> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/search-and-reports/active-directory-entities/forest.md).

# Forest

| Field           | Type   | Possible Operators                                             | Description                                                                                                                                                                     |
| --------------- | ------ | -------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Guid            | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A unique identifier that is a combination of GUID of selected `Scan` and Active Directory `ObjectGUID` of the object.                                                           |
| FSName          | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | A special unique identifier that is a combination of the `Name of the object` and the `Fully Qualified Domain Name of the Domain`                                               |
| Name            | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Name of the specified object. (**Ldap Display Name**: ou)                                                                                                                       |
| risk            | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The risk score of the object that calculated based on vulnerability counts and severities.                                                                                      |
| ForestMode      | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The operating mode of the forest. ([Field reference](https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectory.forestmode?view=windowsdesktop-7.0)) |
| ForestModeLevel | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | The operating mode level of the forest. ([Field reference](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/d49624d0-9320-4368-8b0c-a7998ac2abdb))         |
| Schema          | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Distinguished Name of the Schema of the forest.                                                                                                                                 |
| SchemaRoleOwner | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain controller that holds the FSMO schema master role for the forest.                                                                                                        |
| NamingRoleOwner | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | Domain controller that holds the FSMO naming master role for the forest.                                                                                                        |
| RootDomain      | TEXT   | LIKE, NOT\_LIKE, EQUAL, NOT\_EQUAL, IS\_EMPTY                  | The Root Domain is the first domain created in a forest and acts as the central point for trust and namespace structure.                                                        |
| Tier            | NUMBER | EQUAL, BETWEEN, SMALLER, LARGER, SMALLER\_EQUAL, LARGER\_EQUAL | Tier level Forestall assigned to the object: `0` (Tier 0), `1` (Tier 1) or `2` (Tier 2). Lower is more privileged.                                                              |