# NXQL data model (classic)
Download the full data model:
## Objects
### application
An application is a set of executables e.g. 'Microsoft Office'.
| Name | Type | Operating systems | Properties | |
| ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| company | string | Windows | macOS | |
| | Company producing the application | | | |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the application | | | |
| description | string | Windows | | |
| | Application description | | | |
| first\_seen | datetime | Windows | macOS | NU |
| | First time activity of the application was recorded on any device. | | | |
| id | identifier | Windows | macOS | |
| | Unique application identifier | | | |
| known\_packages | string | Windows | macOS | |
| | List of packages known to contain the application. This list is not exhaustive: The presence of a package does not necessarily imply that on a given device the application was installed through that package. | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Last time activity of the application was recorded on any device. | | | |
| name | string | Windows | macOS | |
| | Application name | | | |
| platform | enum | Windows | macOS | |
| | The platform (operating system family) on which the application is running. | | | |
| storage\_policy | enum | Windows | macOS | |
| | Indicates the event storage policy for the application. Possible values are:
- all: web requests, connections and executions are stored;
- connections and executions;
- executions;
- none: no activity is recorded.
| | | |
| total\_active\_days | day | Windows | macOS | |
| | Total number of days the application was active. | | | |
### binary
A binary is an executable binary file identified by its hash code.
| Name | Type | Operating systems | Properties | | |
| --------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- | - |
| application\_category | string | Windows | macOS | SE | |
| | Indicates the category of the application:
- '-': Not yet tagged;
- Unknown: Not categorized by Nexthink Library.
| | | | |
| application\_company | string | Windows | macOS | | |
| | Application company | | | | |
| application\_name | string | Windows | macOS | | |
| | Application name | | | | |
| architecture | enum | Windows | macOS | | |
| | Executable architecture (32/64 bit) | | | | |
| average\_cpu\_usage | permill | Windows | | | |
| | Average CPU usage for the binary | | | | |
| average\_memory\_usage | byte | Windows | | NU | |
| | Average memory usage for the binary | | | | |
| average\_number\_of\_graphical\_handles | integer | Windows | | NU | |
| | Average number of graphical handles (GDI) | | | | |
| company | string | Windows | macOS | | |
| | Executable company | | | | |
| database\_usage | permill | Windows | macOS | | |
| | Percentage of the database used by information related with the binary. | | | | |
| description | string | Windows | | | |
| | Description as it appears in the binary file. | | | | |
| executable\_name | string | Windows | macOS | | |
| | Executable name | | | | |
| file\_size | byte | Windows | macOS | | |
| | Binary file size | | | | |
| first\_seen | datetime | Windows | macOS | NU | |
| | First time activity of the binary was recorded on any device. | | | | |
| hash | md5 | Windows | macOS | | |
| | Hash code of the binary (MD5) | | | | |
| id | identifier | Windows | macOS | | |
| | Unique binary identifier | | | | |
| last\_seen | datetime | Windows | macOS | NU | |
| | Last time activity of the binary was recorded on any device. | | | | |
| paths | path | Windows | macOS | | |
| | List of paths of the binary | | | | |
| platform | enum | Windows | macOS | | |
| | The platform (operating system family) on which the binary is running. | | | | |
| sha1 | sha1 | Windows | macOS | | |
| | SHA-1 hash code of the binary | | | | |
| sha256 | sha256 | Windows | macOS | | |
| | SHA-256 hash code of the binary | | | | |
| storage\_policy | enum | Windows | macOS | | |
| | Event storage policy for the binary (connection and execution, execution-only or none) | | | | |
| threat\_level | enum | Windows | macOS | SE | |
| | Indicates the threat level of the binary:
- '-': Not yet tagged;
- none detected: No known threat;
- low: low threat;
- intermediate: Intermediate threat;
- high: high threat.
| | | | |
| total\_active\_days | day | Windows | macOS | | |
| | Total number of days the binary was active. | | | | |
| user\_interface | boolean | Windows | | | |
| | Application has interactive user interface | | | | |
| version | version | Windows | macOS | | |
| | Version of the binary | | | | |
### destination
A destination is a device or server receiving TCP/UDP connections.
| Name | Type | Operating systems | Properties | |
| --------------- | --------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the destination | | | |
| first\_seen | datetime | Windows | macOS | NU |
| | First time activity to the destination was recorded on any device. | | | |
| id | identifier | Windows | macOS | |
| | Unique destination identifier | | | |
| ip\_address | ip\_address | Windows | macOS | |
| | IP address for the destination | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Last time activity to the destination was recorded on any device. | | | |
| name | string | Windows | macOS | |
| | Reverse lookup name | | | |
### device
A device is Windows physical or virtual machine monitored by a Nexthink Collector.
| Name | Type | Operating systems | Properties | |
| -------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| administrator\_account\_status | enum | Windows | | |
| | Determines whether the local Administrator account is enabled or disabled. | | | |
| all\_antispywares | string | Windows | | |
| | Summary information about all the detected antispyware:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| all\_antiviruses | string | Windows | | |
| | Summary information about all the detected antiviruses:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| all\_firewalls | string | Windows | | |
| | Summary information about all the detected firewalls:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| allow\_non\_provisionable\_devices | boolean | | | NU |
| | Indicates whether a device which does not fully support the policy is still allowed to connect to the Exchange Exchange ActiveSync server. If 'yes', the security policy is not guaranteed to be applied, even if the field 'ActiveSync policy application status' value is 'applied in full' | | | |
| antispyware\_name | string | Windows | | NU |
| | Name of the main antispyware | | | |
| antispyware\_rtp | enum | Windows | | |
| | Indicates whether the antispyware real time protection (RTP) is active:
- on: Indicates that RTP is active;
- off: Indicates that either RTP is not active or no antispyware has been detected;
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| antispyware\_up\_to\_date | enum | Windows | | |
| | Indicates whether the antispyware is up-to-date:
- yes: Indicates that antispyware is up-to-date;
- no: Indicates that either the antispyware is not up-to-date or no antispyware has been detected;
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| antivirus\_name | string | Windows | | NU |
| | Name of the main antivirus | | | |
| antivirus\_rtp | enum | Windows | | |
| | Indicates whether the antivirus real time protection (RTP) is active:
- on: Indicates that RTP is active;
- off: Indicates that either RTP is not active or no antivirus has been detected;
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| antivirus\_up\_to\_date | enum | Windows | | |
| | Indicates whether the antivirus is up-to-date:
- yes: Indicates that antivirus is up-to-date;
- no: Indicates that either the antivirus is not up-to-date or no antivirus has been detected;
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| audit\_account\_logon\_events | enum | Windows | | |
| | Determines whether to audit each instance of a user logging on to or logging off from another computer in which this computer is used to validate the account. | | | |
| audit\_account\_management | enum | Windows | | |
| | Determines whether to audit each event of account management on a computer. | | | |
