Devices are Windows, macOS or mobile endpoints.

Field

Group

Type

Access state

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether the device can access the Exchange ActiveSync server. The possible states are:

  • allowed: the device has access

  • blocked: the device is blocked

  • discovery: the device is temporarily quarantined while it is being identified by the Exchange ActiveSync server

  • quarantined: the device is waiting for Exchange ActiveSync administrator approval

NXQL ID:

eas_access_state

Access state reason

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the reason for the device access state. The possible values are:

  • global: caused by the global access settings

  • device rule: caused by a device access rule

  • individual: caused by an individual exemption

  • policy: caused by Exchange ActiveSync policy

NXQL ID:

eas_access_state_reason

Activity start time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Start time of investigated activity

NXQL ID:

activity_start_time

Activity stop time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Stop time of investigated activity

NXQL ID:

activity_stop_time

AD site

Properties

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the AD site of the device as configured in the Active Directory.

A `-` is displayed if the Collector is older than version 6.19 or if the device is not part of a domain.

NXQL ID:

directory_service_site

Administrator account status

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether the local Administrator account is enabled or disabled

NXQL ID:

administrator_account_status

All antispyware

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Summary information about all the detected antispyware:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

all_antispywares

Note: this field is not available for Windows Server operating systems.

All antiviruses

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Summary information about all the detected antiviruses:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

all_antiviruses

Note: this field is not available for Windows Server operating systems.

All firewalls

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Summary information about all the detected firewalls:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

all_firewalls

Note: this field is not available for Windows Server operating systems.

Antispyware display name

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Name of the main antispyware

NXQL ID:

antispyware_name

Note: this field is not available for Windows Server operating systems.

Antispyware RTP

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the antispyware real time protection (RTP) is active:

  • on: indicates that RTP is active

  • off: indicates that either RTP is not active or no antispyware has been detected

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

antispyware_rtp

Note: this field is not available for Windows Server operating systems.

Antispyware up-to-date

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the antispyware is up-to-date:

  • yes: indicates that antispyware is up-to-date

  • no: indicates that either the antispyware is not up-to-date or no antispyware has been detected

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

antispyware_up_to_date

Note: this field is not available for Windows Server operating systems.

Antivirus display name

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Name of the main antivirus

NXQL ID:

antivirus_name

Note: this field is not available for Windows Server operating systems.

Antivirus RTP

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the antivirus real time protection (RTP) is active:

  • on: indicates that RTP is active

  • off: indicates that either RTP is not active or no antivirus has been detected

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

antivirus_rtp

Note: this field is not available for Windows Server operating systems.

Antivirus up-to-date

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the antivirus is up-to-date:

  • yes: indicates that antivirus is up-to-date

  • no: indicates that either the antivirus is not up-to-date or no antivirus has been detected

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

antivirus_up_to_date

Note: this field is not available for Windows Server operating systems.

Application crash ratio

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of application crashes per 100 executions.

NXQL ID:

application_crash_ratio

Application not responding event ratio

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of application not responding events per 100 executions.

NXQL ID:

application_not_responding_event_ratio

Audit account logon events

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account

NXQL ID:

audit_account_logon_events

Audit account management

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit each event of account management on a computer

NXQL ID:

audit_account_management

Audit directory service access

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified

NXQL ID:

audit_directory_service_access

Audit logon events

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit each instance of a user logging on to or logging off from a computer

NXQL ID:

audit_logon_events

Audit object access

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit the event of a user accessing an object, e.g. a file, folder, registry key, printer, and so forth-that has its own system access control list (SACL) specified

NXQL ID:

audit_object_access

Audit policy change

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies

NXQL ID:

audit_policy_change

Audit privilege use

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit each instance of a user exercising a user right

NXQL ID:

audit_privilege_use

Audit process tracking

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access

NXQL ID:

audit_process_tracking

Audit system events

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log

NXQL ID:

audit_system_events

Average application startup duration

Activity

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average time between the start of the process and the time a window is displayed (not taking into account the splash screen)

NXQL ID:

average_process_start_time

Average boot duration

Startup

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average (full or fast startup) boot duration.

NXQL ID:

average_boot_duration

Average Citrix RTT

Session performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Citrix RTT averaged across all session performance events.

  • Citrix ICA RTT represents the screen lag experienced by the user and it measures the time between a user input and the display of the response.

  • The measure is only available for Citrix ICA

NXQL ID:

average_citrix_rtt

Average CPU queue length

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average CPU queue length across all device performance events. Rounding is used for presenting the result as an integer.

