt8
      symbol_type_str: String
      symbol_bind: UInt8
      symbol_bind_str: String
      symbol_visibility: UInt8
      symbol_visibility_str: String
      symbol_section_index: UInt16
      symbol_section_index_str: String
      is_dynamic: UInt8
    search_fields:
      - symbol_name
      - symbol_type_str
      - symbol_bind_str
      - symbol_visibility_str
      - is_dynamic

  redb_elf_imports:
    columns:
      - sha256
      - md5
      - sha1
      - elf_imports_total
      - elf_import_libraries
      - elf_import_functions
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      elf_imports_total: UInt32
      elf_import_libraries: Array(String)
      elf_import_functions: Array(String)
    search_fields:
      - elf_imports_total
      - elf_import_libraries
      - elf_import_functions

  redb_elf_exports:
    columns:
      - sha256
      - md5
      - sha1
      - elf_exports_total
      - elf_export_functions
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      elf_exports_total: UInt32
      elf_export_functions: Array(String)
    search_fields:
      - elf_exports_total
      - elf_export_functions

  redb_elf_relocations:
    columns:
      - sha256
      - md5
      - sha1
      - relocation_offset
      - relocation_offset_hex
      - relocation_type
      - relocation_type_str
      - relocation_symbol_index
      - relocation_symbol_name
      - relocation_addend
      - relocation_section
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      relocation_offset: UInt64
      relocation_offset_hex: String
      relocation_type: UInt32
      relocation_type_str: String
      relocation_symbol_index: UInt32
      relocation_symbol_name: String
      relocation_addend: Int64
      relocation_section: String
    search_fields:
      - relocation_type_str
      - relocation_symbol_name
      - relocation_section

  redb_elf_notes:
    columns:
      - sha256
      - md5
      - sha1
      - note_name
      - note_type
      - note_type_str
      - note_desc
      - note_section
    column_types:
      sha256: FixedString(64)
      md5: FixedString(32)
      sha1: FixedString(40)
      note_name: String
      note_type: UInt32
      note_type_str: String
      note_desc: String
      note_section: String
    search_fields:
      - note_name
      - note_type_str
      - note_section

  # Mach-O Binary Tables
  redb_macho_features:
    columns:
      - sha256
      - architecture
      - magic
      - cputype
      - cpusubtype
      - filetype
      - ncmds
      - sizeofcmds
      - flags
      - magic_str
      - cputype_str
      - cpusubtype_str
      - filetype_str
      - flags_str
      - is_64bit
      - is_signed
      - entry_point
      - uuid
      - version_info
      - version_info_str
      - load_commands_set
      - number_of_segments
      - number_of_dylibs
      - number_of_imports
      - number_of_exports
    column_types:
      sha256: FixedString(64)
      architecture: Nullable(UInt32)
      magic: UInt32
      cputype: UInt32
      cpusubtype: UInt32
      filetype: UInt32
      ncmds: UInt32
      sizeofcmds: UInt32
      flags: UInt32
      magic_str: String
      cputype_str: String
      cpusubtype_str: String
      filetype_str: String
      flags_str: Array(String)
      is_64bit: UInt8
      is_signed: UInt8
      entry_point: Nullable(UInt64)
      uuid: Nullable(String)
      version_info: JSON
      version_info_str: JSON
      load_commands_set: Array(String)
      number_of_segments: UInt32
      number_of_dylibs: UInt32
      number_of_imports: UInt32
      number_of_exports: UInt32
    search_fields:
      - magic_str
      - cputype_str
      - cpusubtype_str
      - filetype_str
      - is_64bit
      - is_signed
      - uuid
      - number_of_segments
      - number_of_dylibs
      - number_of_imports
      - number_of_exports
      - load_commands_set

