---
title: "Report datasets"
description: "Every dataset a report can read in the Outpost console, what each one contains, the permission it needs, its row limit, and the plans that offer it."
url: "https://support.outpostplatform.com/reports/datasets/"
product: "depot"
type: "reference"
status: "draft"
ai_summary: "Every Outpost report dataset with its contents, permission, and row limit. Per-client datasets on every plan cover endpoints, patching, vulnerabilities, alerts, tickets, software, storage, Sync, audit, remote access, compliance, discovery, backup, credentials, and expirations. Practice datasets on the MSP plan add cross-client versions, a practice summary, and project, finance, and sales sets."
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/reports/datasets.mdx"
license: "CC BY 4.0"
---

# Report datasets

A dataset is a source a report section reads. Built-in reports are made from
these datasets, and you choose one per section in the
[Report builder](/reports/report-builder/). This page lists every dataset in
version 0.4.1, with the permission it needs and the most rows one section can
return. A section that reaches its limit says it is a partial view.

Every dataset needs the permission listed, in addition to `report:read`.
Datasets leave out encrypted content and sensitive personal data, such as a
credential's secret, ticket text, or the person signed in to an endpoint. Some
datasets do name people, such as a software requester, an audit actor, or a
remote access technician.

## Per-client datasets

These read one client's data. They are in each client's **Reports**.

### Endpoints and software

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Endpoints** | One row per endpoint: hostname, alias, asset tag, status, operating system and version, manufacturer, model, serial number, CPU, memory, health, last seen, and enrollment date | `endpoint:read` | 5,000 |
| **Patch compliance** | One row per endpoint with outstanding updates: counts by severity and by state (pending, approved, deferred, failed, awaiting user), and how long it has been behind | `patch:read` | 5,000 |
| **Vulnerabilities** | One row per finding: hostname, CVE, CVSS score and severity, whether an exploit is known, the software and version, the fixed version, state, and when it was first and last seen | `vuln:read` | 5,000 |
| **Software inventory** | One row per application and version: publisher, how many endpoints have it, and when it was first and last seen | `software:read` | 5,000 |
| **Software requests** | One row per end user software request: when, the endpoint, the requester, the package, its state, and who decided | `software:read` | 5,000 |
| **Policy compliance** | One row per endpoint and setting: status, reported value, how it is enforced, and the policy it came from | `policy:read` | 5,000 |

### Alerts, service, and activity

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Alert history** | One row per alert: when it was first and last raised, the endpoint, category, severity, state, occurrences, acknowledgment, resolution, and escalation tier | `alert:read` | 5,000 |
| **Tickets and SLA** | One row per ticket: reference, status, **Status group**, priority, **Category**, **Subcategory**, **Category / subcategory**, source, whether the SLA was breached, first response, solved and closed times, and logged and billable time. Tickets exist only on plans with the [service desk](/service-desk/). | `ticket:read` | 5,000 |
| **Audit activity** | One row per console audit entry: when, the actor, the action, and the target | `audit:read` | 5,000 |
| **Remote access activity** | One row per remote session: when it started and ended, the endpoint, the mode, the technician, how long it lasted, why it ended, and whether it was recorded | `remote:read` | 2,000 |

What the ticket category and status columns of **Tickets and SLA** hold:

| Column | Contains |
| --- | --- |
| **Status group** | The stage of the ticket's status: new, open, pending, hold, solved, or closed. Earlier versions titled this column **Category**. Saved reports that use it keep working. |
| **Category** | The code of the ticket's category, as set on the ticket. |
| **Subcategory** | The code of the ticket's subcategory, or empty. |
| **Category / subcategory** | The category and subcategory by name, such as `Hardware / Printer`, or the category name alone when there is no subcategory. A code with no matching category or subcategory shows as the code. |

The built-in **Tickets by category** report reads this dataset and counts
tickets per category and subcategory pair, one row each. The **Tickets and
SLA** and **Tickets by category** reports have a **Category** filter that
narrows them to one category. The filter also applies to **Download CSV** and
**Download PDF**. A scheduled report is not filtered.

### Storage and Outpost Sync

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Storage usage** | One row per day: peak stored, peak metered, and peak customer-owned storage | `billing:read` | 400 |
| **Outpost Sync usage** | One row per person: storage used, plaintext size, versions, recycle bin, and file count | `sync:read` | 2,000 |

### Compliance

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Compliance posture** | One row per framework control and setting: what is required, how it is enforced, and how many endpoints are compliant, have a gap, are not measured, are not applicable, or are excepted, with a compliance percentage. The built-in posture reports filter this to one framework. | `compliance:read` | 5,000 |
| **Compliance gaps by endpoint** | One row per endpoint and setting that is not compliant: the verdict, the reason, the required and reported values, any exception, and any open ticket | `compliance:read` | 20,000 |

See [Compliance](/compliance/).