NXQL ID:

average_cpu_queue_length

Average CPU usage

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average CPU usage across all device performance events.

NXQL ID:

average_cpu_usage

Average extended logon duration

Startup

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average extended logon duration.

NXQL ID:

average_extended_logon_duration

Average incoming network bitrate

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average incoming network bitrate

NXQL ID:

average_incoming_bitrate

Average incoming web bitrate

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average incoming bitrate of all underlying web requests, consolidated over time

NXQL ID:

average_incoming_bitrate

Average logon duration

Startup

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average logon duration.

NXQL ID:

average_logon_duration

Average memory usage

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average memory usage of the device across all device performance events.

NXQL ID:

average_memory_usage

Average memory usage per process

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the average memory usage per process for the given executions with the sampling resolution of 5 minutes.

  • Example: if two tabs of the Chrome browser are opened at the same time, two distinct processes of chrome.exe are launched and they are aggregated by the Engine in a single execution (with an event cardinality = 2). The average memory usage per process will represent the average memory usage of a single Chrome tab.

NXQL ID:

average_memory_usage_per_execution

Average network response time

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the average TCP connection establishment time of all underlying connections. The value is

the average TCP connection establishment time of all executions weighted by their cardinality.

NXQL ID:

average_network_response_time

Average normalized CPU usage

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average CPU usage across all device performance events. Value is normalized by the number of logical CPUs available.

NXQL ID:

average_normalized_cpu_usage

Average outgoing network bitrate

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average outgoing network bitrate

NXQL ID:

average_outgoing_bitrate

Average outgoing web bitrate

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average outgoing bitrate of all underlying web requests, consolidated over time

NXQL ID:

average_outgoing_bitrate

Average read operations per second

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average number of disk read operations per second across all device performance events.

NXQL ID:

average_read_operations

Average session network latency

Session performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the session network latency averaged across all session performance events.

  • It measures the performance of the network.

  • When the value is too high, the user will see some screen lag and a degraded user experience.

  • The measure is not available for local session.

NXQL ID:

average_session_network_latency

Average web request duration

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average time between request and last response byte

NXQL ID:

average_request_duration

Average web request size

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average size of web requests

NXQL ID:

average_request_size

Average web response size

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Average size of web responses

NXQL ID:

average_response_size

Average write operations per second

Device performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the average number of disk write operations per second across all device performance events.

NXQL ID:

average_write_operations

Binary paths

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

List of executed binary paths (max. 50 paths)

BIOS serial number

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

BIOS serial number

NXQL ID:

bios_serial_number

Chassis serial number

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Chassis serial number

NXQL ID:

chassis_serial_number

Collector assignment

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates whether Collector assignment service is enabled or disabled

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

cltr_ca_status

Collector assignment license UID

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the Collector assignment license UID

NXQL ID:

cltr_ca_license_uid

Collector CrashGuard count

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the number of consecutive hard resets or system crashes of the device

NXQL ID:

cltr_crash_guard_count

Collector CrashGuard limit

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Collector CrashGuard limit

NXQL ID:

cltr_crash_guard_limit

Collector CrashGuard protection interval

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the CrashGuard monitoring interval in minutes

NXQL ID:

cltr_crash_guard_protection_interval

Collector CrashGuard reactivation interval

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Collector CrashGuard reactivation interval in hours

NXQL ID:

cltr_crash_guard_react_interval

Collector installation log

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the link to the last Nexthink Collector installation error log.

NXQL ID:

collector_installation_log

Collector log level

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the Collector log level

  • off: no logs

  • critical: only critical logs are enabled

  • error: only error and critical logs are enabled

  • warning: only warning, error and critical logs are enabled

  • info: only info, warning, error and critical logs are enabled

  • debug: only debug, info, warning, error and critical logs are enabled

  • trace: only trace, debug, info, warning, error and critical logs are enabled

"-" : data not available

NXQL ID:

cltr_log_level

Collector status

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the status of the Nexthink Collector package installed on the device:

  • unmanaged: the Collector is not automatically updated

  • up-to-date: the Collector is up-to-date

  • outdated: a newer Collector version is available.

NXQL ID:

collector_status

Collector string tag

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the Collector string tag

NXQL ID:

cltr_string_tag

Collector tag

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Collector installation tag.

