# Configuring Collector level anonymization

## Anonymization capabilities <a href="#configuringcollectorlevelanonymization-anonymizationcapabilities" id="configuringcollectorlevelanonymization-anonymizationcapabilities"></a>

Nexthink offers various ways to anonymize data along with granular controls for user privacy. The approach described in this article complements similar features offered by the data storage layer, ensuring that data leaving the Microsoft Windows or macOS devices is anonymized.

If the data anonymization is enabled for the user name and activity at the Collector level, there is no need to enable the server-side equivalents.

| Data                                            | Description                                                                                                                                                                                                                                | Available privacy options                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                 | Default privacy options                   |
| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------- |
| **User name**                                   | User logon name reported from the device.                                                                                                                                                                                                  | <p><code>cleartext</code> The collector reports the username in cleartext.</p><p><code>hashed</code> The collector hashes the username before sending it to the backend.</p><p><code>no\_import</code> Collector does not collect the username at all.<br></p><p><strong>Note:</strong> The integration with Microsoft Active Directory using the <a href="../../integrating-nexthink-with-third-party-tools/api-and-integrations-classic/data-enricher-classic">Data Enricher (classic)</a> or Microsoft Entra ID using the <a href="../../integrating-nexthink-with-third-party-tools/inbound-connectors/connector-for-microsoft-entra-id-azure-ad">Connector for Microsoft Entra ID</a> are independent from this Collector configuration. Ensure that the list of AD fields retrieved by the Data Enricher (classic) and Connector for Microsoft Entra ID is properly configured.</p> | `cleartext`                               |
| **User Principal Name (UPN)**                   | Standardized user identifier that usually takes the form of an email address. The UPN allows the system to identify a user across systems uniquely. Nexthink also uses the UPN to enrich user objects with data from third-party services. | <p><code>cleartext</code> The collector reports the UPN in cleartext.</p><p><code>hashed</code> The collector hashes the UPN before sending it to the backend.</p><p><code>no\_import</code> Collector does not collect the UPN at all.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               | `no_import`                               |
| **Focus time**                                  | Reports the application focus duration while the application’s windows were in focus.                                                                                                                                                      | <p><code>enable</code> Execution events <em>contain</em> information about how long the application was in focus.</p><p><code>disable</code> Execution events <em>do not contain</em> information about how long the application was in focus.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        | `disable`                                 |
| **User activity**                               | Controls the reporting of the time the user was interacting with the mouse, touchpad or keyboard.                                                                                                                                          | <p><code>enable</code> Collector reports time periods when the user is actively using a device.</p><p><code>disable</code> Collector does not report time periods when the user is actively using a device.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           | `enable`                                  |
| **Wi-Fi network**                               | Manages the reporting of the identification details for both the SSID and the BSSID with Wi-FI performance metrics.                                                                                                                        | <p><code>enable</code> Collector reports only performance metrics and connection attributes.</p><p><code>disable</code> Collector reports the SSID and BSSID of the connected hotspots in addition to the performance metrics and connection attributes.<br><br><strong>Note:</strong> On Windows 11 version 24H2 and later, enable the <strong>Location services</strong> setting to allow reporting Wi-Fi data.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `enable`                                  |
| **Network connections**                         | Manages the reporting of network connection data.                                                                                                                                                                                          | <p><code>enable</code> Collector reports network connections for all binaries including destination attributes and connection metrics.</p><p><code>disable</code> Collector reports no network connection data.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       | `enable`                                  |
| **Domain name**                                 | Manages the reporting of the destination’s domain name for network connections.                                                                                                                                                            | <p><code>enable</code> Collector reports the domain name of the destination.</p><p><code>disable</code> Collector reports no domain name for network connections.</p>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     | `disable`                                 |
| **Data privacy filter for network connections** | Report network connections according to a user-defined `ALLOW` / `BLOCK` rules.                                                                                                                                                            | Refer to [data privacy filter](#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter) section for more information.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                | Collector reports all network connections |

## Changing the default privacy options <a href="#configuringcollectorlevelanonymization-changingthedefaultprivacyoptions" id="configuringcollectorlevelanonymization-changingthedefaultprivacyoptions"></a>

There are various configuration options to change the default privacy setting for each data type. Review the different options to find the right method for your environment and situation.

