Configuring Collector-level anonymization

This page applies to Collector version 26.5 and later connecting to tenants using Device configuration profiles. To understand how anonymization works for Collector versions earlier than 26.5, refer to the Configuring Collector-level anonymization (classic) page.

Nexthink offers various ways to anonymize data along with granular controls for user privacy. The approaches described in this documentation complement similar features offered by the data storage layer, ensuring that data leaving the Microsoft Windows or macOS devices is anonymized.

Anonymization options

Starting with Collector version 26.5, the system manages anonymization settings in Device configuration profiles. For these settings, the system ignores values originating from classic settings, such as Remote actions, installer parameters, registry settings, and Collector configuration files.

The following table lists each anonymization option and the available settings for them.

Data	Description	Privacy options	Default privacy option
User name	User logon name reported from the device.	Enabled: The system reports the user account name. The user.name is populated and available in Nexthink Query Language (NQL), dashboards, and Remote actions. Disabled: The system does not report the user account name. The user.name is empty. The system tracks users anonymously by security identifier (SID). Directory enrichment by name and name-based targeting are unavailable. Note: The integration with Microsoft Active Directory using the Data Enricher (classic) or Microsoft Entra ID using the Connector for Microsoft Entra ID are independent from this Collector configuration. Ensure that the list of AD fields retrieved by the Data Enricher (classic) and Connector for Microsoft Entra ID is properly configured. Note: The hashed option has been removed from Collector version 26.5 onwards and unavailable in the UI settings. If set in an earlier Collector version, the Collector will keep reporting hashed until it is updated to 26.5 or later.	Enabled
User Principal Name (UPN)	Standardized user identifier that usually takes the form of an email address. The UPN allows the system to identify a user across systems uniquely. Nexthink also uses the UPN to enrich user objects with data from third-party services.	Enabled: The system reports the UPN. user.upn is populated and available in NQL. The system uses it for cross-system user identification and connector-based enrichment. Disabled: The system does not collect the UPN. user.upn is empty. Cross-system user identification, connector-based enrichment, Spark, AI Tools, and other UPN-dependent features are unavailable. Note: The hashed option has been removed from Collector version 26.5 onwards and unavailable in the UI settings. If set in an earlier Collector version, the Collector will keep reporting hashed until it is updated to 26.5 or later.	Enabled
Application focus time	Reports the application focus duration while the application’s windows were in focus.	Enabled: The system populates focus_time on execution events and makes it available in NQL, dashboards, and software metering. Disabled: The focus_time is empty. Software metering and AI tool usage tracking are unavailable.	Enabled
User interaction time	Controls the reporting of the time the user was interacting with the mouse, touchpad or keyboard.	Enabled: The system reports active usage intervals. user_interaction_time is populated on session events and available in NQL and dashboards. Disabled: The system does not report active usage intervals. user_interaction_time is empty. User availability metrics and features that depend on engagement signals are unavailable.	Enabled
Wi-Fi network names	Manages the reporting of the identification details for both the SSID and the BSSID with Wi-Fi performance metrics.	Enabled: The system reports SSID and BSSID alongside Wi-Fi performance data. Disabled: The system does not collect SSID and BSSID. The system still reports Wi-Fi performance metrics, but network-specific identification and troubleshooting are unavailable. Note: Only supported on Windows. On Windows 11 version 24H2 and later, enable the Location services setting to allow reporting Wi-Fi data.	Enabled
Network connections	Manages the reporting of network connection data.	Enabled with domain names: The system reports connection events, including the DNS domain name of each destination (destination.domain). This enables destination-level identification and filtering in NQL and Device View. Enabled: The system reports connection events without destination domain names. destination.domain is empty. Disabled: The system generates no connection events. Network analytics, application network visibility, and execution-level traffic metrics are unavailable.	Enabled
Network connections (advanced filtering)	Reports network connections according to user-defined ALLOW / BLOCK rules.	Refer to the Network connections (advanced filtering) section for more information.	Collector reports all network connections

Network connections (advanced filtering)

This option allows you to configure a filter for Collector, forcing it to report connections only to specific destinations.

The filter is a comma-separated list of ALLOW and BLOCK rules. Each filter rule takes the following form: ALLOW | BLOCK [PATTERN]

There are four options for the [PATTERN]:

• A domain name with an optional port number, for example: abc.intra.nexthink.com:443
• A domain name with a leading * wildcard and an optional port number, for example: *.nexthink.com:443
• An IP address (IPv4 or IPv6) with optional port number, for example: 192.0.2.123:443
• A subnet mask, for example: 192.0.2.0/24

Enclose IPv6 addresses in brackets when you combine them with a port number, for example: ALLOW [fe80::1ff:fe23:4567:890a]:8080. Brackets are optional for IPv6-based rules without a port number.

Domain name with wildcard

In domain name based patterns, use a * wildcard to match zero, one, or multiple sub-domains.

For example, ALLOW *.nexthink.com matches all these domain names:

• nexthink.com
• intra.nexthink.com
• abc.intra.nexthink.com

The domain name based patterns with a * wildcard must start with the * wildcard instead of a sub-domain.

Correct example:

• ALLOW *.nexthink.com

Incorrect examples:

• ALLOW intra.*.nexthink.com
• ALLOW nexthink.*
• ALLOW *nexthink.com

Default rules

There are two default rules:

• System default rule: BLOCK * ("block everything else"). The system automatically adds this rule, if there is at least one user-defined rule.
• User-defined default rule: ALLOW * ("allow everything else").

The user-defined default rule overwrites the system default rule.

These defaults apply to the following cases:

Case	Default
The filter is not configured or parameter value is empty.	The Collector reports all connections.
The filter is configured and there is at least one user-defined rule.	The Collector reports connections according to the user-defined ALLOW / BLOCK rules and blocks everything else.

If you define only BLOCK rules, the Collector reports no connections.

Filter rule evaluation

Collector evaluates rules in the order from more specific to less specific:

1. IP address with port number.
2. IP address without port number.
3. Domain name with many sub-domains before domain names with fewer sub-domains.
4. Domain name with port before domain name without port.
5. Domain name without wildcard (*) before domain name with a wildcard.
6. Subnet mask.
7. User-defined default rule (ALLOW *) before system default rule (BLOCK *).

Considerations

• You can configure up to 1,000 filter rules. The system only evaluates the first 1,000 if there are more filter rules.
• Rules based on domain names do not apply to connections without a domain name.
• In case of a connection with multiple domain names and conflicting matching rules (ALLOW / BLOCK), the ALLOW rule overrules the BLOCK pattern.
• Collector does not support IPv4 addresses in IPv6 format. An IPv4 filter rule in IPv6 format does not match connections with the corresponding IPv4 address.