-- Data Model

Data model¶

This is a simplified data model of the data model of the Mercator.

GDPR¶

The GDPR view contains all the data required to maintain the data processing register, and provides a link with the processes, applications, and information used by the information system.

This view is used to fulfill the obligations set out in article 30 of the GDPR.

There is no direct relation between data_processing and security_controls within this view: both tables are linked to processes and applications, which belong to other views (see Business view and Applications view).

Register¶

The register of processing activities contains the information required by article 30.1 of the GDPR.

The field "controls" is not used and therefore is absent in the app.

The data model export lists processes, information, applications and documents linked to a data processing.

In the app, a process can be linked to a data processing from a data processing object.
An information can be linked with a data processing from a data processing object.

An application can be linked to a data processing from a data processing object.
A document can be linked to a data processing from a data processing object.

Security measures¶

This table identifies the security measures applied to processes and applications.

By default, this table is populated with the security measures of ISO 27001:2022.

Ecosystem¶

The ecosystem view describes all the entities or systems that revolve around the information system considered in the mapping.

This view not only delimits the scope of the mapping, but also provides an overall view of the ecosystem without being limited to the individual study of each entity.

erDiagram
    entities {
        int id PK
        string ext_refs
        string name
        int icon_id
        string entity_type
        string attributes
        text description
        string reference
        int parent_entity_id FK
        boolean is_external
        text security_level
        text contact_point
        string external_ref_id
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    relations {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        text description
        int source_id FK
        int destination_id FK
        string reference
        string responsible
        string order_number
        boolean active
        date start_date
        date end_date
        text comments
        int importance
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    entities ||--o{ entities : "parent_entity_id"
    entities ||--o{ relations : "source_id"
    entities ||--o{ relations : "destination_id"

Entities¶

Entities are a part of the organization (e.g.: subsidiary, department, etc.) or related to the information system to be mapped.

Entities are departments, suppliers, partners with whom information is exchanged through relationships.

The "external_ref_id" field is not used and therefore is missing in the app.

The data model export lists processes and applications linked with an entity.

In the app, a process can be linked with an entity from these two objects.
An application can be linked with an entity (as operations manager) from these two objects.

In the app, a database can be linked with an entity (as operations manager) from these two objects.

Relationships¶

Relationships represent a link between two entities or systems.

Relationships are contracts, service agreements, legal obligations... that have an influence on the information system.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

The data model export lists the reference documents attached to a relationship.
In the application, a document can be attached to a relationship from a relationships object.

The financial values of a contract can be indicated in dedicated fields.

Business¶

The business view of the information system describes all the organization's business processes and the players involved, independently of the technological choices made by the organization and the resources made available to it.

The business view is essential, as it allows you to reposition technical elements in their business environment, and thus understand their context of use.

erDiagram
    "macro-processuses" {
        int id PK
        string ext_refs
        string name
        text description
        text io_elements
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        string owner
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    processes {
        int id PK
        string ext_refs
        string name
        text description
        int icon_id
        string owner
        text in_out
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        int macroprocess_id FK
        list activities
        list entities
        list informations
        list applications
        list operations
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    activities {
        int id PK
        string ext_refs
        string name
        text description
        int recovery_time_objective
        int maximum_tolerable_downtime
        int recovery_point_objective
        int maximum_tolerable_data_loss
        text drp
        string drp_link
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    activity_impact {
        bigint id PK
        int activity_id FK
        string impact_type
        int severity
        timestamp created_at
        timestamp updated_at
    }
    operations {
        int id PK
        string ext_refs
        string name
        text description
        int process_id FK
        list actors
        list tasks
        list activities
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    tasks {
        int id PK
        string ext_refs
        string name
        text description
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    actors {
        int id PK
        string ext_refs
        string name
        string nature
        string type
        string contact
        list operations
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    information {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        text description
        string owner
        string administrator
        string sensitivity
        string storage
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        text constraints
        string retention
        list parents
        list children
        list processes
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    "macro-processuses" ||--o{ processes : "macroprocess_id"
    processes }o--o{ activities : "activities"
    processes }o--o{ information : "informations"
    operations }o--|| processes : "process_id"
    operations }o--o{ actors : "actors"
    operations }o--o{ tasks : "tasks"
    operations }o--o{ activities : "activities"
    activities ||--o{ activity_impact : "activity_id"
    information }o--o{ information : "parents / children"

Note: entities, applications and databases referenced by processes/activities/information belong to other views (Ecosystem, Applications) and are therefore not represented in this diagram.