| audit\_directory\_service\_access | enum | Windows | | |
| | Determines whether to audit the event of a user accessing an Active Directory object that has its own system access control list (SACL) specified. | | | |
| audit\_logon\_events | enum | Windows | | |
| | Determines whether to audit each instance of a user logging on to or logging off from a computer. | | | |
| audit\_object\_access | enum | Windows | | |
| | Determines whether to audit the event of a user accessing an object, e.g. a file, folder, registry key, and so forth - that has its own system access control list (SACL) specified. | | | |
| audit\_policy\_change | enum | Windows | | |
| | Determines whether to audit every incident of a change to user rights assignment policies, audit policies, or trust policies. | | | |
| audit\_privilege\_use | enum | Windows | | |
| | Determines whether to audit each instance of a user exercising a user right. | | | |
| audit\_process\_tracking | enum | Windows | | |
| | Determines whether to audit detailed tracking information for events such as program activation, process exit, handle duplication, and indirect object access. | | | |
| audit\_system\_events | enum | Windows | | |
| | Determines whether to audit when a user restarts or shuts down the computer or when an event occurs that affects either the system security or the security log. | | | |
| average\_boot\_duration | millisecond | Windows | | NU |
| | Full boot duration baseline | | | |
| average\_fast\_startup\_duration | millisecond | Windows | | NU |
| | Indicated the fast startup boot duration averaged over the fast startups. In the calculation, recent boots weigh more than older boots (exponentially weighted moving average). | | | |
| average\_logon\_duration | millisecond | Windows | | NU |
| | User logon duration baseline | | | |
| bios\_serial\_number | string | Windows | macOS | NU |
| | BIOS serial number | | | |
| boot\_disk\_health\_status | enum | Windows | | NU |
| | Indicates the health of the disk from which the device is booting \[from], as reported by the operating system. | | | |
| boot\_disk\_type | enum | Windows | macOS | NU |
| | Indicates the type of the disk from which the device is booting. | | | |
| chassis\_serial\_number | string | Windows | | NU |
| | Chassis serial number | | | |
| cltr\_ca\_license\_uid | string | Windows | macOS | NU |
| | Indicates the Collector assignment license UID | | | |
| cltr\_ca\_status | enum | Windows | macOS | NU |
| | Indicates whether Collector assignment service is enabled or disabled | | | |
| cltr\_crash\_guard\_count | integer | Windows | | NU |
| | Indicates the number of consecutive hard resets or system crashes of the device | | | |
| cltr\_crash\_guard\_limit | integer | Windows | | NU |
| | Indicates the Collector CrashGuard limit | | | |
| cltr\_crash\_guard\_protection\_interval | integer | Windows | | NU |
| | Indicates the CrashGuard monitoring interval in minutes | | | |
| cltr\_crash\_guard\_react\_interval | integer | Windows | | NU |
| | Indicates the Collector CrashGuard reactivation interval in hours | | | |
| cltr\_custom\_shells | enum | Windows | | NU |
| | Indicates whether the Collector reports user logon events and user interactions in virtualized and embedded (kiosk mode) environments | | | |
| cltr\_data\_channel\_protocol | enum | Windows | macOS | NU |
| | Specifies if the Collector data is sent over TCP or UDP | | | |
| cltr\_dns\_res\_preference | enum | Windows | | NU |
| | Indicates the DNS resolution preference for Collector in terms of IP protocol version on the device | | | |
| cltr\_engage\_service\_status | enum | Windows | macOS | NU |
| | Indicates whether Engage is enabled or disabled | | | |
| cltr\_freezes\_monitoring | enum | Windows | | NU |
| | Indicates whether the Collector is monitoring for unresponsive applications on the device | | | |
| cltr\_installs\_scan\_interval | integer | Windows | | NU |
| | Indicates the interval, in hours, after which the Collector checks for newly installed packages and updates | | | |
| cltr\_is\_visible | enum | Windows | | NU |
| | Indicates whether Collector is hidden in the "Add or Remove Programs" | | | |
| cltr\_log\_level | enum | Windows | macOS | NU |
| | Indicates the Collector log level | | | |
| cltr\_max\_segment\_size | integer | Windows | | NU |
| | Indicates the maximum segment size of packets sent by Collector | | | |
| cltr\_ra\_execution\_policy | enum | Windows | | NU |
| | Indicates the Powershell script execution policy | | | |
| cltr\_string\_tag | string | Windows | macOS | NU |
| | Indicates the Collector string tag | | | |
| cltr\_web\_mon\_status | enum | Windows | | NU |
| | Indicates whether Web & Cloud monitoring is enabled or disabled | | | |
| collector\_distinguished\_name | string | Windows | | NU |
| | Indicates the distinguished name (DN) as seen:
- For Windows: In Active Directory (AD). if no connection with AD is set up, a '-' is displayed;
- For Mobile: In the Exchange ActiveSync server Note that this DN is reported by the Collector.
| | | |
| collector\_installation\_log | string | Windows | | NU |
| | Link to the last Nexthink Collector installation error log | | | |
| collector\_package\_target\_version | version | Windows | macOS | NU |
| | Indicates the Collector package version that is targeted. | | | |
| collector\_status | enum | Windows | macOS | NU |
| | Indicates the status of the Nexthink Collector package installed on the device:
- unmanaged: the Collector is not automatically updated
- up-to-date: the Collector is up-to-date
- outdated: a newer Collector version is available.
| | | |
| collector\_tag | integer | Windows | | |
| | Collector installation tag | | | |
| collector\_update\_status | enum | Windows | | |
| | Current status of Nexthink Collector Updater | | | |
| collector\_version | version | Windows | macOS | |
| | Version number of Nexthink Collector installation | | | |
| cpu\_frequency | mhz | Windows | macOS | NU |
| | CPU frequency | | | |
| cpu\_model | string | Windows | macOS | NU |
| | CPU model | | | |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the device | | | |
| device\_encryption\_required | boolean | | | NU |
| | Indicates whether device encryption is required. | | | |
| device\_manufacturer | string | Windows | macOS | NU |
| | Indicates the device manufacturer. | | | |
| device\_model | string | Windows | macOS | NU |
| | Indicates the model of the device. | | | |
| device\_password\_required | boolean | | | NU |
| | Indicates whether a password is required on the device. | | | |
| device\_product\_id | string | Windows | macOS | NU |
| | Device product ID | | | |
| device\_product\_version | string | Windows | macOS | NU |
| | Device product version | | | |
| device\_serial\_number | string | Windows | macOS | NU |
| | Indicates the device serial number. | | | |
| device\_type | enum | Windows | macOS | |
| | Type of device (desktop, laptop, server, mobile) | | | |
| device\_uid | md5 | Windows | macOS | |
| | Indicates the universally unique identifier (based on Engine name and device ID) | | | |
| device\_uuid | string | Windows | macOS | |
| | Indicates the device universally unique identifier (UUID) | | | |
| directory\_service\_site | string | Windows | | NU |
| | Site (or location) of an Active Directory (AD) service | | | |
| disks\_manufacturers | string | Windows | | |
| | Hard disks manufacturers | | | |
| disks\_smart\_index | percent | Windows | | NU |
| | Lowest S.M.A.R.T. index of installed hard disks (index is based on S.M.A.R.T. attributes) | | | |
| distinguished\_name | string | Windows | | NU |
| | Indicates the distinguished name (DN) as seen:
- For Windows: In Active Directory (AD). if no connection with AD is set up, a '-' is displayed;
- For Mobile: In the Exchange ActiveSync server
| | | |
| eas\_access\_state | enum | | | |
| | Indicates whether the device can access the Exchange ActiveSync server. The possible states are:
- allowed: the device has access;
- blocked: the device is blocked;
- discovery: the device is temporary quarantined while it is being identified by the Exchange ActiveSync server;
- quarantined: the device is waiting for Exchange ActiveSync administrator approval.