NXQL ID:

collector_tag

Collector update group

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the update group of Nexthink Collector:

  • manual: the Collector is manually updated

  • pilot: the Collector is updated as part of the pilot group

  • main: the Collector is updated as part of the main group.

NXQL ID:

upgrade_group

Collector update status

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the status of the Nexthink Collector updater.

NXQL ID:

collector_update_status

Collector version

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the version of the Nexthink Collector installed on the device.

NXQL ID:

collector_version

CPU frequency

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

CPU frequency

NXQL ID:

cpu_frequency

CPU model

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

CPU model

NXQL ID:

cpu_model

CPU usage ratio

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the sum of the CPU time of all executions on each device in scope over all logical processors divided by their total duration.

Executions shorter than 30 seconds are ignored.

  • Example: if we consider two executions with the first one taking 50% of a logical processor during 30 minutes and the second one taking 100% of 2 logical processors during 60 minutes, the CPU usage ratio is 150% (= [50% * 30 min + 2 * 100% * 60 min] / [30 min + 60 min]).

NXQL ID:

cpu_usage_ratio

Cumulated execution duration

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Cumulated duration of executions

NXQL ID:

cumulated_execution_duration

Cumulated interaction time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Cumulated time with user interaction (mouse or keyboard events)

NXQL ID:

cumulated_interaction_duration

Cumulated network connection duration

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Cumulated duration of TCP connections

NXQL ID:

cumulated_connection_duration

Data transport protocol

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Specifies if the Collector data is sent over TCP or UDP

  • UDP: the Collector data traffic is sent over UDP

  • TCP: the Collector data traffic is sent over TCP

"-" : data not available

NXQL ID:

cltr_data_channel_protocol

Database usage

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the percentage of the Engine database used by the device.

NXQL ID:

database_usage

Device access rule

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the name of the Exchange ActiveSync device access rule and if the rule allows, blocks or quarantines the device.

NXQL ID:

eas_device_access_rule

Device encryption required

Policy

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether device encryption is required.

NXQL ID:

device_encryption_required

Device identity

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the identity of the device in Exchange ActiveSync server.

NXQL ID:

eas_device_identity

Device manufacturer

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the device manufacturer.

NXQL ID:

device_manufacturer

Device model

Hardware

Field

Windows black.pngMac black.pngMobile black.png

Indicates the model of the device.

NXQL ID:

device_model

Device password required

Policy

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether a password is required on the device.

NXQL ID:

device_password_required

Device product ID

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Device product ID

NXQL ID:

device_product_id

Device product version

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Device product version

NXQL ID:

device_product_version

Device serial number

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the device serial number.

NXQL ID:

device_serial_number

Device type

Hardware

Field

Windows black.pngMac black.pngMobile black.png

Indicates the device type:

  • desktop

  • laptop

  • server

  • mobile

NXQL ID:

device_type

Device UUID

Properties

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the device universally unique identifier (UUID).

NXQL ID:

device_uuid

Disks S.M.A.R.T. index

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Lowest S.M.A.R.T. index of installed hard disks (index is based on S.M.A.R.T. attributes)

NXQL ID:

disks_smart_index

Distinguished name

Properties

Field

Windows black.pngMac gray disabled.pngMobile black.png

Indicates the distinguished name (DN) as seen:

  • For Windows: in Active Directory (AD); if no connection with AD is set up, a '-' is displayed

  • For Mobile: in the Exchange ActiveSync server

NXQL ID:

distinguished_name

Distinguished name reported by Collector

Properties

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the distinguished name as reported by the Collector.

A `-` is displayed if the device is not part of a domain.

NXQL ID:

collector_distinguished_name

Email attachment enabled

Policy

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether attachments can be downloaded to the mobile device through the Exchange ActiveSync protocol.

NXQL ID:

email_attachment_enabled

Enforce password history

Policy

Field

Windows black.pngMac gray disabled.pngMobile black.png

Indicates the number of unique password that have to be associated with a user account before an old password can be reused:

  • Windows: as set up in the group policy

  • Mobile: as set up in security policies

NXQL ID:

enforce_password_history

Engage

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates whether Engage is enabled or disabled

  • enabled: indicates that the status of Engage service in Collector is enabled

  • enabled except on server OS: indicates that the status of Engage service in Collector is enabled on all devices except on servers

  • disabled: indicates that the status of Engage service in Collector is disabled

"-" : data not available

NXQL ID:

cltr_engage_service_status

Entity

Properties

Field

Windows black.pngMac black.pngMobile black.png

Entity to which the device belongs

NXQL ID:

entity

Exemption

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether a personal exemption is set for the device and its user. Possible values are:

  • none

  • allow

  • block

NXQL ID:

eas_exemption

Extended logon duration baseline

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the extended logon duration averaged over the last logons. In the calculation, recent logons weigh more than older logons (exponentially

weighted moving average).