Macro-processes¶

Macro-processes represent sets of processes.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

In the application, a process can be linked with a macro-process from these two objects.

Processes¶

Processes are a set of activities designed to achieve a goal. The process produces value-added information ( output) (in the form of deliverables) from information (input) produced by other processes.

Processes are made up of activities, entities involved in this process, and information processed by this process.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

The data model export lists:

• entities,
• activities,
• information,
• applications,
• data processing,
• and security measures

linked to a process.

In the application, an entity associated with a process can be linked with a process from these two objects.
An activity can be linked with a process from these two objects.
An information can be linked with a process from these two objects.

An application can be linked with a process from these two objects.
A GDPR registry data processing can be linked with a process from a registry data processing object.

A security measure can be linked with an application from the "Assign security controls" button.
This button is in the GDPR view and visible in the list of Security controls objects.

Activities¶

An activity is a step required to carry out a process. It corresponds to a specific know-how and not necessarily to an organizational structure of the company.

The maximum tolerable downtime is the limit after which the downtime effets are critical or unacceptable.
The maximum tolerable data loss is the limit after which the data loss is critical or unacceptable.

The data model export lists processes, operations, and applications linked with an activity.

In the app, a process can be linked with an activity from these two objects.
An operation can be linked with an activity from these two objects.
An application can be linked with an activity from these two objects.

In the app, the "Impact Type" and "Severity" fields are managed in a separate table.

Impacts¶

Impacts are the consequences of the occurrence of a risk during an activity.
Impacts are only accessible through "activities" objects.

Operations¶

An operation is made up of actors and tasks.

The data model export lists activities, actors, and tasks linked to an operation.

In the app, an activity can be linked with an operation from these two objects.
An actor can be linked to an operation from the object "operation".
A task can be linked to an operation from the object "operation".

Tasks¶

A task is an elementary activity performed by an organizational function and constituting an indivisible unit of work in the value-added chain of a process.

The data model export lists operations linked to a task.

In the app, an operation can be linked to a task from the object "operation".

Actors¶

An actor is a representative of a business role who performs operations, uses applications, and makes decisions within processes. This role can be carried by a person, a group of people, or an entity.

The data model export lists operations linked with an actor.

In the app, an operation can be linked with an actor from the object "operation".

Information¶

Information is data processed by a computer. Information can be inherited from another information. Information can be linked to multiple information.

The field "retention" is not used and therefore is absent in the app.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

The data model export lists databases and processes linked with information.

In the app, a database can be linked with an information from the object "database".
A process can be linked to an information from these two objects.

Note: The link to processes is a view of the result generated through the endpoint processes and its field informations**

Applications¶

The application view is used to describe part of what is classically referred to as the "computer system".

This view describes the technological solutions that support business processes, mainly applications.

erDiagram
    "application-blocks" {
        int id PK
        string ext_refs
        string name
        text description
        string responsible
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    applications {
        int id PK
        string ext_refs
        string name
        int application_block_id FK
        string attributes
        text description
        int icon_id
        string status
        string responsible
        string functional_referent
        string editor
        string users
        string technology
        string type
        string external
        date install_date
        date prod_date
        date update_date
        date next_update
        string documentation
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        int rto
        int rpo
        string vendor
        string product
        string version
        int patching_frequency
        string hosting
        string urls
        list entities
        list processes
        list services
        list databases
        list logical_servers
        list activities
        list containers
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    application_events {
        int id PK
        string ext_refs
        int user_id FK
        int application_id FK
        text message
        timestamp created_at
        timestamp updated_at
    }
    application_services {
        int id PK
        string ext_refs
        string name
        text description
        string exposition
        list modules
        list applications
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    application_modules {
        int id PK
        string ext_refs
        string name
        text description
        list entities
        list application_services
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    databases {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int entity_resp_id FK
        string responsible
        int icon_id
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        string external
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    application_flows {
        int id PK
        string ext_refs
        string name
        string attributes
        text description
        int application_source_id FK
        int service_source_id FK
        int module_source_id FK
        int database_source_id FK
        int application_dest_id FK
        int service_dest_id FK
        int module_dest_id FK
        int database_dest_id FK
        boolean crypted
        boolean bidirectional
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    "application-blocks" ||--o{ applications : "application_block_id"
    applications ||--o{ application_events : "application_id"
    applications }o--o{ application_services : "services"
    applications }o--o{ databases : "databases"
    application_services }o--o{ application_modules : "modules"
    application_flows }o--|| applications : "source / destination"
    application_flows }o--|| application_services : "source / destination"
    application_flows }o--|| application_modules : "source / destination"
    application_flows }o--|| databases : "source / destination"

Note: entities, processes, activities, logical_servers and containers referenced by applications belong to other views and are therefore not represented in this diagram.