  redb_macho_signatures:
    columns:
      - sha256
      - signing_type
      - has_signature
      - number_of_certificates
      - cd_identifier
      - cd_team_id
      - cd_flags
      - cd_hash
      - has_hardened_runtime
      - has_library_validation
      - date_signed
    column_types:
      sha256: FixedString(64)
      signing_type: String
      has_signature: UInt8
      number_of_certificates: UInt32
      cd_identifier: Nullable(String)
      cd_team_id: Nullable(String)
      cd_flags: Nullable(UInt32)
      cd_hash: Nullable(String)
      has_hardened_runtime: UInt8
      has_library_validation: UInt8
      date_signed: Nullable(DateTime64)
    search_fields:
      - signing_type
      - has_signature
      - cd_identifier
      - cd_team_id
      - cd_hash
      - has_hardened_runtime
      - has_library_validation
      - date_signed

  redb_macho_certificates:
    columns:
      - sha256
      - certificate_type
      - certificate_algorithm
      - certificate_issuer
      - certificate_subject
      - certificate_serial_number
      - certificate_thumbprint
      - certificate_valid_from
      - certificate_valid_to
    column_types:
      sha256: FixedString(64)
      certificate_type: String
      certificate_algorithm: String
      certificate_issuer: String
      certificate_subject: String
      certificate_serial_number: String
      certificate_thumbprint: FixedString(40)
      certificate_valid_from: DateTime64
      certificate_valid_to: DateTime64
    search_fields:
      - certificate_type
      - certificate_algorithm
      - certificate_issuer
      - certificate_subject
      - certificate_serial_number
      - certificate_thumbprint
      - certificate_valid_from
      - certificate_valid_to

  redb_macho_entitlements:
    columns:
      - sha256
      - entitlement_key
      - entitlement_type
      - value_bool
      - value_string
      - value_array
    column_types:
      sha256: FixedString(64)
      entitlement_key: String
      entitlement_type: String
      value_bool: Nullable(UInt8)
      value_string: Nullable(String)
      value_array: Array(String)
    search_fields:
      - entitlement_key
      - entitlement_type

  redb_macho_segments:
    columns:
      - sha256
      - segment_name
      - segment_vaddr
      - segment_vsize
      - segment_offset
      - segment_size
      - segment_max_vm_protection
      - segment_initial_vm_protection
      - segment_nsects
      - segment_flags
      - segment_entropy
      - segment_sha256
    column_types:
      sha256: FixedString(64)
      segment_name: String
      segment_vaddr: UInt64
      segment_vsize: UInt64
      segment_offset: UInt64
      segment_size: UInt64
      segment_max_vm_protection: UInt32
      segment_initial_vm_protection: UInt32
      segment_nsects: UInt32
      segment_flags: UInt32
      segment_entropy: Float64
      segment_sha256: FixedString(64)
    search_fields:
      - segment_name
      - segment_vaddr
      - segment_size
      - segment_entropy
      - segment_sha256

  redb_macho_dylibs:
    columns:
      - sha256
      - dylib_name
      - dylib_timestamp
      - dylib_current_version
      - dylib_compat_version
    column_types:
      sha256: FixedString(64)
      dylib_name: String
      dylib_timestamp: UInt32
      dylib_current_version: UInt32
      dylib_compat_version: UInt32
    search_fields:
      - dylib_name

  redb_macho_imports:
    columns:
      - sha256
      - library_name
      - function_name
      - import_source
    column_types:
      sha256: FixedString(64)
      library_name: String
      function_name: String
      import_source: Nullable(String)
    search_fields:
      - library_name
      - function_name
      - import_source

  redb_macho_exports:
    columns:
      - sha256
      - macho_exports_total
      - macho_export_symbols
    column_types:
      sha256: FixedString(64)
      macho_exports_total: UInt32
      macho_export_symbols: Array(String)
    search_fields:
      - macho_exports_total
      - macho_export_symbols

  yara_matches:
    columns:
      - sha256
      - rule_id
      - rule_name
      - scan_date
      - match_strings
    column_types:
      sha256: FixedString(32)
      rule_id: UInt64
      rule_name: String
      scan_date: DateTime64
      match_strings: Array(String)
    search_fields:
      - rule_name