NXQL ID:

extended_logon_duration_baseline

Fast startup boot duration baseline

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicated the fast startup boot duration averaged over the fast startups. In the calculation, recent boots weigh more than older boots (exponentially weighted moving average).

NXQL ID:

average_fast_startup_duration

Firewall display name

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Name of the main firewall

NXQL ID:

firewall_name

Note: this field is not available for Windows Server operating systems.

Firewall RTP

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the firewall real time protection (RTP) is active:

  • on: indicates that RTP is active

  • off: indicates that either RTP is not active or no firewall has been detected

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

firewall_rtp

Note: this field is not available for Windows Server operating systems.

First seen

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the first time when the activity of the device was recorded:

  • For Windows and Mac OS: the first time Collector reported activity

  • For Mobile: the first time the device was reported with a successful synchronization

NXQL ID:

first_seen

Focus time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the amount of time any window of an application was in focus during the execution.

  • Example: the time Microsoft Teams is being executed (duration = 5h 10min 48s) will usually be considerably longer compared how long (Focus time = 52min 23s) its window(s) are forefront on the desktop.

NXQL ID:

focus_time

Full boot duration baseline

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicated the full boot duration averaged over the last full boots. In the calculation, recent full boots weigh more than older full boots (exponentially weighted moving average).

NXQL ID:

average_boot_duration

Graphical card RAM

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Amount of RAM of the graphical card with most RAM

NXQL ID:

graphical_card_ram

Graphical cards

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Installed graphical cards

NXQL ID:

graphical_cards

Group name

Network

Field

Windows black.pngMac black.pngMobile gray disabled.png

Name of computer domain or workgroup

NXQL ID:

group_name

Guest account status

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Determines if the Guest account is enabled or disabled

NXQL ID:

guest_account_status

Hard disks

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

List of all hard disks

NXQL ID:

hard_disks

Hard disks manufacturers

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the list of hard disk manufacturers

NXQL ID:

disks_manufacturers

High device IO throughput time ratio

Warnings

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the ratio between the time the device is in high IO throughput and its uptime.

NXQL ID:

high_device_io_throughput_time_ratio

High device memory time ratio

Warnings

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the ratio between the time the device is in high memory usage and its uptime.

NXQL ID:

high_device_memory_time_ratio

High device overall CPU time ratio

Warnings

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the ratio between the time the device is in high overall CPU usage and its uptime.

NXQL ID:

high_device_overall_cpu_time_ratio

High device page faults time ratio

Warnings

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the ratio between the time the device is in high page faults and its uptime.

NXQL ID:

high_device_page_faults_time_ratio

High device thread CPU time ratio (deprecated)

Warnings

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the ratio between the time that the device is in high thread CPU usage and its uptime.

Highest local privilege level reached

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Highest local privilege level reached for executions (user, power user, administrator)

NXQL ID:

highest_local_privilege_reached

Incoming network traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total network incoming traffic

NXQL ID:

incoming_traffic

Incoming web traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total web incoming traffic

NXQL ID:

incoming_traffic

Interaction time ratio

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Percentage of time with user interaction (mouse or keyboard events)

Internet security settings

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Internet security settings (ok, at risk or unknown)

NXQL ID:

internet_security_settings

IP addresses

Network

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the list of IP addresses seen from the Nexthink appliance. If the connection between

the device and the Nexthink appliance goes through network address translation (NAT), the IP addresses will be different than the local IP addresses set-up on the device.

NXQL ID:

ip_addresses

IP protocol DNS resolution

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the DNS resolution preference for Collector in terms of IP protocol version on the device

  • IPv4: prefer IPv4

  • IPv6: prefer IPv6

"-" : data not available

NXQL ID:

cltr_dns_res_preference

Last boot time

Startup

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the time of the last (full or fast startup) boot.

NXQL ID:

last_system_boot

Last boot time duration

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the duration of the last (full or fast startup) boot.

NXQL ID:

last_boot_duration

Last extended logon duration

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the last recorded value for the time between the user logging on and the device is ready.