| | | |
| eas\_access\_state\_reason | enum | | | |
| | Indicates the reason for the device access state. The possible values are:
- global: caused by the global access settings;
- device rule: caused by a device access rule;
- individual: caused by an individual exemption;
- policy: caused by Exchange ActiveSync policy.
| | | |
| eas\_device\_access\_rule | string | | | |
| | Indicates the name of the access rule. An access rule allows, blocks or quarantines devices based on the device type, model, OS or user agent characteristics. | | | |
| eas\_device\_identity | string | | | |
| | Indicates the identity of the device in Exchange ActiveSync Server. | | | |
| eas\_exemption | enum | | | |
| | Indicates whether a personal exemption is set for the device and its user. Possible values are:
| | | |
| eas\_policy\_application\_status | enum | | | |
| | Indicates whether the Exchange ActiveSync policy is applied or not. Possible values are:
- not applied;
- applied in full: the policy is applied (unless the field 'Allow non provisionable devices' value is 'yes');
- partially applied.
| | | |
| eas\_policy\_name | string | | | |
| | Indicates the name of the Exchange ActiveSync policy applied to the user's mailbox. | | | |
| eas\_policy\_update | datetime | | | |
| | Indicates the last time the Exchange ActiveSync policy was updated on the device. | | | |
| email\_attachment\_enabled | boolean | | | NU |
| | Indicates whether attachments can be downloaded to the mobile device through the Exchange ActiveSync protocol. | | | |
| enforce\_password\_history | integer | Windows | | NU |
| | Indicates the number of unique passwords that have to be associated with a user account before an old password can be reused. | | | |
| entity | string | Windows | macOS | |
| | Entity | | | |
| extended\_logon\_duration\_baseline | millisecond | Windows | | NU |
| | Extended logon duration baseline | | | |
| firewall\_name | string | Windows | | NU |
| | Name of the main firewall | | | |
| firewall\_rtp | enum | Windows | | |
| | Indicates whether the firewall real time protection (RTP) is active:
- on: Indicates that RTP is active;
- off: Indicates that either RTP is not active or no firewall has been detected;
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| first\_seen | datetime | Windows | macOS | NU |
| | Indicates the first time when the activity of the device was recorded:
- For Windows and Mac OS: The first time Collector reported activity;
- For Mobile: The first time the device was reported with a successful synchronization.
| | | |
| graphical\_card\_ram | byte | Windows | | NU |
| | Amount of RAM of the graphical card with most RAM | | | |
| graphical\_cards | string | Windows | | |
| | Installed graphical cards | | | |
| group\_name | string | Windows | macOS | NU |
| | Name of computer domain or workgroup | | | |
| guest\_account\_status | enum | Windows | | |
| | Determines if the Guest account is enabled or disabled. | | | |
| hard\_disks | string | Windows | macOS | NC |
| | List of all hard disks | | | |
| id | identifier | Windows | macOS | |
| | Unique device identifier | | | |
| internet\_security\_settings | enum | Windows | | |
| | Internet security settings (ok, at risk or unknown) | | | |
| ip\_addresses | ip\_address | Windows | macOS | |
| | List of IP addresses for the device | | | |
| is\_collector\_distinguished\_name\_truncated | boolean | Windows | | |
| | Flag indicating whether the collector DN is truncated or not | | | |
| is\_directory\_service\_site\_truncated | boolean | Windows | | |
| | Flag indicating whether the DS site is truncated or not | | | |
| last\_boot\_duration | millisecond | Windows | | NU |
| | Last boot time duration | | | |
| last\_extended\_logon\_duration | millisecond | Windows | | NU |
| | Last extended logon duration | | | |
| last\_ip\_address | ip\_address | Windows | macOS | NU |
| | Last IP address assigned to the device | | | |
| last\_known\_connection\_status | enum | Windows | macOS | NU |
| | Indicates the last known connection status of the device:
- udp: the device successfully connected via UDP but not TCP.
- tcp: the device successfully connected via TCP but not UDP.
- udp\_tcp: the device successfully connected via both UDP and TCP.
- '-': Collector version is below V6.6.
| | | |
| last\_local\_ip\_address | ip\_address | Windows | macOS | NU |
| | Last local IP address assigned to the device | | | |
| last\_logged\_on\_user | string | Windows | | NU |
| | Last logged on user | | | |
| last\_logon\_duration | millisecond | Windows | | NU |
| | Last user logon duration | | | |
| last\_logon\_time | datetime | Windows | | NU |
| | Last logon time | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Indicates the last time that activity on the device was reported:
- For Windows and Mac OS: The last time Collector reported activity through the UDP channel,
- For Mobile: The last time the device successfully synchronized with the Mobile Bridge.
| | | |
| last\_seen\_on\_tcp | datetime | Windows | macOS | NU |
| | Indicates the last time that the device was successfully connected through the TCP channel.