<table data-full-width="true"><thead><tr><th>Configuration via</th><th>Used for</th><th>User name</th><th>UPN</th><th>Focus time</th><th>User activity</th><th>Wi-Fi network</th><th>Network connections</th><th>Domain name</th><th>Data privacy filter</th></tr></thead><tbody><tr><td>Remote Actions</td><td>Existing installations</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Windows Collector installer</td><td>New installations</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>Windows registry</td><td>Existing installations</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>macOS Collector installer</td><td>New installations</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr><tr><td>macOS Collector configuration</td><td>Existing installations</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td><td>✓</td></tr></tbody></table>

### Remote Actions <a href="#configuringcollectorlevelanonymization-remoteactions" id="configuringcollectorlevelanonymization-remoteactions"></a>

Change the Collector configuration parameter for the **User name, Wi-Fi Network**, and **UPN** on Windows and macOS operating systems with the *Set anonymization features* remote action.

Configure **Focus time** and **User activity** on Windows and macOS operating systems with the *Set Collector configuration* remote action.

Configure **Network connections**, **Domain name** and **Data privacy filter** on Microsoft Windows and macOS operating systems with the *Set application connectivity configuration* remote action.

The remote actions set the appropriate registry keys and configuration fields for you.

### Windows Collector installer <a href="#configuringcollectorlevelanonymization-windowscollectorinstaller" id="configuringcollectorlevelanonymization-windowscollectorinstaller"></a>

Use the following optional parameters to change the default values for each data type:

<table data-header-hidden data-full-width="true"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>User name</strong></td><td><p>Parameter name: <code>ANONYMIZE_USERNAME</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no_import</code></li></ul><p>Example: <code>ANONYMIZE_USERNAME=no_import</code></p></td></tr><tr><td><strong>User Principal Name (UPN)</strong></td><td><p>Parameter name: <code>UPN_PRIVACY</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no_import</code></li></ul><p>Example: <code>UPN_PRIVACY=hashed</code></p></td></tr><tr><td><strong>Focus time</strong></td><td><p>Parameter name: <code>WINDOW_FOCUS_TIME_MONITORING</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>WINDOW_FOCUS_TIME_MONITORING=enable</code></p></td></tr><tr><td><strong>User activity</strong></td><td><p>Parameter name: <code>USER_INTERACTION_TIME_MONITORING</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>USER_INTERACTION_TIME_MONITORING=disable</code></p></td></tr><tr><td><strong>Wi-Fi network</strong></td><td><p>Parameter name: <code>ANONYMIZE_WIFI_NETWORK</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>ANONYMIZE_WIFI_NETWORK=disable</code></p></td></tr><tr><td><strong>Network connections</strong></td><td><p>Parameter name: <code>CONNECTIONS_REPORTING</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>CONNECTIONS_REPORTING=disable</code></p></td></tr><tr><td><strong>Domain name</strong></td><td><p>Parameter name: <code>DOMAIN_NAME_REPORTING</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>DOMAIN_NAME_REPORTING=enable</code></p></td></tr><tr><td><strong>Data privacy filter</strong></td><td><p>Parameter name: <code>DATA_PRIVACY_FILTER</code></p><p>Parameter values: <code>[a comma separated list of ALLOW / BLOCK rules]</code></p><p>Example: <code>DATA_PRIVACY_FILTER="ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"</code><br></p><p>Refer to <a href="#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter">data privacy filter</a> section for more information.</p></td></tr></tbody></table>

### Windows registry <a href="#configuringcollectorlevelanonymization-windowsregistrywinconfig" id="configuringcollectorlevelanonymization-windowsregistrywinconfig"></a>

Use the Windows registry to adjust the default value of the relevant key.