Applications blocks¶

An application block represents a set of applications.

An application block can be: office applications, management applications, analysis applications, development applications, etc.

In the app, an application can be linked to an application block from these two objects.

Applications¶

An application is a coherent set of IT objects (executables, programs, data, etc.). It is a grouping of application services.

An application can be deployed on one or more logical servers.

When there is no virtualized environment, there are not several logical servers per physical server, but one logical server per physical server.

RTO : Recovery Time Objective
RPO : Recovery Point Objective

The "patching_frequency" and "next_update" fields are not used at the moment and are therefore missing from the application.

In the app, the need for authentication is hidden by default. It is mandatory in the case from an entity subject to EU Directive 2022/2554 (DORA).
It is activated from the Configuration > Settings menu.

Export of reference data model:

• user entities (entities field),
• supported processes,
• supported activities,
• application services,
• databases,
• workstations,
• logical servers,
• logical security devices,
• administrators ("Users" object of the administration view),
• and security measures

linked with an application.

In the app, an entity using the application can be linked with an application from an application object.
A process can be linked with an application from these two objects.
An activity can be linked with an application from these two objects.

An application service can be linked with an application from these two objects.
A database can be linked to an application from these two objects.
A workstation can be linked to an application from a workstation object.

A logical server can be linked with an application from these two objects.
A logical security device can be linked with an application from these two objects.
An administrator can be linked with an application from an application object.

A security measure can be linked to an application from the "Assign a security measure" button.
This button is present in the GDPR view and visible in the list of Security controls objects.

In the app, a container can be linked with an application from these two objects.
In the app, the major events field is managed in a separate table.

Major events¶

Major events are the main events undergone by an application during its operation.
Major events are only accessible through application objects.

They are neither importable nor exportable through the graphics tool.

Applications services¶

An application service is a specific service provided to a user to perform specific tasks related to their role in the organisation.

Eg. an application service could be a Cloud service or platform.

The data model export lists the applications and application modules linked with an application service.

In the app, an application can be linked with an application service from these two objects.
In the app, an application module can be linked with an application service from these two objects.

There are two fields containing the same information in the data model export, servicesApplications and applications.
The connection with application objects is made through the applications field.

Application modules¶

An application module is a component of an application characterized by functional coherence and technological homogeneity.

The export of the data model lists application services linked with an application module.

In the app, an application service can be linked to an application module from these two objects.

Databases¶

A database is a set of structured and ordered information meant for computed processing.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

The data model export references the specific icon of a database.
In the app, a specific icon can be linked with a database from a database object.

The data model export lists entities using the database (entities field), applications, information, logical servers and containers linked with a database.

In the app, a user entity can be linked with a database from a database object.
In the app, an information can be linked with a database from a database object.

In the app, an application can be linked with a database from these two objects.
In the app, a logical server can be linked with a database from these two objects.
In the app, a container can be linked with a database from these two objects.

Application Flows¶

An application flow is an exchange of information between a sender and a receiver (application, application service, application module, or database).

An application flow represents an exchange of information between two elements of the information system. It is important to avoid representing all firewall filtering rules in terms of flows.

For example, DNS or NTP requests should not be represented as flows.

The device_ for source_id or dest_id can be: :

In the app, an information can be linked with an application flow from an application flow object.

Administration¶

The administration view lists the management of resources, directories, and user privilege levels within the information system.

Having directories and centralized user access rights is strongly recommended for operators of vital importance (OIVs).

Nota: OVI is coming from the French military programme law. The closest equivalents in EU regulations are OES (Operators of Essential Services, EU 2016/1148, NIS) and EE (Essential Entities, EU 2022/2555, NIS 2).

erDiagram
    zone_admins {
        int id PK
        string ext_refs
        string name
        text description
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    annuaires {
        int id PK
        string ext_refs
        string name
        text description
        string solution
        int zone_admin_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    forest_ads {
        int id PK
        string ext_refs
        string name
        text description
        int zone_admin_id FK
        list domains
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    domains {
        int id PK
        string ext_refs
        string name
        text description
        int domain_ctrl_cnt
        int user_count
        int machine_count
        string relation_inter_domain
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    admin_users {
        int id PK
        string ext_refs
        string user_id
        string firstname
        string lastname
        string type
        string attributes
        int icon_id
        text description
        int domain_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    zone_admins ||--o{ annuaires : "zone_admin_id"
    zone_admins ||--o{ forest_ads : "zone_admin_id"
    forest_ads }o--o{ domains : "domains"
    domains ||--o{ admin_users : "domain_id"

Administration zone¶

An administration zone is a set of resources (people, data, equipment) under the responsibility of one (or more) administrator(s).