- '-': The Collector is an older version that does not support TCP.
| | | |
| last\_system\_boot | datetime | Windows | macOS | NU |
| | Last boot time | | | |
| last\_update | datetime | Windows | macOS | NU |
| | Indicates the last Collector update time. | | | |
| last\_update\_status | enum | Windows | macOS | NU |
| | Indicates the status of the last Collector update:
- '-': the Collector was never updated
- successful installation: the last Collector installation was successful
- package download error: the Collector was not able to download the Collector package from Nexthink Appliance
- package digital signature error: the Collector was not able to check the Collector package digital signature
- device reboot required: the device needs to be rebooted to complete the Collector installation
- package error: the Collector package installation has failed
- internal error: the Collector package installation has failed for an unexpected reason.
| | | |
| last\_updater\_request | datetime | Windows | | NU |
| | Last time Nexthink Updater checked for updates | | | |
| last\_windows\_update | datetime | Windows | | NU |
| | Time of last system Update | | | |
| local\_administrators | string | Windows | | |
| | Users and groups which are members of the Local Administrators group on the device. | | | |
| local\_power\_users | string | Windows | | |
| | Users and groups which are members of the Local Powers Users group on the device. | | | |
| logical\_cpu\_number | integer | Windows | macOS | NU |
| | Indicates the number of cores multiplied by the number of threads that can run on each core through the use of hyperthreading. | | | |
| logical\_drives | string | Windows | macOS | |
| | List of all logical drives | | | |
| mac\_addresses | mac\_address | Windows | macOS | |
| | List of MAC addresses for the device | | | |
| maximum\_password\_age | integer | Windows | | NU |
| | Indicates the period in time (in days) during which the password can be used before the system requires the user to change it:
- Windows: As set up in the group policy;
- Mobile: As set up in security policies.
| | | |
| membership\_type | enum | Windows | | |
| | Type of computer membership (domain/workgroup) | | | |
| minimum\_password\_age | integer | Windows | | NU |
| | Period of time (in days) that a password must be used before the user can change it. | | | |
| minimum\_password\_length | integer | Windows | | NU |
| | Least number of characters that a password for a user account may contain. | | | |
| monitor\_models | string | Windows | | |
| | Models of connected monitors | | | |
| monitor\_resolutions | string | Windows | | |
| | Screen resolutions of connected monitors | | | |
| monitors | string | Windows | | |
| | Connected monitors | | | |
| monitors\_serial\_numbers | string | Windows | | |
| | Serial numbers of connected monitors (ordered as in 'Monitors') | | | |
| name | string | Windows | macOS | |
| | Indicates the name of the device:
- For Windows: NetBios Name;
- For Mac OS: Computer name used on the network;
- For Mobile: Composed by mailbox name and device friendly name.
| | | |
| number\_of\_antispyware | enum | Windows | | |
| | Number of antispyware detected:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| number\_of\_antiviruses | enum | Windows | | |
| | Number of antiviruses detected:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| number\_of\_cores | integer | Windows | macOS | NU |
| | Number of cores | | | |
| number\_of\_cpus | integer | Windows | macOS | NU |
| | Number of CPUs | | | |
| number\_of\_days\_since\_first\_seen | integer | Windows | macOS | NU |
| | Number of days since activity of the device was first recorded in the system. | | | |
| number\_of\_days\_since\_last\_boot | integer | Windows | macOS | NU |
| | Number of days since last full boot | | | |
| number\_of\_days\_since\_last\_eas\_policy\_update | integer | | | NU |
| | Indicates the number of days since the last Exchange ActiveSync policy update. | | | |
| number\_of\_days\_since\_last\_logon | integer | Windows | | NU |
| | Number of days since last logon | | | |
| number\_of\_days\_since\_last\_seen | integer | Windows | macOS | NU |
| | Indicates the number of days since the last time the device was seen by Nexthink. The field is updated whenever device activity is detected:
- For Windows and Mac OS: seen through the UDP channel,
- For Mobile: seen through the Mobile Bridge.
| | | |
| number\_of\_days\_since\_last\_seen\_on\_tcp | integer | Windows | | NU |
| | Indicates the number of days since the last time the device was successfully connected through the TCP channel. '-': The Collector is an older version that does not support TCP. | | | |
| number\_of\_days\_since\_last\_windows\_update | integer | Windows | | NU |
| | Number of days since last system Update | | | |
| number\_of\_firewalls | enum | Windows | | |
| | Number of firewalls detected:
- unknown: Indicates that the information could not be retrieved;
- N/A: This field is not available on this operating system;
- '-': No data, incompatible collector version or the data is not yet available.
| | | |
| number\_of\_graphical\_cards | integer | Windows | | |
| | Number of installed graphical cards | | | |
| number\_of\_monitors | integer | Windows | macOS | |
| | Number of connected monitors | | | |
| os\_architecture | enum | Windows | macOS | |
| | Architecture of device operating system (x86/x64/ARM64) | | | |
| os\_build | version | Windows | | |
| | Indicates the build number of the operating system. | | | |
| os\_version\_and\_architecture | string | Windows | macOS | NU |
| | Indicates name, version and architecture (when applicable) of the operating system.
- unknown: the OS version could not be retrieved or it could not be mapped to a recognized value.
| | | |
| password\_complexity\_requirements | enum | Windows | | |
| | Indicates whether password complexity is required:
- Windows: The password must meet complexity requirements as defined in the group policy;
- Mobile: No simple passwords are allowed or a minimum password length is set, as defined in the security policy.
| | | |
| platform | enum | Windows | macOS | |
| | Indicates the platform of the device. A platform is a set of operating system families on which the same objects, activities, events and properties can be retrieved. The possible values are:
| | | |
| privileges\_of\_last\_logged\_on\_users | enum | Windows | | |
| | Privileges of the last logged on user (user, power user, administrator) | | | |
| sd\_card\_encryption\_required | boolean | | | NU |
| | Indicates whether SD card encryption is required. | | | |
| sid | sid | Windows | | NU |
| | Windows security identifier for the device. | | | |
| storage\_policy | enum | Windows | macOS | |
| | Indicates the event storage policy for the device. Possible values are:
- all: web requests, connections and executions are stored
- connections and executions;
- executions;
- none: no activity is recorded;
- remove: The device will be removed from Engine during the next cleanup, as long as it is no longer sending data; Note that available events depend on the device platform.
| | | |
| system\_drive\_capacity | byte | Windows | macOS | |
| | Total capacity of system drive | | | |
| system\_drive\_free\_space | byte | Windows | macOS | |
| | Total available free space on system drive | | | |
| system\_drive\_usage | percent | Windows | macOS | NU |
| | Use percentage of system drive | | | |
| total\_active\_days | day | Windows | macOS | |
| | Total number of days the device was active. | | | |
| total\_drive\_capacity | byte | Windows | macOS | |
| | Total capacity of all drives | | | |
| total\_drive\_free\_space | byte | Windows | macOS | |
| | Total free space on all drives | | | |
| total\_drive\_usage | permill | Windows | macOS | NU |
| | Total use percentage of all drives | | | |
| total\_nonsystem\_drive\_capacity | byte | Windows | macOS | |
| | Total capacity of all non-system drives | | | |
| total\_nonsystem\_drive\_free\_space | byte | Windows | macOS | |
| | Total free space on all non-system drives | | | |
| total\_nonsystem\_drive\_usage | percent | Windows | macOS | NU |
| | Total use percentage of all non-system drives | | | |
| total\_ram | byte | Windows | macOS | NU |
| | Total amount of RAM | | | |
| updater\_error | string | Windows | | |
| | Last Nexthink Collector Updater error | | | |
| updater\_version | version | Windows | | |
| | Nexthink Collector Updater version | | | |
| upgrade\_group | enum | Windows | macOS | NU |
| | Indicates the update group of Nexthink Collector:
- manual: the Collector is manually updated
- pilot: the Collector is updated as part of the pilot group
- main: the Collector is updated as part of the main group.