NXQL ID:

last_extended_logon_duration

Last IP address

Network

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the IP address seen from the Nexthink appliance. If the connection between

the device and the Nexthink appliance goes through network address translation (NAT), the IP address will be different than the local IP address set-up on the device.

NXQL ID:

last_ip_address

Last known connection status

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the last known connection status of the device:

  • 'UDP only': the device is successfully connected via UDP.

  • 'TCP only': the device is successfully connected via TCP.

  • 'Fully connected': the device is successfully connected via both UDP and TCP, unless it has been configured to transmit only over TCP, in which case it has successfully connected via TCP.

NXQL ID:

last_known_connection_status

Last local IP address

Network

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the local IP address of the device. This field requires a collector version newer than 6.23 and connected through TCP.

NXQL ID:

last_local_ip_address

Last logged on user

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Last logged on user

NXQL ID:

last_logged_on_user

Last logged on user's privileges

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Privileges of the last logged on user (user, power user, administrator)

NXQL ID:

privileges_of_last_logged_on_users

Last logon duration

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the last recorded value for the time between the user logging on and the desktop is displayed.

NXQL ID:

last_logon_duration

Last logon time

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the time of the last logon.

NXQL ID:

last_logon_time

Last policy update

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the last time the Exchange ActiveSync policy was updated on the device.

NXQL ID:

eas_policy_update

Last seen

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the last time that activity on the device was reported:

  • For Windows and Mac OS: the last time that the Collector reported activity.

  • For Mobile: the last time that the device successfully synchronized with the Mobile Bridge.

NXQL ID:

last_seen

Last seen on TCP

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the last time that the device was successfully connected through the TCP channel.

  • '-': the Collector version is older than V6.6 and does not support TCP; or the Collector has never connected to Engine in TCP.

NXQL ID:

last_seen_on_tcp

Last system update

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Time of last system update

NXQL ID:

last_windows_update

Last update

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the last Collector update time.

NXQL ID:

last_update

Last update status

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the status of the last Collector update:

  • '-': the Collector was never updated

  • successful installation: the last Collector installation was successful

  • package download error: the Collector was not able to download the Collector package from Nexthink Appliance

  • package digital signature error: the Collector was not able to check the Collector package digital signature

  • device reboot required: the device needs to be rebooted to complete the Collector installation

  • package error: the Collector package installation has failed

  • internal error: the Collector package installation has failed for an unexpected reason.

NXQL ID:

last_update_status

Last Updater request

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the last time the Nexthink Updater has checked for updates.

NXQL ID:

last_updater_request

Local Administrators

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Users and groups which are members of the Local Administrators group on the device

NXQL ID:

local_administrators

Local Power Users

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Users and groups which are members of the Local Powers Users group on the device

NXQL ID:

local_power_users

Logical drives

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

List of all logical drives

NXQL ID:

logical_drives

Logon duration baseline

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the logon duration averaged over the last logons. In the calculation, recent logons weigh more than older logons (exponentially

weighted moving average).

NXQL ID:

average_logon_duration

Lowest observed web protocol version

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Lowest protocol version observed in web requests (excluding web requests with unknown protocol version)

NXQL ID:

lowest_protocol_version

MAC addresses

Network

Field

Windows black.pngMac black.pngMobile gray disabled.png

List of MAC addresses for the device

NXQL ID:

mac_addresses

Maximum password age

Policy

Field

Windows black.pngMac gray disabled.pngMobile black.png

Indicates the period in time (in days) during which the password can be used before the system requires the user to change it:

  • Windows: as set up in the group policy

  • Mobile: as set up in security policies

NXQL ID:

maximum_password_age

Membership type

Network

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Type of computer membership (domain/workgroup)

NXQL ID:

membership_type

Memory usage

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the average memory usage of executions, based on the total memory usage of underlying processes. Sampling resolution is 5 minutes.

  • Example: if two tabs of the Chrome browser are opened at the same time, two distinct processes of chrome.exe are launched and they are aggregated by the Engine in a single execution (with an event cardinality = 2). The memory usage will represent the total memory usage of the two Chrome tabs.