<table data-header-hidden data-full-width="true"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>User name</strong></td><td><p>Adjust the <strong>UserName</strong> value of <strong>AnonymizedData</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>UserName</code></p><p>Value data:</p><ul><li><code>0</code> → cleartext</li><li><code>1</code> → hashed</li><li><code>2</code> → no_import</li></ul></td></tr><tr><td><strong>User Principal Name (UPN)</strong></td><td><p>Adjust the <strong>UpnPrivacy</strong> value of the <strong>AnonymizedData</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>UpnPrivacy</code></p><p>Value data:</p><ul><li><code>0</code> → no_import</li><li><code>1</code> → hashed</li><li><code>2</code> → cleartext</li></ul></td></tr><tr><td><strong>Focus time</strong></td><td><p>Adjust the <strong>Enabled</strong> value of the <strong>WindowFocusTimeMonitoring</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\WindowFocusTimeMonitoring</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>Enabled</code></p><p>Value data:</p><ul><li><code>0</code> → disable</li><li><code>1</code> → enable</li></ul></td></tr><tr><td><strong>User activity</strong></td><td><p>Adjust the <strong>Disabled</strong> value of the <strong>UserInteractionTimeMonitoring</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\UserInteractionTimeMonitoring</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>Disabled</code></p><p>Value data:</p><ul><li><code>0</code> → disable</li><li><code>1</code> → enable</li></ul></td></tr><tr><td><strong>Wi-Fi network</strong></td><td><p>Adjust the <strong>WifiNetwork</strong> value of the <strong>AnonymizedData</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>WifiNetwork</code></p><p>Value data:</p><ul><li><code>0</code> → disable</li><li><code>1</code> → enable</li></ul></td></tr><tr><td><strong>Network connections</strong></td><td><p>Adjust the <strong>ConnectionsReporting</strong> value of the <strong>AppConnectivity</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>ConnectionsReporting</code></p><p>Value data:</p><ul><li><code>0</code> → disable</li><li><code>1</code> → enable</li></ul></td></tr><tr><td><strong>Domain name</strong></td><td><p>Adjust the <strong>DomainNameReporting</strong> value of the <strong>AnonymizedData</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AnonymizedData</code></p><p>Data type: <code>DWORD (32-bit)</code></p><p>Value name: <code>DomainNameReporting</code></p><p>Value data:</p><ul><li><code>0</code> → disable</li><li><code>1</code> → enable</li></ul></td></tr><tr><td><strong>Data privacy filter</strong></td><td><p>Adjust the <strong>DataPrivacyFilter</strong> value of the <strong>AppConnectivity</strong> key.</p><p>Key name: <code>HKEY_LOCAL_MACHINE\SOFTWARE\Nexthink\Collector\AppConnectivity</code></p><p>Data type: <code>String (REG_SZ)</code></p><p>Value name: <code>DataPrivacyFilter</code></p><p>Value data example: <code>"ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"</code><br><br>Refer to <a href="#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter">data privacy filter</a> section for more information.</p></td></tr></tbody></table>

For the changes to take effect, follow this sequence:

1. Stop Collector.
2. Modify the registry.
3. Start Collector.

### macOS Collector installer <a href="#configuringcollectorlevelanonymization-macoscollectorinstaller" id="configuringcollectorlevelanonymization-macoscollectorinstaller"></a>

Use the following optional parameters to change the default values for each data type:

| **User name**                 | <p>Parameter name: <code>anonymize\_username</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no\_import</code></li></ul><p>Example: <code>anonymize\_username=hashed</code></p>                                                                                                                                                                                                                                               |
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **User Principal Name (UPN)** | <p>Parameter name: <code>upn\_privacy</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no\_import</code></li></ul><p>Example: <code>upn\_privacy=hashed</code></p>                                                                                                                                                                                                                                                             |
| **Focus time**                | <p>Parameter name: <code>windows\_focus\_time\_monitoring</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>windows\_focus\_time\_monitoring=enable</code></p>                                                                                                                                                                                                                                                       |
| **User activity**             | <p>Parameter name: <code>user\_interaction\_time\_monitoring</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>user\_interaction\_time\_monitoring=disable</code></p>                                                                                                                                                                                                                                                |
| **Wi-Fi network**             | <p>Parameter name: <code>anonymize\_wifi\_network</code></p><p>Parameter values:</p><ul><li><code>enable</code></li><li><code>disable</code></li></ul><p>Example: <code>anonymize\_wifi\_network=disable</code></p>                                                                                                                                                                                                                                                                      |
| **Network connections**       | <p>Parameter name: <code>connections\_reporting</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example: <code>connections\_reporting=false</code></p>                                                                                                                                                                                                                                                                                |
| **Domain name**               | <p>Parameter name: <code>domain\_name\_reporting</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example: <code>domain\_name\_reporting=true</code></p>                                                                                                                                                                                                                                                                               |
| **Data privacy filter**       | <p>Parameter name: <code>data\_privacy\_filter</code></p><p>Parameter values: <code>\[a comma separated list of ALLOW / BLOCK rules]</code></p><p>Example: <code>data\_privacy\_filter="ALLOW \*.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW \[fe80::1ff:fe23:4567:890a]:8080"</code><br></p><p>Refer to <a href="#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter">data privacy filter</a> section for more information.</p> |

### macOS Collector configuration <a href="#configuringcollectorlevelanonymization-macoscollectorconfigurationmacconfig" id="configuringcollectorlevelanonymization-macoscollectorconfigurationmacconfig"></a>

Use the macOS Collector configuration file `config.json` located in the folder `/Library/Application Support/Nexthink` to add the following parameters on a new line at the end of the file before the closing curly bracket:

<table data-header-hidden data-full-width="true"><thead><tr><th></th><th></th></tr></thead><tbody><tr><td><strong>User name</strong></td><td><p>Parameter name: <code>AnonymizeUserName</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no_import</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"AnonymizeUserName": "no_import"
}
</code></pre></td></tr><tr><td><strong>User Principal Name (UPN)</strong></td><td><p>Parameter name: <code>UpnPrivacy</code></p><p>Parameter values:</p><ul><li><code>cleartext</code></li><li><code>hashed</code></li><li><code>no_import</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"UpnPrivacy": "cleartext"
}
</code></pre></td></tr><tr><td><strong>Focus time</strong></td><td><p>Parameter name: <code>EnableWindowFocusTimeMonitoring</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"EnableWindowFocusTimeMonitoring": "true"
}
</code></pre></td></tr><tr><td><strong>User activity</strong></td><td><p>Parameter name: <code>DisableUserInteractionTimeMonitoring</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"DisableUserInteractionTimeMonitoring": "true"
}
</code></pre></td></tr><tr><td><strong>Wi-Fi network</strong></td><td><p>Parameter name: <code>AnonymizeWifiNetwork</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"AnonymizeWifiNetwork": "false"
}
</code></pre></td></tr><tr><td><strong>Network connections</strong></td><td><p>Parameter name: <code>ConnectionsReporting</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"ConnectionsReporting": "false"
}
</code></pre></td></tr><tr><td><strong>Domain name</strong></td><td><p>Parameter name:<code>DomainNameReporting</code></p><p>Parameter values:</p><ul><li><code>false</code></li><li><code>true</code></li></ul><p>Example of the end of a configuration file:</p><pre class="language-json"><code class="lang-json">...
"DomainNameReporting": "true"
}
</code></pre></td></tr><tr><td><strong>Data privacy filter</strong></td><td><p>Parameter name: <code>DataPrivacyFilter</code></p><p>Parameter values:<code>[a comma separated list of ALLOW / BLOCK rules]</code></p><p>Example of the end of a configuration file:</p><pre class="language-json" data-overflow="wrap"><code class="lang-json">...
"DataPrivacyFilter": "ALLOW *.nexthink.com, ALLOW nexthink.eu.nexthink.cloud, ALLOW 100.64.0.0/16, ALLOW [fe80::1ff:fe23:4567:890a]:8080"
}
</code></pre><p>Refer to <a href="#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter">data privacy filter</a> section for more information.</p></td></tr></tbody></table>

For the changes to take effect, follow this sequence:

1. Stop Collector.
2. Modify the configuration file.
3. Start Collector.

## Data privacy filter <a href="#configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter" id="configuringcollectorlevelanonymization-dataprivacyfilterdata-privacy-filter"></a>

Configure Collector to report only connections to specific destinations. Refer to the [Windows registry](#configuringcollectorlevelanonymization-windowsregistrywinconfig) and [macOS Collector configuration](#configuringcollectorlevelanonymization-macoscollectorconfigurationmacconfig) sections for more information.