| | | |
| user\_account\_control\_status | enum | Windows | | |
| | User account control status (ok, at risk or unknown) | | | |
| windows\_license\_key | string | Windows | | NU |
| | Windows license key | | | |
| windows\_updates\_status | enum | Windows | | |
| | Windows update status (ok, at risk or unknown) | | | |
| wmi\_status | enum | Windows | | |
| | Windows WMI service status (ok, failure) | | | |
### domain
A domain is a domain name e.g. .
| Name | Type | Operating systems | Properties | |
| ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the domain | | | |
| domain\_category | string | Windows | macOS | SE |
| | Indicates the category of the domain:
- '-': Not yet tagged or internal domain.
| | | |
| first\_seen | datetime | Windows | macOS | NU |
| | The first time the domain has been seen. | | | |
| hosting\_country | string | Windows | macOS | SE |
| | Indicates in which country the domain is hosted:
- '-': Not yet tagged, internal domain or not known by Nexthink Library.
| | | |
| hostname | string | Windows | macOS | NU |
| | The hostname of the fully qualified domain name | | | |
| id | identifier | Windows | macOS | |
| | Unique domain identifier | | | |
| internal\_domain | boolean | Windows | macOS | |
| | Indicates whether the domain is considered internal:
- yes: The domain is not reported to Nexthink Library and subdomains are not compressed using the '' pattern;
- no: The domain is reported to the Nexthink Library (if the license includes the Security module); complex subdomains are compressed using the '' pattern.
| | | |
| last\_seen | datetime | Windows | macOS | NU |
| | The last time the domain has been seen. | | | |
| name | string | Windows | macOS | |
| | The fully qualified domain name | | | |
| protocol | enum | Windows | macOS | |
| | Protocols used in web requests (HTTP, TLS, HTTP/TLS) | | | |
| response\_size | byte | Windows | macOS | |
| | Total web incoming traffic | | | |
| storage | enum | Windows | macOS | |
| | Event storage policy for the domain (web request or none) | | | |
| threat\_level | enum | Windows | macOS | SE |
| | Indicates the threat level of the domain:
- '-': Not yet tagged or internal domain;
- none detected: No known threat;
- low: low threat;
- intermediate: Intermediate threat;
- high: High threat.
| | | |
### executable
An application is an executable program e.g. 'winword.exe'.
| Name | Type | Operating systems | Properties | |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | ---------- | -- |
| application\_company | string | Windows | macOS | |
| | Application company | | | |
| application\_name | string | Windows | macOS | |
| | Application name | | | |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the executable. | | | |
| description | string | Windows | | |
| | Executable description | | | |
| first\_seen | datetime | Windows | macOS | NU |
| | First time activity of the executable was recorded on any device. | | | |
| id | identifier | Windows | macOS | |
| | Unique executable identifier | | | |
| known\_packages | string | Windows | macOS | |
| | List of packages known to contain the executable. This list is not exhaustive: The presence of a package does not necessarily imply that on a given device the executable was installed through that package. | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Last time activity of the executable was recorded on any device. | | | |
| name | string | Windows | macOS | |
| | Executable name | | | |
| platform | enum | Windows | macOS | |
| | The platform (operating system family) on which the executable is running. | | | |
| storage\_policy | enum | Windows | macOS | |
| | Indicates the event storage policy for the executable. Possible values are:
- all: web requests, connections and executions are stored;
- connections and executions;
- executions;
- none: no activity is recorded.
| | | |
| total\_active\_days | day | Windows | macOS | |
| | Total number of days the executable was active. | | | |
### package
A package is a software package (programs or updates).
| Name | Type | Operating systems | Properties | |
| -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| first\_installation | datetime | Windows | | NU |
| | Time of first installation | | | |
| first\_seen | datetime | Windows | macOS | NU |
| | The first time the package has been seen. | | | |
| id | identifier | Windows | macOS | |
| | Unique package identifier | | | |
| name | string | Windows | macOS | |
| | Package name | | | |
| number\_of\_updates | integer | Windows | | |
| | Number of updates (for programs) | | | |
| platform | enum | Windows | macOS | |
| | The platform (operating system family) on which the package is installed. | | | |
| program | string | Windows | macOS | |
| | Package program | | | |
| publisher | string | Windows | macOS | NU |
| | Package publisher | | | |
| status | enum | Windows | macOS | |
| | Package status (installed/removed) | | | |
| type | enum | Windows | macOS | |
| | Package type (program/update) | | | |
| version | string | Windows | macOS | NU |
| | Package version | | | |
| windows\_7\_32bit\_compatibility | string | Windows | | DE |
| | Indicates the Windows 7 (32-bit) compatibility of the package:
- '-': Not yet tagged;
- No information available: Not known by Nexthink Library;
- Compatible: Compatible with Windows 7.
| | | |
| windows\_7\_64bit\_compatibility | string | Windows | | DE |
| | Indicates the Windows 7 (64-bit) compatibility of the package:
- '-': Not yet tagged;
- No information available: Not known by Nexthink Library;
- Compatible: Compatible with Windows 7.
| | | |
### port
A port is a TCP or UDP connection port.
| Name | Type | Operating systems | Properties | |
| ------------ | ----------------------------------------------------------- | ----------------- | ---------- | -- |
| first\_seen | datetime | Windows | macOS | NU |
| | First time activity of the port was recorded on any device. | | | |
| id | identifier | Windows | macOS | |
| | Unique port identifier | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Last time activity of the port was recorded on any device. | | | |
| port\_number | integer | Windows | macOS | |
| | Port number | | | |
| port\_type | enum | Windows | macOS | |
| | Port type (tcp, udp, tcp port scan, udp port scan) | | | |
| port\_value | port | Windows | macOS | |
| | Port value for tagging | | | |
### service
A service represents an IT service in your organization, such as the mail service or the directory service. Services are either based on TCP connections (for Windows and Mac devices) or on web requests (for Windows devices only).
| Name | Type | Operating systems | Properties | |
| ------ | ------------------------------ | ----------------- | ---------- | - |
| id | integer | Windows | macOS | |
| | Unique service identifier | | | |
| name | string | Windows | macOS | |
| | Service name | | | |
| status | enum | Windows | macOS | |
| | Service status (active, error) | | | |
| type | enum | Windows | macOS | |
| | Type of service (network, web) | | | |
### url\_path
A url\_path is a URL path after the domain name e.g. \[ ]/awards/.
| Name | Type | Operating systems | Properties | |
| ---- | -------------------------- | ----------------- | ---------- | - |
| id | identifier | Windows | macOS | |
| | Unique url path identifier | | | |
| path | string | Windows | macOS | |
| | The URL path | | | |
### user
A user is an object that represents an individual account in a device (local user) or in a group of devices (domain user). The account may identify a physical user or a system user.
