# Pulse Database Skill — Query Reference

> **Purpose:** This document describes the PostgreSQL database behind **Pulse**, an MSP operations platform built by Wulf Consulting. Use it to query Autotask PSA data, RMM alerts, security agents, backup status, IT documentation, engagement metrics, and more.

## Connection

- **Host:** `pulse-postgres` (Docker) or `localhost:5432`
- **Database:** `pulse_autotask`
- **User:** `pulse_user`
- **Read-only queries only** — no INSERT/UPDATE/DELETE

---

## Data Domains at a Glance

| Domain | Key Tables | Approx Rows | Description |
|---|---|---|---|
| **Autotask PSA** | tickets, time_entries, companies, contacts, resources, configuration_items, contracts, projects, tasks, ticket_notes | 109K tickets, 154K time entries, 7K CIs | Service desk, billing, contracts, clients |
| **Datto RMM** | datto_rmm_alerts, datto_rmm_devices, datto_rmm_sites | 4.3K alerts, 3.6K devices | Remote monitoring & management |
| **SentinelOne** | s1_agents, s1_threats, s1_sites | 2.8K agents, 4.1K threats | Endpoint security |
| **Veeam** | veeam_organizations, veeam_backup_jobs, veeam_backup_agents, veeam_alarms, veeam_protected_workloads, veeam_repositories, veeam_backup_servers | ~2.5K total | Backup & disaster recovery |
| **IT Glue** | itg_organizations, itg_configurations, itg_passwords, itg_flexible_assets, itg_contacts, itg_documents, itg_expirations, itg_domains, itg_locations | 14.7K configs, 7.1K contacts | IT documentation |
| **Microsoft 365** | graph_users, teams_meetings, teams_meeting_attendees, engagement_snapshots | 14.3K meetings | Teams meetings, activity reports |
| **Zoom** | zoom_users, zoom_meetings, zoom_meeting_participants, zoom_calls | 2.8K calls, meetings | Zoom calls and meetings |
| **Billing** | billing_items | 95K items | Invoice line items tied to tickets/projects/tasks |

---

## 1. Autotask PSA — Core Service Desk

### tickets (~109K rows, 68 columns)

The central table. Each row is a service ticket.

**Key columns:**
- `id` (bigint PK) — Autotask ticket ID
- `title` (varchar) — ticket subject line
- `description` (text) — full body/description
- `status` (int) — FK to `statuses.value`
- `priority` (int) — FK to `priorities.value`
- `queue_id` (int) — FK to `queues.value`
- `source` (int) — how the ticket was created (see Source Codes below)
- `company_id` (bigint) — FK to `companies.id`
- `contact_id` (bigint) — FK to `contacts.id`
- `assigned_resource_id` (bigint) — FK to `resources.id`
- `configuration_item_id` (bigint) — FK to `configuration_items.id`
- `contract_id` (bigint) — FK to `contracts.id`
- `project_id` (bigint) — FK to `projects.id`
- `issue_type` (int), `sub_issue_type` (int) — classification
- `ticket_type` (int) — 1=Incident, 2=Service Request, 5=Alert
- `create_date` (timestamp) — when opened
- `due_date_time` (timestamp) — SLA due
- `completed_date` (timestamp) — when closed
- `resolved_date_time` (timestamp) — when resolved
- `first_response_date_time` (timestamp) — first response SLA timestamp
- `last_activity_date` (timestamp) — most recent update
- `monitor_id` (bigint) — RMM monitor that created this ticket (if source=8)
- `monitor_type_id` (int) — type of monitor
- `is_deleted` (boolean) — soft delete flag

**Source codes (tickets.source):**
| Value | Meaning | Count |
|---|---|---|
| 8 | Monitoring Alert (RMM/Datto) | 80,736 |
| 4 | Email | 14,872 |
| 21 | Portal | 2,500 |
| 2 | Phone/Voice | 1,781 |
| -1 | Insourced | 1,092 |
| -2 | Outsourced | 1,088 |
| 35 | Phish Alert | 726 |
| 6 | API | 488 |
| 17 | Internal Alert | 453 |

**Ticket types:**
| Value | Meaning | Count |
|---|---|---|
| 1 | Incident | 8,409 |
| 2 | Service Request | 3,217 |
| 5 | Alert | 29,885 |
| NULL | Unclassified | 67,737 |

### companies (~4K rows, 41 columns)

Client/customer organizations.