The `DataPrivacyFilter` configuration parameter takes a comma-separated list of `ALLOW` and `BLOCK` filter rules. Each filter rule takes the following form: `ALLOW | BLOCK [PATTERN]`

There are four options for the `[PATTERN]`:

* A domain name with an optional port number, for example: `abc.intra.nexthink.com:443`
* A domain name with a leading wildcard (“\*”) and an optional port number, for example: `*.nexthink.com:443`
* An IP address (IPv4 or IPv6) with optional port number, for example: `192.0.2.123:443`
* A subnet mask, for example: `192.0.2.0/24`

{% hint style="info" %}
Users must put IPv6 IP addresses into brackets to combine them with a port number, for example: `ALLOW [fe80::1ff:fe23:4567:890a]:8080` The brackets are optional for IPv6-base rules without port number.
{% endhint %}

### Domain Name with Wildcard <a href="#configuringcollectorlevelanonymization-domainnamewithwildcard" id="configuringcollectorlevelanonymization-domainnamewithwildcard"></a>

In domain name based patterns, use a “\*” wildcard to match zero, one, or multiple sub-domains.

For example, `ALLOW *.nexthink.com` matches all these domain names:

* `nexthink.com`
* `intra.nexthink.com`
* `abc.intra.nexthink.com`

The domain name based patterns with a “\*” wildcard must start with the “\*” wildcard instead of a sub-domain.

* `ALLOW *.nexthink.com` -> OK
* `ALLOW intra.*.nexthink.com` -> not OK
* `ALLOW nexthink.*` -> not OK
* `ALLOW *nexthink.com` -> not OK

### Default Rules <a href="#configuringcollectorlevelanonymization-defaultrules" id="configuringcollectorlevelanonymization-defaultrules"></a>

There are two default rules:

* System default rule: `BLOCK *` ("block everything else"). The system automatically adds this rule, if there is at least one user-defined rule.
* User-defined default rule: `ALLOW *` ("allow everything else").

The user-defined default rule overwrites the system default rule.

These defaults apply to the following cases:

| Case                                                                             | Default                                                                                                           |
| -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| The DataPrivacyFilter is not configured or parameter value is empty.             | The Collector reports all connections.                                                                            |
| The DataPrivacyFilter is configured and there is at least one user-defined rule. | The Collector `ALLOW` / `BLOCK` connections reporting based on the user defined rules and blocks everything else. |

{% hint style="info" %}
The Collector reports no connections if you only define `BLOCK` rules.
{% endhint %}

### Filter Rule Evaluation <a href="#configuringcollectorlevelanonymization-filterruleevaluation" id="configuringcollectorlevelanonymization-filterruleevaluation"></a>

Collector evaluates rules in the order from more specific to less specific:

1. IP address with port number.
2. IP address without port number.
3. Domain name with many sub-domains before domain names with fewer sub-domains.
4. Domain name with port before domain name without port.
5. Domain name without wildcard (`*`) before domain name with a wildcard.
6. Subnet mask.
7. User-defined default rule (`ALLOW *`) before system default rule (`BLOCK *`).

### Considerations <a href="#configuringcollectorlevelanonymization-considerations" id="configuringcollectorlevelanonymization-considerations"></a>

1. You can configure up to 1,000 filter rules. The system only evaluates the first 1,000 if there are more filter rules.
2. Rules based on domain names do not apply to connections without a domain name.
3. In case of a connection with *multiple domain names* and conflicting matching rules (`ALLOW` / `BLOCK`), the `ALLOW` rule overrules the `BLOCK` pattern.
4. Collector does not support IPv4 addresses in IPv6 format. An IPv4 filter rule in IPv6 format does not match connections with the corresponding IPv4 address.