| Name | Type | Operating systems | Properties | |
| ----------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| country | string | Windows | macOS | |
| | Country of user as listed in active directory | | | |
| database\_usage | permill | Windows | macOS | |
| | Percentage of the database used by information related with the binary | | | |
| department | string | Windows | macOS | |
| | User department as listed in active directory | | | |
| distinguished\_name | string | Windows | macOS | NU |
| | Active directory distinguished name (DN) | | | |
| first\_seen | datetime | Windows | macOS | NU |
| | First time activity of the user was recorded on any device. | | | |
| full\_name | string | Windows | macOS | NU |
| | Full user name as listed in active directory | | | |
| id | identifier | Windows | macOS | |
| | Unique user identifier | | | |
| job\_title | string | Windows | macOS | NU |
| | Job title as listed in active directory | | | |
| last\_seen | datetime | Windows | macOS | NU |
| | Last time activity of the user was recorded on any device. | | | |
| locality | string | Windows | macOS | |
| | Locality of user as listed in active directory | | | |
| location | string | Windows | macOS | |
| | Location of user as listed in active directory | | | |
| name | string | Windows | macOS | |
| | User logon name | | | |
| number\_of\_days\_since\_last\_seen | integer | Windows | macOS | NU |
| | Indicates the number of days since the last time the user was seen by Nexthink. The field is updated whenever user activity is detected. | | | |
| org\_unit | string | Windows | macOS | |
| | Organisational unit of User as listed in active directory | | | |
| seen\_on\_mac\_os | boolean | Windows | macOS | |
| | Indicates if the user has been seen on a Mac device. | | | |
| seen\_on\_mobile | boolean | Windows | macOS | |
| | Indicates if the user has been seen on a Mobile device. | | | |
| seen\_on\_windows | boolean | Windows | macOS | |
| | Indicates if the user has been seen on a Windows device. | | | |
| sid | sid | Windows | macOS | NU |
| | Indicates the Windows security identifier for the user. For Mac OS, '-' means that the user is not in Active Directory. | | | |
| total\_active\_days | day | Windows | macOS | |
| | Total number of days the user was active. | | | |
| type | enum | Windows | macOS | |
| | Type of user (local/domain/system) | | | |
| user\_uid | md5 | Windows | macOS | |
| | Indicates the universally unique identifier | | | |
## Events
### connection
A connection is a TCP connection or a UDP packet. Several identical TCP connections or UDP packets are merged when in close succession.
| Name | Type | Operating systems | Properties | |
| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| cardinality | integer | Windows | macOS | |
| | Number of underlying connections, consolidated over time | | | |
| destination\_ip\_address | ip\_address | Windows | macOS | |
| | IP address of the connection destination | | | |
| device\_ip\_address | ip\_address | Windows | macOS | |
| | IP address of the connection source | | | |
| duration | millisecond | Windows | macOS | |
| | The time between the start of the first connection and the end of the last underlying connection. | | | |
| end\_time | datetime | Windows | macOS | |
| | Connection end time, corresponding to the moment when the last underlying connection was closed. | | | |
| id | identifier | Windows | macOS | |
| | Unique connection identifier | | | |
| incoming\_bitrate | bps | Windows | macOS | NU |
| | Average incoming bitrate of all underlying connections, consolidated over time | | | |
| incoming\_traffic | byte | Windows | macOS | |
| | Incoming traffic | | | |
| network\_interface\_iana\_code | string | Windows | macOS | |
| | (beta) Indicates the network interface IANA code. | | | |
| network\_interface\_index | integer | Windows | macOS | |
| | (beta) Indicates the network interface index. | | | |
| network\_interface\_type | enum | Windows | macOS | |
| | (beta) Indicates the network interface type. Possible values are:
- wifi
- ethernet
- mobile
- other
- unknown: the Collector is not supporting interface type.
| | | |
| network\_response\_time | microsecond | Windows | macOS | |
| | TCP connection establishment time | | | |
| outgoing\_bitrate | bps | Windows | macOS | NU |
| | Average outgoing bitrate of all underlying connections, consolidated over time | | | |
| outgoing\_traffic | byte | Windows | macOS | |
| | Outgoing traffic | | | |
| start\_time | datetime | Windows | macOS | |
| | Connection start time | | | |
| status | enum | Windows | macOS | |
| | Status of the connection (established, rejected, no service, no host, closed) | | | |
| type | enum | Windows | macOS | |
| | Type of the connection (tcp, udp) | | | |
### device\_activity
A device\_activity is a device activity (boot or activity).
| Name | Type | Operating systems | Properties | |
| ---------- | ------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| boot\_type | enum | Windows | macOS | NU |
| | Boot type of the boot activity | | | |
| duration | millisecond | Windows | macOS | |
| | Boot duration (timed between kernel start and launch of 'logonui.exe' process) or online duration | | | |
| id | identifier | Windows | macOS | |
| | Boot event identifier | | | |
| time | datetime | Windows | macOS | |
| | Time of boot | | | |
| type | enum | Windows | macOS | |
| | Activity event information | | | |
### device\_error
A device\_error is a critical system error (system crash, hard reset, or disk error).
| Name | Type | Operating systems | Properties | |
| ------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | - |
| error\_code | integer | Windows | macOS | |
| | Error code | | | |
| error\_label | string | Windows | macOS | |
| | Error label | | | |
| id | identifier | Windows | macOS | |
| | Problem identifier | | | |
| start\_time | datetime | Windows | macOS | |
| | Time of error | | | |
| type | enum | Windows | macOS | |
| | Indicates the device error type, with the following possible values:
- system crash: Windows bluescreen or macOS kernel panic;
- hard reset: the device was abruptly stopped and then rebooted. It might be caused by pressing the reset button, a power failure or a crash;
- SMART disk failure: a disk error was detected on a disk with SMART technology.
| | | |
### device\_performance
A device\_performance reports the average IOPS, CPU and memory of a device for one hour.
| Name | Type | Operating systems | Properties | |
| ---------------------- | ------------------------------------------------------------------------ | ----------------- | ---------- | -- |
| average\_cpu\_usage | permill | Windows | | |
| | Average CPU usage on the period | | | |
| average\_memory\_usage | byte | Windows | | |
| | Average memory usage on the period | | | |
| cpu\_queue\_length | integer | Windows | | |
| | Average CPU queue length on the period | | | |
| duration | millisecond | Windows | | |
| | Total report duration | | | |
| end\_time | datetime | Windows | | |
| | Report end time | | | |
| id | identifier | Windows | | |
| | Unique report identifier | | | |
| normalized\_cpu\_usage | permill | Windows | | |
| | Average CPU usage on the period normalized by the available logical CPUs | | | |
| read\_operations | integer | Windows | | NU |
| | Total disk read operations accumulated during the period | | | |
| start\_time | datetime | Windows | | |
| | Start time | | | |
| write\_operations | integer | Windows | | NU |
| | Total disk write operations accumulated during the period | | | |
### device\_warning
A device\_warning is a peak in device resource usage (CPU, memory or I/O).