An administration zone is made up of Active Directory (AD) directory services and forests, or LDAP trees.

Administration directory services¶

An administration directory service is an application that collects data on a company's users or IT equipment, enabling them to be administered.

It can be an inventory tool used to manage changes or tickets, or a mapping tool such as Mercator.

Active Directory forests / LDAP tree structure¶

These objects represent an organized grouping of Active Directory domains or LDAP trees.

Active Directory domains / LDAP¶

Active Directory domains / LDAP are company IT directories. They contains user and computer accounts, contacts, objects rights, and a part of IT policies (e.g. Group Policy Object - GPO).

The data model esport lists AD forests / LDAP trees linked with an AD domain / LDAP.

In the app, an AD forest / LDAP tree can be linked with an AD domain / LDAP from these two objects.
A logical server can be linked with an AD domain / LDAP from these two objects.

Users¶

Users are user accounts with privileged rights on IT systems.

The data model export lists applications which an user is administrator.

In the app, an user can be defined as administrator of an application from an application object.

Logical infrastructure¶

The logical infrastructure view corresponds to the logical distribution of the network.

It illustrates the partitioning of networks and the logical links between them. It also lists the network equipment that handles the traffic.

erDiagram
    networks {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        text description
        string protocol_type
        string responsible
        string responsible_sec
        int security_need_c
        int security_need_i
        int security_need_a
        int security_need_t
        int security_need_auth
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    subnetworks {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        text description
        int network_id FK
        int subnetwork_id FK
        int connected_subnets_id
        string address
        string default_gateway
        int gateway_id FK
        int vlan_id FK
        string ip_allocation_type
        string zone
        string dmz
        string wifi
        string responsible_exp
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    gateways {
        int id PK
        string ext_refs
        string name
        text description
        string ip
        string authentification
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    external_connected_entities {
        int id PK
        string ext_refs
        string name
        string type
        text description
        int entity_id FK
        int network_id FK
        list subnetworks
        string contacts
        string src
        string src_desc
        string dest
        string dest_desc
        text security
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    network_switches {
        int id PK
        string ext_refs
        string name
        text description
        string ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    routers {
        int id PK
        string ext_refs
        string name
        string type
        text ip_addresses
        text description
        text rules
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    security_devices {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        int icon_id
        text description
        string address_ip
        string vendor
        string product
        string version
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    dhcp_servers {
        int id PK
        string ext_refs
        string name
        text description
        string address_ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    dnsservers {
        int id PK
        string ext_refs
        string name
        text description
        string address_ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    clusters {
        int id PK
        string ext_refs
        string name
        string type
        int icon_id
        text description
        string attributes
        string address_ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    logical_servers {
        int id PK
        string ext_refs
        string name
        int icon_id
        string type
        boolean active
        string attributes
        text description
        string operating_system
        datetime install_date
        datetime update_date
        int patching_frequency
        date next_update
        string net_services
        string environment
        string address_ip
        int domain_id FK
        string cpu
        string memory
        int disk
        int disk_used
        text configuration
        list databases
        list cluster_id
        list physical_servers
        list applications
        list containers
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    backups {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        list logical_server_ids
        list storage_device_ids
        int backup_frequency
        int backup_cycle
        int backup_retention
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    containers {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int icon_id
        list applications
        list databases
        list logical_servers
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    logical_flows {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        text description
        string chain
        string interface
        int router_id FK
        int priority
        string action
        string protocol
        string source_ip_range
        string dest_ip_range
        string source_port
        string dest_port
        int device_source_id FK
        int device_dest_id FK
        string users
        string schedule
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    certificates {
        int id PK
        string ext_refs
        string name
        text description
        string type
        date start_validity
        date end_validity
        int status
        list logical_servers
        list applications
        datetime last_notification
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    vlans {
        int id PK
        string ext_refs
        string name
        text description
        int vlan_id
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    networks ||--o{ subnetworks : "network_id"
    subnetworks ||--o{ subnetworks : "subnetwork_id"
    subnetworks }o--|| gateways : "gateway_id"
    subnetworks }o--|| vlans : "vlan_id"
    networks ||--o{ external_connected_entities : "network_id"
    external_connected_entities }o--o{ subnetworks : "subnetworks"
    routers ||--o{ logical_flows : "router_id"
    clusters }o--o{ logical_servers : "cluster_id"
    logical_servers }o--o{ containers : "containers"
    backups }o--o{ logical_servers : "logical_server_ids"
    logical_flows }o--|| security_devices : "device (poly)"
    logical_flows }o--|| logical_servers : "device (poly)"
    logical_flows }o--|| clusters : "device (poly)"
    logical_flows }o--|| subnetworks : "device (poly)"
    certificates }o--o{ logical_servers : "logical_servers"