### Network discovery

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Discovered devices** | One row per device network discovery found: site, network, MAC and IP address, hostname, vendor, type, status, whether it is managed, and when it was first and last seen. The **New devices** report filters this to devices first seen in the last 30 days. | `discovery:read` | 5,000 |
| **Discovery by site** | One row per site: managed endpoints, managed, tracked, unmanaged, and suggested devices, devices new in 30 days, and trusted networks | `discovery:read` | 5,000 |

### Backup

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Backup coverage** | One row per endpoint: backup status, its backup sources, and when it last succeeded and last attempted | `backup:read` | 5,000 |
| **Backup status by source** | One row per endpoint and backup source, including third-party products: outcome, last success, last attempt, and what is protected | `backup:read` | 2,000 |
| **Backup runs** | One row per Outpost Backup run: kind, trigger, state, start and finish, data scanned and uploaded, files, failures, and errors | `backup:read` | 5,000 |

See [Backup](/backup/).

### Documentation and credentials

| Dataset | Contains | Permission | Row limit |
| --- | --- | --- | --- |
| **Credential health** | One row per credential: collection, scope, kind, who manages it, rotation state, strength, breach count, findings, one-time code, last rotated, rotate-by date, last used, checkout, and links. Never the secret. | `vault:read` | 5,000 |
| **Credentials at risk after a departure** | One row per person who has left and credential they could reach that has not changed since. A filter on one person narrows it. | `vault:manage` | 5,000 |
| **Offboarding: what this person could see** | One person's disclosures and grants: when, the action, the record, the ticket, and the audit entry. A section must filter **User** to one person. | `vault:manage` | 5,000 |
| **Documentation expirations** | One row per dated record: source, kind, record, due date, days remaining, whether it is overdue, and whether reminders are on | `docs:read` | 5,000 |

See [Password health and at-risk reports](/documentation/password-health/) and
[Track expirations](/documentation/expirations/).

## Practice datasets

These read across your clients and are in the practice-level **Reports**. A
report can run across every client or a set you pick. Rows that come from one
client start with a **Client** column. A client that could not be reached
during the run is marked in an **Unavailable** column rather than left out.
Practice datasets return at most 20,000 rows per section.

### Across clients

Each of these is the per-client dataset of the same name with the **Client**
and **Unavailable** columns added, and needs the same permission.

| Dataset | Permission |
| --- | --- |
| **Endpoints across clients** | `endpoint:read` |
| **Patch compliance across clients** | `patch:read` |
| **Vulnerabilities across clients** | `vuln:read` |
| **Alert history across clients** | `alert:read` |
| **Tickets and SLA across clients** | `ticket:read` |
| **Software inventory across clients** | `software:read` |
| **Outpost Sync usage across clients** | `sync:read` |
| **Backup coverage across clients** | `backup:read` |

| Dataset | Contains | Permission |
| --- | --- | --- |
| **Practice summary** | One row per client: endpoints, active endpoints, seen in the last 24 hours, not seen in 30 days, and the oldest check-in | `endpoint:read` |

### Business

These read the MSP business data from sales, projects, client agreements, and
client invoicing. Months are UTC calendar months, so the current month is
partial.

| Dataset | Contains | Permission |
| --- | --- | --- |
| **Client health across the practice** | One row per client with a health grade and the reason: endpoints, endpoints not seen in 30 days, patch compliance, open critical and warning alerts, open tickets and tickets past SLA, satisfaction over the last 90 days, the agreement and its hours, money outstanding and overdue, open projects, and the worst project. The thresholds are set in **Client health thresholds**. | `psa:read` |
| **AR aging across clients** | One row per client of money owed: current, 1 to 30 days, 31 to 60 days, 61 to 90 days, over 90 days, and the total outstanding | `psa:read` |
| **Agreement profitability across clients** | One row per agreement and month: recurring revenue, prepaid blocks sold, time billed, adjustments, revenue invoiced, labor cost, margin, and hours by kind | `psa:read` |
| **Project profitability across clients** | One row per project: billing type, status, budget and logged hours, budget, invoiced and uninvoiced amounts, cost, and margin | `psa:read` |
| **Project status across clients** | One row per project: status, health and why, manager, dates, percent complete, open and at-risk tasks, overdue milestones, the next milestone, and hours burned | `project:read` |
| **Technician utilization across clients** | One row per technician and week: capacity, logged, billable, project, ticket, and booked hours, days off, and utilization and billable percentages | `project:manage` |
| **Open pipeline** | One row per open opportunity: the party, stage, value, probability, weighted value, days in stage and open, expected close, owner, and quotes | `crm:read` |
| **Pipeline funnel** | One row per sales stage: open deals and value, weighted value, how long deals sit there, deals entering and leaving in 90 days, conversion, and deals won and lost in 90 days. Stage history is counted from 2026-09-11. | `crm:read` |
| **Sales outcomes by month** | One row per month: deals won and lost and their value, win rate, average days to close, and quotes sent and accepted with their values and acceptance rate | `crm:read` |

Revenue in these datasets is what was invoiced, not what was signed.

## Related

- [Reports](/reports/)
- [Build a custom report](/reports/report-builder/)
- [Run and schedule reports](/reports/run-and-schedule/)