| Name | Type | Operating systems | Properties | |
| ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | - |
| duration | millisecond | Windows | macOS | |
| | Performance event duration | | | |
| end\_time | datetime | Windows | macOS | |
| | Performance event end time | | | |
| id | identifier | Windows | macOS | |
| | Unique performance event identifier | | | |
| info | string | Windows | macOS | |
| | Performance event information | | | |
| start\_time | datetime | Windows | macOS | |
| | Performance event start time | | | |
| type | enum | Windows | macOS | |
| | Type of the device warning, one of:
- 'high overall cpu usage'
- 'high cpu usage' (deprecated)
- 'high io usage'
- 'high memory usage'
- 'high number of page faults'.
| | | |
| value | percent | Windows | macOS | |
| | Performance percentage | | | |
| warning\_duration | millisecond | Windows | macOS | |
| | Indicates the duration of the warning. This duration can be shorter than the event duration when the warning is not continuous. | | | |
### execution
An execution is a process executing on a device. Several executions of the same process are merged when in close succession.
| Name | Type | Operating systems | Properties | |
| ---------------------- | ------------------------------------------------------------------ | ----------------- | ---------- | -- |
| average\_memory\_usage | byte | Windows | macOS | |
| | Average memory usage per execution | | | |
| binary\_path | path | Windows | macOS | |
| | Executed binary path | | | |
| cardinality | integer | Windows | macOS | |
| | Number of underlying processes, consolidated over time | | | |
| duration | millisecond | Windows | macOS | |
| | Total execution duration | | | |
| end\_time | datetime | Windows | macOS | |
| | Execution end time | | | |
| focus\_time | millisecond | Windows | macOS | NU |
| | Focus time | | | |
| id | identifier | Windows | macOS | |
| | Unique execution identifier | | | |
| incoming\_tcp\_traffic | byte | Windows | macOS | |
| | Incoming TCP traffic | | | |
| incoming\_udp\_traffic | byte | Windows | macOS | |
| | Incoming UDP traffic | | | |
| memory\_usage | byte | Windows | macOS | |
| | Average memory usage | | | |
| outgoing\_tcp\_traffic | byte | Windows | macOS | |
| | Outgoing TCP traffic | | | |
| outgoing\_udp\_traffic | byte | Windows | macOS | |
| | Outgoing UDP traffic | | | |
| privilege\_level | enum | Windows | macOS | |
| | Privilege level of the execution (user, power user, administrator) | | | |
| start\_time | datetime | Windows | macOS | |
| | Execution start time | | | |
| startup\_duration | millisecond | Windows | | NU |
| | Startup duration | | | |
| status | enum | Windows | macOS | |
| | Status of the execution (started, stopped) | | | |
| total\_cpu\_time | millisecond | Windows | macOS | |
| | Total CPU time | | | |
### execution\_error
An execution\_error is an application error (crash or not responding).
| Name | Type | Operating systems | Properties | |
| ---- | --------------------------------------------------------------- | ----------------- | ---------- | - |
| id | identifier | Windows | macOS | |
| | Error identifier | | | |
| info | string | Windows | macOS | |
| | Error event information | | | |
| time | datetime | Windows | macOS | |
| | Time of error | | | |
| type | enum | Windows | macOS | |
| | Type of the execution error (application not responding, crash) | | | |
### execution\_warning
An execution\_warning is a peak in application resource usage (CPU or memory).
| Name | Type | Operating systems | Properties | |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | - |
| duration | millisecond | Windows | macOS | |
| | Performance event duration | | | |
| end\_time | datetime | Windows | macOS | |
| | Performance event end time | | | |
| id | identifier | Windows | macOS | |
| | Unique performance event identifier | | | |
| info | string | Windows | macOS | |
| | Performance event information | | | |
| start\_time | datetime | Windows | macOS | |
| | Performance event start time | | | |
| type | enum | Windows | macOS | |
| | Type of the execution warning (high cpu usage, high memory usage) | | | |
| value | percent | Windows | macOS | |
| | Performance percentage | | | |
| warning\_duration | millisecond | Windows | macOS | |
| | Indicates the duration of the warning. This duration can be shorter than the event duration when the warning is not continuous. | | | |
### installation
An installation is the installation or uninstallation of a software package (programs or updates).
| Name | Type | Operating systems | Properties | |
| ---- | ------------------------------------------------ | ----------------- | ---------- | - |
| id | identifier | Windows | macOS | |
| | Unique deployment identifier | | | |
| time | datetime | Windows | macOS | |
| | Installation start time | | | |
| type | enum | Windows | macOS | |
| | Type of operation (installation, uninstallation) | | | |
### network\_scan
A network scan is a sequence of failed TCP connections or UDP packets made to the same port to more than 50 destinations within a few seconds.
| Name | Type | Operating systems | Properties | |
| ------------------- | ---------------------------------------------------------------------------------------------- | ----------------- | ---------- | - |
| cardinality | integer | Windows | macOS | |
| | Number of underlying connections, consolidated over time | | | |
| device\_ip\_address | ip\_address | Windows | macOS | |
| | IP address of the connection source | | | |
| duration | millisecond | Windows | macOS | |
| | The time between the start of the first connection and end of the last underlying connection | | | |
| end\_time | datetime | Windows | macOS | |
| | Scanning end time, corresponding to the moment when the last underlying connection was closed. | | | |
| id | identifier | Windows | macOS | |
| | Unique scanning identifier | | | |
| network | ip\_network | Windows | macOS | |
| | Minimum IP network including all scanned destinations | | | |
| start\_time | datetime | Windows | macOS | |
| | Scanning start time | | | |
| status | enum | Windows | macOS | |
| | Status of the Scanning (established, closed) | | | |
| type | enum | Windows | macOS | |
| | Type of the port scanning (tcp, udp) | | | |
### port\_scan
A port scan is a sequence of failed TCP connections or UDP packets made to the same destination to more than 50 ports within a few seconds.
| Name | Type | Operating systems | Properties | |
| ------------------------ | ---------------------------------------------------------------------------------------------- | ----------------- | ---------- | - |
| cardinality | integer | Windows | macOS | |
| | Number of underlying connections, consolidated over time | | | |
| destination\_ip\_address | ip\_address | Windows | macOS | |
| | IP address of the scanned destination | | | |
| device\_ip\_address | ip\_address | Windows | macOS | |
| | IP address of the connection source | | | |
| duration | millisecond | Windows | macOS | |
| | The time between the start of the first connection and end of the last underlying connection. | | | |
| end\_time | datetime | Windows | macOS | |
| | Scanning end time, corresponding to the moment when the last underlying connection was closed. | | | |
| first\_scanned\_port | port | Windows | macOS | |
| | First port scanning | | | |
| id | identifier | Windows | macOS | |
| | Unique scanning identifier | | | |
| last\_scanned\_port | port | Windows | macOS | |
| | Last port scanning | | | |
| start\_time | datetime | Windows | macOS | |
| | Scanning start time | | | |
| status | enum | Windows | macOS | |
| | Status of the Scanning (established, closed) | | | |
| type | enum | Windows | macOS | |
| | Type of the port scanning (tcp, udp) | | | |
### session\_performance
Sessions of a user logged on a device.