NXQL ID:

memory_usage

Message maximum segment size

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the maximum segment size of packets sent by Collector

NXQL ID:

cltr_max_segment_size

Minimum password age

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Period of time (in days) that a password must be used before the user can change it

NXQL ID:

minimum_password_age

Minimum password length

Policy

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Least number of characters that a password for a user account may contain

NXQL ID:

minimum_password_length

Monitor models

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Models of connected monitors

NXQL ID:

monitor_models

Monitor resolutions

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Screen resolutions of connected monitors

NXQL ID:

monitor_resolutions

Monitoring of unresponsive applications

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the Collector is monitoring for unresponsive applications on the device

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

cltr_freezes_monitoring

Monitors

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Connected monitors

NXQL ID:

monitors

Monitors serial numbers

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Serial numbers of connected monitors (ordered as in 'Monitors')

NXQL ID:

monitors_serial_numbers

Name

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the name of the device:

  • For Windows: NetBios Name

  • For Mac OS: computer name used on the network

  • For Mobile: composed by mailbox name and device friendly name

NXQL ID:

name

Network availability level

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the ratio of successful TCP connections. The possible values are:

  • high: the ratio is greater or equal to 98%

  • medium: the ratio is greater or equal to 90% and less than 98%

  • low: the ratio is lower than 90%

NXQL ID:

network_availability_level

Number of antispyware

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of antispyware detected:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

number_of_antispyware

Note: this field is not available for Windows Server operating systems.

Number of antiviruses

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of antiviruses detected:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

number_of_antiviruses

Note: this field is not available for Windows Server operating systems.

Number of application crashes

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of application crashes

NXQL ID:

number_of_application_crashes

Number of application not responding events

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of application not responding events

NXQL ID:

number_of_application_not_responding_events

Number of applications

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of applications

NXQL ID:

number_of_applications

Number of binaries

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of binaries

NXQL ID:

number_of_binaries

Number of boots

Startup

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of (full or fast startup) boot.

NXQL ID:

number_of_boots

Number of connections

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of connections

NXQL ID:

number_of_connections

Number of cores

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of CPUs multiplied by the number of cores that are available on each CPU.

NXQL ID:

number_of_cores

Number of CPUs

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of central processing units (CPUs), also known as the number of sockets.

NXQL ID:

number_of_cpus

Number of days since first seen

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the number of complete days since the device was first seen. The value is updated every hour.

NXQL ID:

number_of_days_since_first_seen

Number of days since last full boot

Startup

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of days since the last full boot.

NXQL ID:

number_of_days_since_last_boot

Number of days since last logon

Startup

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of days since last logon

NXQL ID:

number_of_days_since_last_logon

Number of days since last policy update

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the number of days since the last Exchange ActiveSync policy update.

NXQL ID:

number_of_days_since_last_eas_policy_update

Number of days since last seen

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the number of days since the last time that activity on the device was reported. The field is updated every hour:

  • For Windows and Mac OS: the last time that the Collector reported activity.

  • For Mobile: seen the last time that the device successfully synchronized with the Mobile Bridge.

NXQL ID:

number_of_days_since_last_seen

Number of days since last seen on TCP

Nexthink Collector

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of days since the last time that the device was successfully connected through the TCP channel. The field is updated every hour:

  • '-': the Collector version is older than V6.6 and does not support TCP; or the Collector has never connected to Engine in TCP.

NXQL ID:

number_of_days_since_last_seen_on_tcp

Number of days since last system update

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of days since last system update

NXQL ID:

number_of_days_since_last_windows_update

Number of destinations

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of destinations

NXQL ID:

number_of_destinations

Number of domains

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of domains

NXQL ID:

number_of_domains

Number of executables

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of executables

NXQL ID:

number_of_executables

Number of executions

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of executions

NXQL ID:

number_of_executions

Number of firewalls

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of firewalls detected:

  • unknown: indicates that the information could not be retrieved

  • N/A: this field is not available on this operating system

  • '-' : no data, incompatible collector version or the data is not yet available

NXQL ID:

number_of_firewalls

Note: this field is not available for Windows Server operating systems.

Number of graphical cards

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of installed graphical cards

NXQL ID:

number_of_graphical_cards

Number of hard resets

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of hard resets

Number of installations

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of installations

NXQL ID:

number_of_installations

Number of logical processors

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of cores multiplied by the number of threads that can run on each core through the use of hyperthreading.

NXQL ID:

logical_cpu_number

Number of logons

Startup

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of logons

NXQL ID:

number_of_logons

Number of monitors

Hardware

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of connected monitors

NXQL ID:

number_of_monitors

Number of packages

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of packages

NXQL ID:

number_of_packages

Number of ports

Inventory

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of ports

NXQL ID:

number_of_ports

Number of print jobs

Activity

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of print jobs

NXQL ID:

number_of_printouts

Number of printed pages

Activity

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of printed pages

NXQL ID:

number_of_printed_pages

Number of printers

Inventory

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Number of printers

NXQL ID:

number_of_printers

Number of system crashes

Errors

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the number of system crashes.

