Tables

A table is where rows are stored and what VFQL queries read. A table holds a storage schema: each column's name, type, whether it may be null, and an optional description. It does not know how to parse logs. That is the job of the sources attached to it.

How tables are filled

Every table has a population, shown in the All Populations filter on the Tables page:

• Source: filled by attached sources. This page is mostly about these.
• Rule: filled by a detection rule. Shown with a Derived badge. Created from the rules pages.
• Query: a saved query. Shown with a View badge. Created from the query page.

Only source-populated tables accept sources. One table can have many sources attached. Each source writes into it independently.

Kinds: event and lookup

• Event tables are append-only. This is the kind the app creates.
• Lookup tables are versioned. Each full-replace load is a new version. A lookup table's page has a Versions section that lists each version with its commit time and row count. Query as of opens a query pinned to that version. In VFQL you pin a version with asof:

Assets | asof datetime(2026-09-01) | take 10

Browse tables

Open Tables in the sidebar. The page shows Total Tables, Total Rows, Total Size and System Tables. Search by name or description, and filter by population, owner team (All Owners) and kind (All Kinds).

Click a table to open its page:

• Columns, Rows, Size and Last Ingested.
• Schema: every column with its type, Nullable and description.
• Sources: the sources attached to this table, and an Attach existing source control for detached sources.
• Sample Query: a VFQL query to start from.
• Advisories, when Vigilfield has a warning about the table.
• Export and access information.

The sample query on every table page has this shape:

cloudtrail | take 100

System columns

Every table has two columns that Vigilfield adds and manages. They carry a System badge:

• vf_event_timestamp: the event time taken from the source data.
• vf_ingestion_timestamp: when Vigilfield ingested the row.

You can use them in queries like any other column:

cloudtrail | where vf_ingestion_timestamp > ago(1h) | summarize count()

System tables

Tables with a System badge are owned by Vigilfield. Only admins can see them, and they are read-only: they have no Edit or Delete buttons.

Create a table

Most tables are created by the source wizard: on its Destination step, choose Create a new table. The new table's schema matches the source, and the source is attached in the same step. This is the recommended path.

You can also create an empty table first and attach sources to it later:

1. On Tables, click New Table.
2. Tick Create the table now and configure its source later.
3. Table Info: enter a Table Name and an optional Description.
4. Schema: add the columns. Types are STRING, BIGINT, DOUBLE, BOOLEAN, TIMESTAMP, ARRAY and MAP.
5. On Review, click Create Table.
6. Create a source with Attach to an existing table, or attach a detached source from the table's Sources section.

API: create a table.

Naming rules

• The app requires lowercase letters, digits and underscores, starting with a letter. For example cloudtrail_prod.
• Names are unique within your organization, ignoring case.
• Names starting with vf_ are reserved for Vigilfield.
• Column names starting with __vf_ are reserved for Vigilfield.

Schema compatibility

Every time a source is attached, a source's columns change, or a table's columns change, Vigilfield checks that the table can store what each attached source produces. The rules:

• The table must be source-populated.
• For every column the source and the table share, the types must match exactly, or the table column must be json, which can store any value. There is no automatic widening or casting. Cast in the source's extraction expression instead.
• A required (non-nullable) table column must be produced by the source, the source field must be non-nullable, and the source must not use the Nullify extraction-failure setting.
• A table column the source does not produce is fine if it is nullable. It is written as null.
• A source field the table has no column for is allowed. The attach succeeds with a warning, and the field is dropped on ingest unless you click Add columns to table.

When the check fails, the app lists every violation with a suggested fix.

Edit a table

Click Edit on the table page or the pencil on the list.

• You can change the Description.
• The Table Name cannot be changed here.
• Existing columns are locked. You can only append new columns.

If the change would break a source attached to the table, it is refused with a message that names the source and the problem.

API: update a table.

Delete a table

Click Delete and confirm. All data in the table is permanently deleted. This cannot be undone. The table stops being queryable at once. Its stored files are removed in the background afterwards.

API: delete a table.