Note: entities, administration domains, applications, databases and physical-infrastructure devices referenced here belong to other views and are therefore not represented in this diagram.

Networks¶

Networks are a set of logically interconnected devices that exchange information.

In the app, the field for the authenticity need ("security_need_auth") is hidden by default. It is mandatory for entities subject to the regulation (EU) 2022/2554 (DORA).
This default configuration can be changed in the menu Configuration > Parameters.

Subnetworks¶

Subnetworks are a logical subdivision of a larger network.

The field "connected_subnets_id" is a foreign key. However, this one doesn't seem to be used.

External input gateways¶

Gateways are components used to connect a local network to the outside world.

In the application, a subnet can be linked with a gateway from these two objects.

Connected external entities¶

Connected external entities represent external entities connected to the network.

The data model export lists subnets and documents attached to a connected external entity.

In the app, a subnet can be linked to a connected external entity from a connected external entity object. A document can be attached to a connected external entity from a connected external entity object.

Network switches¶

Network switches are the components that manage connections between the various servers on a network.

The data model export lists physical switches and VLANs linked with a network switch.

In the app, a VLAN can be linked with a network switch from these two objects.
A physical switch can be linked with a network switch from these two objects.

Logical routers¶

Logical routers are logical components that manage connections between different networks.

The data model export lists physical routers linked to a logical router.

In the app, a physical router can be linked to a logical router from these two objects.

Security devices¶

Security devices are components used for network supervision, incident detection, equipment protection, and information system security.

Security equipment includes intrusion detection systems (IDS: Intrusion Detection System), intrusion prevention systems (IPS: Intrusion Prevention System) and equipment monitoring systems.

The "vendor", "product" and "version" fields are not used and therefore are absent in the app.

The data model export lists physical security device and applications linked to a logical security device.

In the app, physical security device can be linked to a logical security device from these two objects.
An application can be linked a to logical security device from these two objects.

DHCP servers¶

***NOTE***: The DHCP servers are kept for backward compatibility and to be compliant with ANSSI's guidelines.

- ANSSI is the French cybersecurity regulation authority.
  This object is considered barely useful and obsolete. It's hidden by default.

DHCP servers are physical or virtual devices that manage a network's IP addresses.

DNS servers¶

***NOTE***: The DNS servers are kept for backward compatibility and to be compliant with ANSSI's guidelines.

- ANSSI is the French cybersecurity regulation authority.
  This object is considered barely useful and obsolete. It's hidden by default.

Domain Name System (DNS) servers are physical or virtual devices that convert a domain name into an IP address.

Clusters¶

Clusters are a set of logical servers hosted on one or more physical servers.

The data model export lists logical routers, logical and physical servers linked with a cluster.

In the app, a logical router can be linked to a cluster from a cluster object.
A logical server can be linked to a cluster from these two objects.
A physical server can be linked to a cluster from these two objects.

Logical servers¶

Logical servers are a logical breakdown of a physical server. If the physical server is not virtualized, it is split into a single logical server.

The "patching_frequency" and "next_update" fields are not used and therefore are absent in the app.

The data model lists:

• applications,
• physical servers,
• documents,
• databases,
• clusters,
• certificates,
• and containers

linked with a logical server.

In the app, an application can be linked with a logical server from these two objects.
A database can be linked with a logical server from these two objects.

A cluster can be linked with a logical server from these two objects.
A physical server can be linked with a logical server from these two objects.

A certificate can be linked with a logical server from a certificate object.
A container can be linked with a logical server from a container object.

The "documents" field doesn't appear to be used in a logical server's data model.