**Key columns:**
- `id` (bigint PK)
- `company_name` (varchar) — display name
- `company_number` (varchar) — short code
- `is_active` (boolean)
- `company_type` (int) — 1=Customer, 2=Lead, 3=Prospect, 4=Dead, 6=Cancellation, 7=Vendor, etc.
- `owner_resource_id` (bigint) — account manager, FK to `resources.id`
- `classification` (varchar) — e.g. "Platinum", "Gold", etc.
- Address fields: `address1`, `city`, `state`, `postal_code`
- `last_activity_date` (timestamp)

### contacts (~4.2K rows, 37 columns)

People at client companies.

**Key columns:**
- `id` (bigint PK)
- `first_name`, `last_name`, `email_address`, `phone` (varchar)
- `company_id` (bigint) — FK to `companies.id`
- `is_active` (boolean)
- `title` (varchar) — job title

### resources (~40 columns)

Internal staff / technicians.

**Key columns:**
- `id` (bigint PK)
- `first_name`, `last_name`, `email` (varchar)
- `email_address` (varchar) — primary email
- `is_active` (boolean)
- `resource_type` (varchar)
- `default_service_desk_role_id` (bigint)
- `hire_date` (date)
- `location_id` (bigint)

### time_entries (~154K rows, 45 columns)

Work logged against tickets, tasks, or projects.

**Key columns:**
- `id` (bigint PK)
- `resource_id` (bigint) — who did the work, FK to `resources.id`
- `ticket_id` (bigint) — FK to `tickets.id` (NULL if task/project entry)
- `task_id` (bigint) — FK to `tasks.id`
- `project_id` (bigint) — FK to `projects.id`
- `company_id` (bigint) — FK to `companies.id`
- `entry_date` (timestamp) — date of work
- `hours_worked` (numeric) — actual hours
- `hours_to_bill` (numeric) — billable hours
- `start_date_time`, `end_date_time` (timestamp) — clock in/out
- `title` (varchar), `notes` (text), `internal_notes` (text)
- `billable` (boolean), `non_billable` (boolean)
- `billing_rate` (numeric), `cost_rate` (numeric), `revenue` (numeric)
- `contract_id` (bigint), `contract_service_id` (bigint)
- `role_id` (bigint)
- `is_deleted` (boolean)

### ticket_notes (~30K rows, 14 columns)

Notes/comments on tickets.

**Key columns:**
- `id` (bigint PK)
- `ticket_id` (bigint) — FK to `tickets.id`
- `title` (varchar), `description` (text) — note content
- `note_type` (int) — internal, external, etc.
- `publish` (int) — visibility
- `creator_resource_id` (bigint) — who wrote it
- `create_date_time` (timestamptz)

### configuration_items (~7K rows, 95 columns)

Devices/assets tracked in Autotask.

**Key columns:**
- `id` (bigint PK)
- `reference_title` (varchar) — device name (e.g. "DT037", "SRV-DC01")
- `reference_number` (varchar) — often a GUID from RMM
- `serial_number` (varchar)
- `company_id` (bigint) — FK to `companies.id`
- `contact_id` (bigint) — FK to `contacts.id`
- `is_active` (boolean)
- `device_type` (varchar)

**Note:** `reference_title` follows a naming convention per client (e.g. DT037 exists at multiple companies as separate CIs). Always filter by both `reference_title` AND `company_id` when searching.

### contracts (~44 columns)

Service agreements with clients.

**Key columns:**
- `id` (bigint PK)
- `company_id` (bigint) — FK to `companies.id`
- `contract_name` (varchar), `contract_number` (varchar)
- `contract_type` (int), `status` (int)
- `start_date`, `end_date` (date)
- `estimated_hours` (numeric), `estimated_revenue` (numeric)

### contract_services (~8.2K rows)

Line items on contracts.