  # IOC (Indicators of Compromise) table
  # Extracted from decompiled functions and strings
  # Uses xxHash64 for fast IOC value lookups
  # Note: Only sha256 stored - md5/sha1 lookups handled by search layer translation
  redb_iocs:
    columns:
      - sha256
      - ioc_type
      - ioc_value
      - ioc_hash
      - source_type
      - source_identifier
      - extracted_at
    column_types:
      sha256: FixedString(64)
      ioc_type: Enum8('ipv4'=1, 'ipv6'=2, 'fqdn'=3, 'url'=4, 'email'=5, 'server'=6, 'hash_md5'=10, 'hash_sha1'=11, 'hash_sha256'=12, 'cve'=20, 'cwe'=21, 'cpe'=22, 'crypto_btc'=30, 'crypto_eth'=31, 'crypto_xrp'=32, 'crypto_bch'=33, 'crypto_ada'=34, 'crypto_substrate'=35, 'path_linux'=40, 'path_windows'=41, 'registry_key'=42, 'onion'=50)
      ioc_value: String
      ioc_hash: UInt64
      source_type: Enum8('decompiled_function'=1, 'disassembled_function'=2, 'string'=3, 'text_raw'=4, 'text_normalized'=5)
      source_identifier: String
      extracted_at: DateTime64(3)
    search_fields:
      # IOC type-specific search fields (ioc_ipv4, ioc_url, etc.)
      - ipv4
      - ipv6
      - fqdn
      - url
      - email
      - server
      - hash_md5
      - hash_sha1
      - hash_sha256
      - cve
      - cwe
      - cpe
      - crypto_btc
      - crypto_eth
      - crypto_xrp
      - crypto_bch
      - crypto_ada
      - crypto_substrate
      - path_linux
      - path_windows
      - onion

  redb_apk_features:
    columns:
      - sha256
      - package_name
      - app_name
      - version_code
      - version_name
      - min_sdk_version
      - target_sdk_version
      - compile_sdk_version
      - main_activity
      - is_debuggable
      - allow_backup
      - uses_cleartext_traffic
      - supported_abis
      - dex_count
      - total_dex_size
      - total_file_count
      - has_native_code
      - has_assets
      - uses_libraries
      - earliest_content_modification
      - latest_content_modification
      - contains_embedded_apk
      - analysis_date
    column_types:
      sha256: String
      package_name: Nullable(String)
      app_name: Nullable(String)
      version_code: Nullable(UInt32)
      version_name: Nullable(String)
      min_sdk_version: UInt16
      target_sdk_version: UInt16
      compile_sdk_version: UInt16
      main_activity: String
      is_debuggable: UInt8
      allow_backup: UInt8
      uses_cleartext_traffic: UInt8
      supported_abis: Array(String)
      dex_count: UInt16
      total_dex_size: UInt64
      total_file_count: UInt32
      has_native_code: UInt8
      has_assets: UInt8
      uses_libraries: Array(String)
      earliest_content_modification: String
      latest_content_modification: String
      contains_embedded_apk: UInt8
    search_fields:
      - package_name
      - app_name
      - version_code
      - version_name
      - min_sdk_version
      - target_sdk_version
      - is_debuggable
      - has_native_code
      - contains_embedded_apk

  redb_apk_components:
    columns:
      - sha256
      - component_type
      - class_name
      - is_exported
      - intent_actions
      - intent_categories
      - analysis_date
    column_types:
      sha256: String
      component_type: String
      class_name: String
      is_exported: UInt8
      intent_actions: Array(String)
      intent_categories: Array(String)