Number of users

Inventory

Aggregate

Windows black.pngMac black.pngMobile black.png

Number of users

NXQL ID:

number_of_users

Number of web requests

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Number of web requests

NXQL ID:

number_of_web_requests

OS architecture

Operating system

Field

Windows black.pngMac black.pngMobile gray disabled.png

Architecture of device operating system (x86/x64/ARM64)

NXQL ID:

os_architecture

OS build

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the build number of the operating system:

  • '0.0.0.0': incompatible collector version or the data is not yet available

NXQL ID:

os_build

OS version

Operating system (deprecated)

Field

Windows black.pngMac black.pngMobile black.png

Version of device operating system

OS version and architecture

Operating system

Field

Windows black.pngMac black.pngMobile black.png

Indicates name, version and architecture (when applicable) of the operating system:

  • Unknown: the OS version could not be retrieved or it could not be mapped to a recognized value

NXQL ID:

os_version_and_architecture

Outgoing network traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total network outgoing traffic

NXQL ID:

outgoing_traffic

Outgoing web traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total web outgoing traffic

NXQL ID:

outgoing_traffic

Packages and updates scan interval

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the interval, in hours, after which the Collector checks for newly installed packages and updates

NXQL ID:

cltr_installs_scan_interval

Password complexity requirements enabled

Policy

Field

Windows black.pngMac gray disabled.pngMobile black.png

Indicates whether password complexity is required:

  • Windows: the password must meet complexity requirements as defined in the group policy

  • Mobile: no simple passwords are allowed or a minimum password length is set, as defined in the security policy

NXQL ID:

password_complexity_requirements

Platform

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the platform of the device. A platform is a set of operating system families on which the same objects, activities, events and properties can be retrieved. The possible values are:

  • Windows

  • Mac OS

  • Mobile

NXQL ID:

platform

Policy allows non provisionable devices

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether a device which does not fully support the policy is still allowed to connect to the Exchange Exchange ActiveSync server.

  • If 'yes', the security policy is not guaranteed to be applied, even if the field 'ActiveSync policy application status' value is 'applied in full'

NXQL ID:

allow_non_provisionable_devices

Policy application status

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether the Exchange ActiveSync policy is applied or not. Possible values are:

  • not applied

  • applied in full: the policy is applied (unless the field 'Allow non provisionable devices' value is 'yes')

  • partially applied

NXQL ID:

eas_policy_application_status

Policy name

Exchange

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates the name of the Exchange ActiveSync policy applied to the user's mailbox.

NXQL ID:

eas_policy_name

Print monitoring

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the Collector printing monitoring is enabled or disabled

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

collector_print_monitoring_status

Protocols used in web requests

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Protocols used in web requests (HTTP, TLS, HTTP/TLS)

NXQL ID:

protocols_used_in_requests

Script execution policy

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Powershell script execution policy

  • unrestricted: indicates that Act service in Collector can execute any kind of scripts

  • signed, trusted: indicates that Act service in Collector can only execute scripts signed by a trusted authority

  • signed, trusted or nexthink: indicates that Act service in Collector can only execute scripts signed by a trusted authority or by Nexthink

  • disabled: indicates that Act service in Collector cannot execute scripts

"-" : data not available

NXQL ID:

cltr_ra_execution_policy

SD card encryption required

Policy

Field

Windows gray disabled.pngMac gray disabled.pngMobile black.png

Indicates whether SD card encryption is required.

NXQL ID:

sd_card_encryption_required

Session duration

Session performance

Aggregate

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the duration of the sessions summed across all session performance events.

NXQL ID:

session_duration

SID

Properties

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Windows security identifier for the device

NXQL ID:

sid

SMB print monitoring

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether SMB printing monitoring is enabled or disabled

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

cltr_smb_print_mon_status

Storage policy

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the event storage policy for the device. Possible values are:

  • all: web requests, connections and executions are stored

  • connections and executions

  • executions

  • none: no activity is recorded

  • remove: the device will be removed from Engine during the next cleanup, as long as it is no longer sending data

Note that available events depend on the device platform

NXQL ID:

storage_policy

Successful HTTP requests ratio

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Percentage of successful HTTP requests (1xx, 2xx and 3xx)

NXQL ID:

successful_http_requests_ratio

Successful network connections ratio

Availability

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Percentage of successful TCP connections

NXQL ID:

successful_connections_ratio

System disk type

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the type of the disk from which the device is booting.