- `contract_id` → `contracts.id`
- `company_id` → `companies.id`
- `service_name` (text), `unit_price`, `quantity`

### projects (~291 rows, 36 columns)

**Key columns:**
- `id`, `company_id`, `project_name`, `status`, `type`
- `project_lead_resource_id` → `resources.id`
- `start_date_time`, `end_date_time`, `actual_hours`, `estimated_time`

### tasks (~4.3K rows, 34 columns)

Tasks on tickets or projects.

- `ticket_id` → `tickets.id`
- `project_id` → `projects.id`
- `assigned_resource_id` → `resources.id`
- `status`, `priority`, `estimated_hours`, `remaining_hours`

### billing_items (~96K rows)

Invoice line items linked to tickets, tasks, or projects.

- `ticket_id` → `tickets.id`, `task_id` → `tasks.id`, `project_id` → `projects.id`
- `company_id` → `companies.id`
- `quantity`, `rate`, `total_amount`, `unit_cost`, `unit_price`

---

## 2. Lookup / Picklist Tables

These map integer codes to human-readable labels. Join on `value`.

### statuses (ticket statuses)

| Value | Label |
|---|---|
| 1 | New |
| 5 | Complete |
| 7 | Waiting Customer |
| 8 | In Progress |
| 10 | Dispatched |
| 11 | Escalate |
| 12 | Waiting Vendor |
| 13 | Waiting Approval |
| 14 | Resource Assigned |
| 16 | Reopened |
| 19 | End User Note Added |
| 25 | On Hold |
| 48 | Escalate to MC |
| 54 | Resolved \<CSAT Survey\> |
| 57 | Escalate to Wulf |

### priorities

| Value | Label |
|---|---|
| 1 | Standard |
| 2 | Medium |
| 4 | Critical |
| 6 | High |
| 7 | Security Event |
| 8 | Minor Service |
| 9 | Major Service |
| 11 | Fast Track |

### queues (46 active)

Major queues include:
- `29682833` Level 1 Support
- `29682969` Level 2 Support
- `29703428` Level 3 Support
- `29749490` Client Success
- `8` Monitoring Alert
- `29832283` Operations Triage
- `5` Client Triage
- `29853700` Deployment
- `29853698` Project Delivery
- `29853701` IT Operations
- `29853699` Mission Control
- Client-specific queues: TTG, LEC, PER, VCF, Premier Automation, TNT Pizza, Trivium Packaging, Glunt

---

## 3. Datto RMM

### datto_rmm_alerts (~4.3K rows, 61 columns)

- `id` (int PK), `uid` (text) — alert identifiers
- `alert_category`, `alert_type`, `alert_message_en` — what triggered
- `priority` (text) — Critical, High, Moderate, Low, Information
- `resolved` (boolean), `resolved_on` (timestamptz)
- `muted` (boolean)
- `ticket_number` (text) — linked Autotask ticket
- `device_hostname`, `device_ip`, `device_os`, `device_id`
- `site_id` (text) — FK to `datto_rmm_sites`
- `timestamp` (timestamptz) — when alert fired

### datto_rmm_devices (~3.6K rows, 42 columns)

- `id` (int PK), `uid` (text), `hostname`
- `device_type_category` (text) — Server, Desktop, Laptop, Network Device
- `operating_system`, `domain`, `int_ip_address`, `ext_ip_address`
- `online` (boolean), `last_seen` (timestamptz)
- `last_logged_in_user` (text)
- `antivirus_product`, `antivirus_status`, `patch_status`
- `site_id` (int) — FK to `datto_rmm_sites.id`
- `udf` (jsonb) — custom fields

### datto_rmm_sites (~16 columns)

- `id` (int PK), `uid`, `name`
- `autotask_company_id` (int) — **FK to `companies.id`** (links RMM sites to Autotask clients)
- `autotask_company_name`
- `number_of_devices`, `number_of_online_devices`

**Join pattern:** `datto_rmm_sites.autotask_company_id = companies.id`

---

## 4. SentinelOne

### s1_agents (~2.8K rows, 42 columns)

Endpoint security agents.