Backup Plans¶

Backup plans allow you to associate the implemented backup strategies with each logical server.
These strategies describe:
- the storage infrastructure used to receive the backup,
- the backup frequency (daily, weekly, monthly…),
- the backup type (full, incremental…),
- the retention period, expressed in days.

This table serves as the reference for auditing backup compliance, identifying unprotected servers, and verifying that backup strategies match availability and restoration requirements.

Detail of proposed ids:

Containers¶

Containers are part of virtualization systems. They can operate in clusters or in isolation. on internal or external (cloud) logical servers.

The data model export lists applications, databases, and logical servers linked with a container.

In the app, an application can be linked to a container from these two objects.
A database can be linked to a container from these two objects.
A logical server can be linked to a container from a container object.

Logical flows¶

Logical flows describe relationships at layers 3 and 4 of the OSI model.

General principle :

Source and destination devices can be:

Certificates¶

Electronic certificates are used to identify and authenticate services and individuals, as well as to encrypt exchanges.

Certificates are SSL keys, HTTPS certificates, etc. They are associated with logical servers or applications.

• Note:
  • status = 0 : "Good"
  • status = 1 : "Revoked"
  • status = 2 : "Unknown"

The "last_notification" field is not used and therefore is absent in the app.

The data model export lists applications and logical servers linked with a certificate.

VLANs¶

A VLAN (Virtual Local Area Network) or virtual LAN enables equipment to be logically grouped together, free from physical constraints.

The data model export lists physical routers and logical network switches linked to a VLAN.

In the app, a VLAN can be linked to a physical router from a physical router object.
In the app, a VLAN can be linked to a subnet from these two objects.
In the app, a VLAN can be linked to a logic switch from these two objects.

Physical infrastructure¶

The physical infrastructure view describes the physical equipment that makes up or is used by the information system.

This view corresponds to the geographical distribution of network equipment within the various sites.

erDiagram
    sites {
        int id PK
        string ext_refs
        string name
        string type
        string attributes
        int icon_id
        text description
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    buildings {
        int id PK
        string ext_refs
        string name
        int icon_id
        string type
        string attributes
        text description
        int site_id FK
        int building_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    bays {
        int id PK
        string ext_refs
        string name
        text description
        int building_id FK
        int site_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    zones {
        int id PK
        string ext_refs
        string name
        text description
        string type
        string attributes
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    physical_servers {
        int id PK
        string ext_refs
        string name
        int icon_id
        text description
        string type
        string cpu
        string memory
        int disk
        int disk_used
        text configuration
        string operating_system
        string address_ip
        datetime install_date
        datetime update_date
        string responsible
        int site_id FK
        int building_id FK
        int bay_id FK
        list clusters
        list logical_servers
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    workstations {
        int id PK
        string ext_refs
        string name
        int icon_id
        text description
        string status
        string type
        int entity_id FK
        int domain_id FK
        int user_id FK
        int other_user
        string manufacturer
        string model
        string serial_number
        string cpu
        string memory
        int disk
        string operating_system
        int network_id FK
        string address_ip
        string mac_address
        string network_port_type
        int site_id FK
        int building_id FK
        list applications
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    storage_devices {
        int id PK
        string ext_refs
        string name
        string type
        text description
        int site_id FK
        int building_id FK
        int bay_id FK
        string address_ip
        string vendor
        string product
        string version
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    peripherals {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int icon_id
        int site_id FK
        int building_id FK
        int bay_id FK
        string responsible
        string address_ip
        string domain
        string vendor
        string product
        string version
        int provider_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    phones {
        int id PK
        string ext_refs
        string name
        text description
        string type
        string vendor
        string product
        string version
        int site_id FK
        int building_id FK
        int physical_switch_id FK
        string address_ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    physical_switches {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int site_id FK
        int building_id FK
        int bay_id FK
        string vendor
        string product
        string version
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    physical_routers {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int site_id FK
        int building_id FK
        int bay_id FK
        list vlans
        list routers
        string vendor
        string product
        string version
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    wifi_terminals {
        int id PK
        string ext_refs
        string name
        text description
        string type
        int site_id FK
        int building_id FK
        string address_ip
        string vendor
        string product
        string version
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    physical_security_devices {
        int id PK
        string ext_refs
        string name
        int icon_id
        text description
        string type
        int site_id FK
        int building_id FK
        int bay_id FK
        list security_devices
        string address_ip
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    physical_links {
        int id PK
        string ext_refs
        string type
        string color
        string attributes
        text description
        int device_src_id FK
        string src_id
        int device_dst_id FK
        string dst_port
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    wans {
        int id PK
        string ext_refs
        string name
        list lans
        list mans
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    mans {
        int id PK
        string ext_refs
        string name
        int parent_man_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    lans {
        int id PK
        string ext_refs
        string name
        text description
        list mans
        list wans
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }

    sites ||--o{ buildings : "site_id"
    buildings ||--o{ buildings : "building_id"
    buildings ||--o{ bays : "building_id"
    sites ||--o{ bays : "site_id"
    sites ||--o{ physical_servers : "site_id"
    buildings ||--o{ physical_servers : "building_id"
    bays ||--o{ physical_servers : "bay_id"
    sites ||--o{ workstations : "site_id"
    buildings ||--o{ workstations : "building_id"
    sites ||--o{ storage_devices : "site_id"
    buildings ||--o{ storage_devices : "building_id"
    bays ||--o{ storage_devices : "bay_id"
    sites ||--o{ peripherals : "site_id"
    buildings ||--o{ peripherals : "building_id"
    bays ||--o{ peripherals : "bay_id"
    sites ||--o{ phones : "site_id"
    buildings ||--o{ phones : "building_id"
    sites ||--o{ physical_switches : "site_id"
    buildings ||--o{ physical_switches : "building_id"
    bays ||--o{ physical_switches : "bay_id"
    sites ||--o{ physical_routers : "site_id"
    buildings ||--o{ physical_routers : "building_id"
    bays ||--o{ physical_routers : "bay_id"
    sites ||--o{ wifi_terminals : "site_id"
    buildings ||--o{ wifi_terminals : "building_id"
    sites ||--o{ physical_security_devices : "site_id"
    buildings ||--o{ physical_security_devices : "building_id"
    bays ||--o{ physical_security_devices : "bay_id"
    physical_links }o--|| peripherals : "device (poly)"
    physical_links }o--|| phones : "device (poly)"
    physical_links }o--|| physical_routers : "device (poly)"
    physical_links }o--|| physical_security_devices : "device (poly)"
    physical_links }o--|| physical_servers : "device (poly)"
    physical_links }o--|| physical_switches : "device (poly)"
    physical_links }o--|| storage_devices : "device (poly)"
    physical_links }o--|| wifi_terminals : "device (poly)"
    physical_links }o--|| workstations : "device (poly)"
    wans }o--o{ lans : "lans"
    wans }o--o{ mans : "mans"
    mans ||--o{ mans : "parent_man_id"

Note: entities, administration domains, networks, applications, clusters and logical servers referenced here belong to other views and are therefore not represented in this diagram.

Sites¶

Sites are geographical locations that bring together a group of people and/or resources.

In the app, a building / room can be linked with a site from a building / room object.

Buildings / Rooms¶

Buildings or rooms represent the location of people or resources within a site.

In the app, a building / room or a site can be linked with a building / room from a building object / room.

Racks¶

Racks are technical cabinets housing computer network or telephony equipment.

In the app, a rack can be linked to a building / room and to a site from a rack object.

Security zones¶

A Security Zone is a physically secured area accessible only with accreditation or specific authorizations.

Physical servers¶

Physical servers are physical machines running a set of IT services.

The data model export lists applications, (logical) clusters, and logical servers linked with a physical server.

In the app, an application can be linked with a physical server from a physical server object.
A cluster can be linked with a physical server from these two types of objects.
A logical server can be linked with a physical server from these two types of objects.

For readability purpose, fields defined in the data model but unused in the app for the table physical_servers have been gathered into the following table:

Workstations¶

Workstations are physical machines that enable a user to access the information system.

The data model export lists applications linked to a workstation.

In the app, an application can be linked to a workstation from a workstation object.

For readability purpose, fields defined in the data model but unused in the app for the table workstations have been gathered in the following table:

The "vendor", "product" and "version" fields are not used and therefore are absent of the app.

Storage infrastructures¶

***NOTE***: The storage infrastructures are kept for compatibility, but this table is not maintained anymore.
It is possible to replace this asset by:

- A logical server.
- A physical server.

Storage infrastructures are physical media or data storage networks: network attached storage (NAS), storage area network (SAN), hard disk...

The "vendor", "product" and "version" fields are not used and therefore are absent of the app.

Peripherals¶

Peripherals are physical components connected to a workstation to add new functions (e.g. keyboard, mouse, printer, scanner, etc.).

The data model export lists applications using a peripheral.

In the app, an application can be linked to a peripheral from a peripheral object.