  redb_apk_manifest:
    columns:
      - sha256
      - activity_count
      - service_count
      - receiver_count
      - provider_count
      - intent_filters_by_action
      - intent_filters_by_category
      - uses_features
      - manifest_xml
      - analysis_date
    column_types:
      sha256: String
      activity_count: UInt16
      service_count: UInt16
      receiver_count: UInt16
      provider_count: UInt16
      intent_filters_by_action: Array(String)
      intent_filters_by_category: Array(String)
      uses_features: Array(String)
      manifest_xml: String

  redb_apk_permissions:
    columns:
      - sha256
      - permission_name
      - protection_level
      - is_custom
      - analysis_date
    column_types:
      sha256: String
      permission_name: String
      protection_level: String
      is_custom: UInt8
    search_fields:
      - permission_name
      - protection_level
      - is_custom

  redb_apk_signature:
    columns:
      - sha256
      - is_signed
      - signature_scheme_versions
      - number_of_certificates
      - apk_signer_subject
      - apk_signer_issuer
      - analysis_date
    column_types:
      sha256: String
      is_signed: UInt8
      signature_scheme_versions: Array(UInt8)
      number_of_certificates: UInt8
      apk_signer_subject: String
      apk_signer_issuer: String

  redb_apk_certificates:
    columns:
      - sha256
      - certificate_subject
      - certificate_issuer
      - certificate_serial_number
      - certificate_valid_from
      - certificate_valid_to
      - certificate_thumbprint
      - certificate_algorithm
      - key_size
      - is_self_signed
      - certificate_source_scheme
      - analysis_date
    column_types:
      sha256: String
      certificate_subject: String
      certificate_issuer: String
      certificate_serial_number: String
      certificate_valid_from: DateTime64
      certificate_valid_to: DateTime64
      certificate_thumbprint: FixedString(40)
      certificate_algorithm: LowCardinality(String)
      key_size: UInt16
      is_self_signed: UInt8
      certificate_source_scheme: LowCardinality(String)

  redb_apk_dex:
    columns:
      - sha256
      - dex_sha256
      - dex_filename
      - dex_tlsh
      - dex_class_count
      - dex_method_count
      - dex_string_count
      - dex_top_packages
      - dex_obfuscation_indicators
      - analysis_date
    column_types:
      sha256: String
      dex_sha256: String
      dex_filename: String
      dex_tlsh: String
      dex_class_count: UInt32
      dex_method_count: UInt32
      dex_string_count: UInt32
      dex_top_packages: JSON
      dex_obfuscation_indicators: JSON

  redb_apk_dex_api_usage:
    columns:
      - sha256
      - dex_sha256
      - api_category
      - api_calls
      - analysis_date
    column_types:
      sha256: String
      dex_sha256: String
      api_category: String
      api_calls: Array(String)

  redb_apk_resources:
    columns:
      - sha256
      - resource_path
      - resource_size
      - resource_sha256
      - resource_magika
      - resource_entropy
      - is_suspicious
      - analysis_date
    column_types:
      sha256: String
      resource_path: String
      resource_size: UInt64
      resource_sha256: String
      resource_magika: String
      resource_entropy: Float32
      is_suspicious: UInt8
    search_fields:
      - resource_magika
      - resource_entropy
      - is_suspicious

  redb_apk_native_libs:
    columns:
      - sha256
      - lib_abi
      - lib_filename
      - lib_size
      - lib_sha256
      - lib_is_known_packer
      - analysis_date
    column_types:
      sha256: String
      lib_abi: String
      lib_filename: String
      lib_size: UInt64
      lib_sha256: String
      lib_is_known_packer: UInt8
    search_fields:
      - lib_abi
      - lib_filename
      - lib_is_known_packer

  redb_apk_inconsistency_tests:
    columns:
      - sha256
      - test_zip_bomb
      - test_zip_duplicate_entries
      - test_zip_path_traversal
      - test_zip_suspicious_timestamps
      - test_hidden_dex_files
      - test_manifest_component_mismatch
      - test_debuggable_release
      - test_emulator_detection_strings
      - test_debugger_detection
      - test_root_detection
      - analysis_date
    column_types:
      sha256: String
      test_zip_bomb: UInt8
      test_zip_duplicate_entries: UInt8
      test_zip_path_traversal: UInt8
      test_zip_suspicious_timestamps: UInt8
      test_hidden_dex_files: UInt8
      test_manifest_component_mismatch: UInt8
      test_debuggable_release: UInt8
      test_emulator_detection_strings: UInt8
      test_debugger_detection: UInt8
      test_root_detection: UInt8