- `id` (varchar PK) — S1 agent ID
- `computer_name`, `os_name`, `os_type`
- `site_id` → `s1_sites.id`, `site_name`
- `is_active`, `is_decommissioned`
- `infected` (boolean), `active_threats` (int)
- `network_status`, `mitigation_mode`, `detection_state`
- `external_ip`, `last_active_date`, `last_logged_in_user_name`
- `firewall_enabled` (boolean)

### s1_threats (~4.1K rows, 25 columns)

Detected threats.

- `id` (varchar PK)
- `threat_name`, `classification`, `confidence_level`
- `mitigation_status`, `analyst_verdict`, `incident_status`
- `agent_id` → `s1_agents.id`
- `agent_computer_name`, `agent_os_name`
- `site_id` → `s1_sites.id`

### s1_sites (~22 columns)

- `id` (varchar PK), `name`, `account_name`
- `health_status`, `active_licenses`, `total_licenses`

### s1_company_mappings

Maps S1 sites to Autotask companies for cross-referencing.

---

## 5. Veeam Backup

### veeam_organizations (~17 columns)

- `instance_uid` (PK), `name`, `company_id`
- All other Veeam tables FK to `veeam_organizations.instance_uid`

### veeam_backup_jobs (~234 rows)

- `instance_uid`, `name`, `type`, `status`, `last_run`, `next_run`
- `organization_uid` → `veeam_organizations`
- `backup_server_uid` → `veeam_backup_servers`

### veeam_backup_agents (~727 rows)

- Backup agents installed on endpoints
- `organization_uid` → `veeam_organizations`

### veeam_alarms (~581 rows)

- Active alarms/alerts
- `organization_uid` → `veeam_organizations`

### veeam_protected_workloads, veeam_repositories, veeam_backup_servers

Supporting tables for backup infrastructure.

---

## 6. IT Glue Documentation

### itg_organizations (~330 rows)

- `id` (bigint PK), `name`, `short_name`, `organization_type_name`
- `psa_id` (varchar) — Autotask company ID (string). Join: `itg_organizations.psa_id::bigint = companies.id`

### itg_configurations (~14.7K rows)

Hardware/software assets documented in IT Glue.

- `id`, `organization_id` → `itg_organizations.id`
- `name`, `hostname`, `serial_number`, `asset_tag`
- `configuration_type_name`, `configuration_status_name`
- `primary_ip`, `mac_address`, `operating_system`
- `warranty_expires_at`, `installed_at`

### itg_passwords (~17 columns)

- `id`, `organization_id`, `name`, `username`, `password_category_name`
- `url`, `notes`

### itg_flexible_assets (~3.2K rows)

Custom documentation (e.g. Backup configs, Email configs, LAN/VLAN, Voice/PBX).

- `id`, `organization_id`, `flexible_asset_type_id`, `flexible_asset_type_name`
- `traits` (jsonb) — all custom field values

### itg_contacts, itg_documents, itg_expirations, itg_domains, itg_locations

Supporting IT documentation tables.

---

## 7. Engagement & Communications

### graph_users

Microsoft 365 users synced from Azure AD.

- `id` (varchar PK), `display_name`, `email`, `job_title`, `department`
- `account_enabled` (boolean)

### teams_meetings (~14.3K rows)

Teams calendar events / meetings.

- `id` (int PK), `user_email`, `subject`
- `start_time`, `end_time` (timestamptz), `duration_minutes`
- `attendee_count`, `client_attendee_count`, `has_client_attendees` (boolean)

### teams_meeting_attendees (~12.6K rows)

- `meeting_id` → `teams_meetings.id`
- `attendee_email`, `attendee_name`
- `matched_contact_id` → `contacts.id`
- `matched_company_id` → `companies.id`

### engagement_snapshots (~1K rows)

Weekly/monthly aggregates of M365 activity per user.