Phones¶

Landlines and mobile phones belonging to the organization.

The "vendor", "product" and "version" fields are not used and therefore are absent in the app.

The filed "physical_switch_id" is not used and therefore is absent in the app. However, a phone object can be linked with a network switch (either physical or logical) through a physical link object.

Physical switches¶

Physical switches are physical components that manage connections between different servers within a network.

The "vendor", "product" and "version" fields are not used and therefore are absent in the app.

The data model export lists logical network switches linked with a physical switch.

In the app, a physical switch can be linked with a logical network switch from these two objects.

Physical routers¶

Physical routers are physical components that manage connections between different networks.

The "vendor", "product" and "version" fields are not used and therefore are absent in the app.

The data model export lists logical routers and VLANs linked to a physical router.

In the app, a physical router can be linked to a logical router (denoted as "Routers") from these two types of objects.
A VLAN can be linked to a physical router from a physical router object.

WiFi terminals¶

WiFi hotspots are hardware devices that enable access to the WiFi wireless network.

Physical security device¶

Physical security device includes components for network supervision, incident detection, equipment protection, and information system security.

Physical security device includes temperature sensors, cameras, security doors, etc.

The data model export lists logical security devices linked to a physical security device.

In the app, a logical security device can be linked to a physical security device from these two objects.

Physical links¶

Physical links represent the cables between physical or logical objects.
Logical objects can have physical links, for example within a virtualized network.
A physical link is different from a logical flow. A physical link describes a relationship at layers 1 or 2 of the OSI model.
A logic flow describes a relationship at layers 3 and 4 of the OSI model.

Source and destination devices can be:

WANs¶

WANs (Wide Area Networks) are computer networks linking equipment over long distances. They generally interconnect MANs or LANs.

The data model export lists LANs and MANs linked to a WAN.

In the app, a LAN can be linked to a WAN from a WAN object.
A MAN can be linked to a WAN from a WAN object.

MANs¶

MANs (Middle Area Networks) are computer networks linking equipment over medium-sized distances. They generally interconnect LANs.

The data model export lists WANs and LANs linked to a MAN.

In the app, a WAN can be linked to a MAN from a WAN object.
A LAN can be linked to a MAN from a MAN object.

LANs¶

LANs (Local Area Networks) are computer networks linking equipment over a small geographical area.

The data model export lists MANs and WANs linked to a LAN.

In the app, a MAN can be linked to a LAN from a MAN object.
A WAN can be linked to a LAN from a WAN object.

Configuration¶

The "documents" section can be found in the configuration menu.

erDiagram
    documents {
        int id PK
        string ext_refs
        string filename
        string mimetype
        int size
        text hash
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    users {
        int id PK
        string login
        string name
        string email
        datetime email_verified_at
        string password
        string remember_token
        int granularity
        list roles
        string language
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    roles {
        int id PK
        string title
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    cartographers {
        int id PK
        string cartographiable_type
        int cartographiable_id
        int user_id FK
        int role_id FK
        timestamp created_at
        timestamp updated_at
        timestamp deleted_at
    }
    permissions {
        int id PK
        string ext_refs
        string title
        string module
        timestamp created_at
        timestamp updated_at
    }

    users }o--o{ roles : "roles"
    cartographers }o--|| users : "user_id"
    cartographers }o--|| roles : "role_id"

Note: documents is referenced from most of the other views through icon_id fields, and cartographiable_id is a polymorphic reference resolved by cartographiable_type — these cross-view links are not represented here.

documents¶

This part allow to see all attached documents, including specific image (icons)

• The document is created in docs directory, referenced by its ID
• The document is not inserted in the database.

Example of a document fields for a specific image of firewall:¶

    "id": 1,
"filename": "fw.png",
"mimetype": "image/png",
"size": 5295,
"hash": "71ffcf1b3cfdbf2c0920abbbfcc472ae92d05a355967b0faed88c97e5c4187b0",
"deleted_at": null,
"created_at": "2026-03-30T08:05:46.000000Z",
"updated_at": "2026-03-30T08:05:46.000000Z"

⚠️ From user interface of Mercator, if a document of specific image (personalized icon) is created, This icon might be used by another asset of the same category as soon as there is, a least, one asset in the category.

users¶

This part allows to see the Mercator users list and their associated link to roles.

Roles¶

This part allows to see Mercator roles list.

Cartography¶

This section allows you to define access rules on objects, applicable to roles or users.

Permissions¶

This part allows to see all Mercator permissions than can be allocated to roles.