  # ============================================================================
  # JavaScript Tables
  # ============================================================================

  redb_js_features:
    columns:
      - sha256
      - line_count
      - char_count
      - text_entropy
      - max_line_length
      - avg_line_length
      - is_minified
      - is_likely_obfuscated
      - obfuscator_name
      - obfuscation_score
      - obfuscation_techniques
      - eval_count
      - function_constructor_count
      - settimeout_setinterval_count
      - document_write_count
      - innerhtml_count
      - unescape_count
      - fromcharcode_count
      - atob_count
      - decodeuri_count
      - total_function_count
      - total_variable_count
      - max_nesting_depth
      - avg_identifier_length
      - hex_string_count
      - unicode_escape_count
      - long_string_count
      - base64_string_count
      - comment_ratio
      - script_type
      - detected_environment
      - analysis_date
    column_types:
      sha256: String
      line_count: UInt32
      char_count: UInt64
      text_entropy: Float64
      max_line_length: UInt32
      avg_line_length: Float64
      is_minified: Bool
      is_likely_obfuscated: Bool
      obfuscator_name: LowCardinality(String)
      obfuscation_score: UInt8
      obfuscation_techniques: Array(String)
      eval_count: UInt32
      function_constructor_count: UInt32
      settimeout_setinterval_count: UInt32
      document_write_count: UInt32
      innerhtml_count: UInt32
      unescape_count: UInt32
      fromcharcode_count: UInt32
      atob_count: UInt32
      decodeuri_count: UInt32
      total_function_count: UInt32
      total_variable_count: UInt32
      max_nesting_depth: UInt16
      avg_identifier_length: Float64
      hex_string_count: UInt32
      unicode_escape_count: UInt32
      long_string_count: UInt32
      base64_string_count: UInt32
      comment_ratio: Float64
      script_type: LowCardinality(String)
      detected_environment: LowCardinality(String)
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - text_entropy
      - is_minified
      - is_likely_obfuscated
      - obfuscator_name
      - obfuscation_score
      - eval_count
      - function_constructor_count
      - fromcharcode_count
      - script_type
      - detected_environment

  redb_js_suspicious_apis:
    columns:
      - sha256
      - api_name
      - api_category
      - call_count
      - line_numbers
      - context_snippet
      - analysis_date
    column_types:
      sha256: String
      api_name: String
      api_category: LowCardinality(String)
      call_count: UInt32
      line_numbers: Array(UInt32)
      context_snippet: String
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - api_name
      - api_category
      - call_count

  redb_js_deobfuscation:
    columns:
      - sha256
      - deobfuscator_used
      - deobfuscation_successful
      - original_size
      - deobfuscated_size
      - size_change_ratio
      - original_entropy
      - deobfuscated_entropy
      - new_strings_found
      - new_apis_found
      - deobfuscated_sha256
      - analysis_date
    column_types:
      sha256: String
      deobfuscator_used: LowCardinality(String)
      deobfuscation_successful: UInt8
      original_size: UInt64
      deobfuscated_size: UInt64
      size_change_ratio: Float64
      original_entropy: Float64
      deobfuscated_entropy: Float64
      new_strings_found: UInt32
      new_apis_found: UInt32
      deobfuscated_sha256: String
      analysis_date: DateTime64(3, 'UTC')
    search_fields:
      - deobfuscator_used
      - deobfuscation_successful
      - size_change_ratio
      - new_strings_found
      - new_apis_found