- `user_email`, `period_type` (D7, D30, D90, D180)
- `teams_chat_messages`, `teams_calls`, `teams_meetings_attended`, `teams_meetings_organized`
- `emails_sent`, `emails_received`, `emails_read`

### zoom_meetings, zoom_meeting_participants

- `host_email`, `topic`, `start_time`, `end_time`, `duration_minutes`
- Participants with `matched_contact_id` → `contacts.id`, `matched_company_id` → `companies.id`
- `is_internal` (boolean) — internal vs external attendee

### zoom_calls (~2.8K rows)

- `resource_email`, `direction` (inbound/outbound), `call_status`
- `other_party_number`, `other_party_name`
- `matched_contact_id`, `matched_company_id`

---

## 8. Common Join Patterns

```sql
-- Ticket with company, resource, and status label
SELECT t.id, t.title, c.company_name, 
       r.first_name || ' ' || r.last_name AS technician,
       s.label AS status_label, p.label AS priority_label
FROM tickets t
LEFT JOIN companies c ON c.id = t.company_id
LEFT JOIN resources r ON r.id = t.assigned_resource_id
LEFT JOIN statuses s ON s.value = t.status
LEFT JOIN priorities p ON p.value = t.priority
WHERE t.is_deleted IS NOT TRUE;

-- Time entries for a ticket
SELECT te.entry_date, te.hours_worked, te.notes,
       r.first_name || ' ' || r.last_name AS technician
FROM time_entries te
JOIN resources r ON r.id = te.resource_id
WHERE te.ticket_id = $1 AND te.is_deleted IS NOT TRUE;

-- RMM device → Autotask company
SELECT d.hostname, d.device_type_category, d.operating_system,
       s.autotask_company_name, d.online, d.last_seen
FROM datto_rmm_devices d
JOIN datto_rmm_sites s ON s.id = d.site_id;

-- Config item lookup (always filter by company too)
SELECT ci.id, ci.reference_title, ci.serial_number, c.company_name
FROM configuration_items ci
JOIN companies c ON c.id = ci.company_id
WHERE ci.reference_title = 'DT037' AND ci.company_id = $1;

-- IT Glue org → Autotask company
SELECT ig.name, ig.id AS itg_org_id, c.id AS autotask_company_id, c.company_name
FROM itg_organizations ig
JOIN companies c ON ig.psa_id::bigint = c.id;

-- Meetings with client attendees
SELECT tm.subject, tm.start_time, tm.duration_minutes,
       tma.attendee_name, c.company_name
FROM teams_meetings tm
JOIN teams_meeting_attendees tma ON tma.meeting_id = tm.id
LEFT JOIN companies c ON c.id = tma.matched_company_id
WHERE tm.has_client_attendees = true;
```

---

## 9. Important Notes

1. **Soft deletes:** Most Autotask tables have `is_deleted` (boolean) and `deleted_at`. Always add `WHERE is_deleted IS NOT TRUE` unless you want deleted records.

2. **Picklist joins:** `status`, `priority`, `queue_id`, `source` on tickets are integer codes. Join to `statuses`, `priorities`, `queues` on `.value` for labels.

3. **Configuration item names are NOT unique globally.** Names like "DT037" are a per-client naming convention. Always pair with `company_id`.

4. **Timestamps:** Most Autotask timestamps are `timestamp without time zone` stored in UTC. Teams/Zoom timestamps are `timestamp with time zone`.

5. **Monitor tickets:** `tickets.source = 8` indicates RMM-generated tickets. `monitor_id` links to the specific Datto RMM monitor. These represent ~74% of all tickets.

6. **Cross-platform linking:**
   - RMM → Autotask: `datto_rmm_sites.autotask_company_id = companies.id`
   - IT Glue → Autotask: `itg_organizations.psa_id::bigint = companies.id`
   - S1 → Autotask: via `s1_company_mappings`
   - Zoom/Teams → Contacts: `matched_contact_id` / `matched_company_id` columns
   - Config Items → RMM: `configuration_items.reference_number` sometimes matches RMM device UIDs

7. **Row counts** (as of March 2026): tickets 109K, time_entries 154K, billing_items 96K, ticket_notes 30K, teams_meetings 14K, itg_configurations 15K, configuration_items 7K, companies 4K, contacts 4.2K, datto_rmm_devices 3.6K, datto_rmm_alerts 4.3K, s1_agents 2.8K, s1_threats 4.1K, zoom_calls 2.8K.