  • HDD

  • SSD

"-" : data not available

NXQL ID:

boot_disk_type

System drive capacity

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total capacity of system drive

NXQL ID:

system_drive_capacity

System drive free space

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total available free space on system drive

NXQL ID:

system_drive_free_space

System drive usage

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Use percentage of system drive

NXQL ID:

system_drive_usage

Target version

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Collector package version that is targeted.

NXQL ID:

collector_package_target_version

Total active days

Activity

Field

Windows black.pngMac black.pngMobile black.png

Indicates the total number of days the device has been active. The value is updated every night.

NXQL ID:

total_active_days

Total CPU time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the sum of the CPU time of all executions on each device in scope and over all logical processors.

Executions shorter than 30 seconds are ignored.

  • Example: if we consider two executions with the first one taking 50% of a logical processor during 30 minutes and the second one taking 100% of 2 logical processors during 60 minutes, the total CPU time is 135 minutes (= 50% * 30 min + 2 * 100% * 60 min).

NXQL ID:

total_cpu_time

Total drive capacity

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total capacity of all drives

NXQL ID:

total_drive_capacity

Total drive free space

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total free space on all drives

NXQL ID:

total_drive_free_space

Total drive usage

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total use percentage of all drives

NXQL ID:

total_drive_usage

Total network traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total network traffic (incoming and outgoing)

NXQL ID:

total_network_traffic

Total non-system drive capacity

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total capacity of all non-system drives

NXQL ID:

total_nonsystem_drive_capacity

Total non-system drive free space

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total free space on all non-system drives

NXQL ID:

total_nonsystem_drive_free_space

Total non-system drive usage

Local drives

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total use percentage of all non-system drives

NXQL ID:

total_nonsystem_drive_usage

Total RAM

Hardware

Field

Windows black.pngMac black.pngMobile gray disabled.png

Total amount of RAM

NXQL ID:

total_ram

Total web traffic

Traffic

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Total web traffic (incoming and outgoing)

NXQL ID:

total_web_traffic

UID

Properties

Field

Windows black.pngMac black.pngMobile black.png

Indicates the universally unique identifier (based on Engine name and device ID).

NXQL ID:

device_uid

Updater error

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the last Nexthink Collector Updater error.

NXQL ID:

updater_error

Updater version

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Nexthink Collector Updater version.

NXQL ID:

updater_version

Uptime

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Amount of time the machine has been running

NXQL ID:

uptime

User account control status

Security

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

User account control status (ok, at risk or unknown)

NXQL ID:

user_account_control_status

VDI/Kiosk support

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether the Collector reports user logon events and user interactions in virtualized and embedded (kiosk mode) environments

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

cltr_custom_shells

Visibility from Add or Remove Programs

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether Collector is hidden in the "Add or Remove Programs"

  • invisible: indicates that the Collector application is not shown in the "add or remove programs" list

  • visible: indicates that the Collector application is shown in the "add or remove programs" list

"-" : data not available

NXQL ID:

cltr_is_visible

Web & Cloud monitoring

Nexthink Collector

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates whether Web & Cloud monitoring is enabled or disabled

  • disabled: indicates that the Collector feature is disabled

  • enabled: indicates that the Collector feature is enabled

"-" : data not available

NXQL ID:

cltr_web_mon_status

Web interaction time

Activity

Aggregate

Windows black.pngMac black.pngMobile gray disabled.png

Indicates the time during which at least one executable is doing HTTP or TLS traffic. This is counted with a 5-minute resolution.

NXQL ID:

cumulated_web_interaction_duration

Windows license key

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Indicates the Windows license key:

  • '-': the data is not yet available

  • 'BBBBB-BBBBB-BBBBB-BBBBB-BBBBB': Windows is activated, but the license key could not be retrieved

  • 'BBBBB-BBBBB-BBBBB-BBBBB-?????': the full license key is not present on the machine

  • 'Windows is not activated': Windows is not activated

NXQL ID:

windows_license_key

Windows Update status

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Windows Update status (ok, at risk or unknown)

NXQL ID:

windows_updates_status

WMI status

Operating system

Field

Windows black.pngMac gray disabled.pngMobile gray disabled.png

Windows WMI service status (ok, failure)

NXQL ID:

wmi_status