| Name | Type | Operating systems | Properties | |
| ------------------------- | -------------------------------------------------------------- | ----------------- | ---------- | -- |
| cardinality | integer | Windows | | |
| | Number of underlaying sessions consolidated in a bucket period | | | |
| citrix\_rtt | millisecond | Windows | | NU |
| | Citrix RTT | | | |
| client\_ip | ip\_address | Windows | | |
| | Client IP | | | |
| duration | millisecond | Windows | | |
| | Session performance bucket period duration | | | |
| end\_time | datetime | Windows | | |
| | Session performance bucket end time | | | |
| id | identifier | Windows | | |
| | Unique session performance identifier | | | |
| session\_network\_latency | millisecond | Windows | | NU |
| | Session network latency | | | |
| session\_protocol | enum | Windows | | NU |
| | User input delay | | | |
| start\_time | datetime | Windows | | |
| | Execution start time | | | |
### user\_activity
A user\_activity is a user activity (logon or interactive activity).
| Name | Type | Operating systems | Properties | |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | ---------- | - |
| duration | millisecond | Windows | macOS | |
| | Indicates the time between the user logging on and the desktop being shown. | | | |
| id | identifier | Windows | macOS | |
| | User logon event identifier | | | |
| real\_duration | millisecond | Windows | macOS | |
| | Indicates the time between the user logging on and the device being ready to use. Desktops and laptops are considered fully functional once the CPU usage drops below 15% and the disk usage drops below 80%, and servers once the CPU usage of all processes belonging to the corresponding user drops below 15%. | | | |
| time | datetime | Windows | macOS | |
| | Time of user logon | | | |
| type | enum | Windows | macOS | |
| | Activity event information | | | |
### web\_request
A web\_request is an HTTP or TLS request.
| Name | Type | Operating systems | Properties | |
| ----------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| cardinality | integer | Windows | macOS | |
| | Number of underlying web requests, consolidated over time | | | |
| connections\_duration | millisecond | Windows | macOS | |
| | The time between start of the first connection and end of the last underlying connection | | | |
| end\_time | datetime | Windows | macOS | |
| | Web request end time, corresponding to the moment when the last underlying TCP connection was closed. | | | |
| http\_status | http\_status\_code | Windows | macOS | NU |
| | HTTP response status code | | | |
| id | identifier | Windows | macOS | |
| | Unique request identifier | | | |
| incoming\_traffic | byte | Windows | macOS | |
| | Incoming web traffic of all underlying web requests, consolidated over time | | | |
| network\_response\_time | microsecond | Windows | macOS | |
| | Average TCP connection establishment time of all underlying connections, consolidated over time | | | |
| outgoing\_traffic | byte | Windows | macOS | |
| | Outgoing web traffic of all underlying web requests, consolidated over time | | | |
| protocol | enum | Windows | macOS | |
| | Web request protocol (HTTP, TLS) | | | |
| protocol\_version | enum | Windows | macOS | |
| | Web request protocol version | | | |
| service\_related | boolean | Windows | macOS | |
| | Indicates whether the web request is related to a configured service:
- yes: These requests are always visible by all users;
- no: Depending on the privacy settings, requests not related to a service might not be visible by everyone.
| | | |
| start\_time | datetime | Windows | macOS | |
| | Web request start time | | | |
| web\_request\_duration | millisecond | Windows | macOS | |
| | Average time between request and last response byte of all underlying requests, consolidated over time | | | |
## Relationships
A relationship is a link between object and event tables and is specified in a **with** clause.
### connection
* device
* user
* binary
* executable
* application
* destination
* port
* service
### device\_activity
* device
### device\_error
* device
### device\_performance
* device
### device\_warning
* device
### execution
* device
* user
* binary
* executable
* application
### execution\_error
* device
* user
* binary
* executable
* application
### execution\_warning
* device
* user
* binary
* executable
* application
### installation
* device
* package
### network\_scan
* device
* user
* binary
* executable
* application
* port
### port\_scan
* device
* user
* binary
* executable
* application
* destination
### session\_performance
* device
* user
### user\_activity
* device
* user
### web\_request
* device
* user
* binary
* executable
* application
* destination
* port
* domain
* url\_path
* service
### package
* device
* package
## Aggregates
### connection
| Name | Type | Type | Properties | |
| --------------------------------------- | -------------------------------------------------------------------------------------- | ------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | FP |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | FP |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | FP |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | FP |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | FP |
| | Number of binaries | | | |
| number\_of\_destinations | integer | Windows | macOS | |
| | Number of destinations | | | |
| number\_of\_ports | integer | Windows | macOS | |
| | Number of ports | | | |
| number\_of\_connections | integer | Windows | macOS | |
| | Number of connections | | | |
| cumulated\_connection\_duration | millisecond | Windows | macOS | |
| | Cumulated duration of TCP connections | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| incoming\_traffic | byte | Windows | macOS | NU |
| | Total network incoming traffic | | | |
| outgoing\_traffic | byte | Windows | macOS | NU |
| | Total network outgoing traffic | | | |
| average\_network\_response\_time | microsecond | Windows | macOS | |
| | Average TCP connection establishment time | | | |
| successful\_connections\_ratio | permill | Windows | macOS | NU |
| | Percentage of successful TCP connections | | | |
| network\_availability\_level | availability\_level | Windows | macOS | NU |
| | Graded ratio of successful TCP connections (high, medium, low) | | | |
| average\_incoming\_bitrate | bps | Windows | macOS | NU |
| | Average incoming network bitrate | | | |
| average\_outgoing\_bitrate | bps | Windows | macOS | NU |
| | Average outgoing network bitrate | | | |
| highest\_local\_privilege\_reached | privileges\_level | Windows | macOS | NU |
| | Highest local privilege level reached for executions (user, power user, administrator) | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
| incoming\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average incoming network traffic | | | |
| outgoing\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average outgoing network traffic | | | |
| total\_network\_traffic | byte | Windows | macOS | NU |
| | Network traffic | | | |
### device\_activity
| Name | Type | Operating systems | Properties | |
| ---------------------------------- | --------------------------------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| average\_boot\_duration | millisecond | Windows | | NU |
| | Average boot duration | | | |
| average\_logon\_duration | millisecond | Windows | | NU |
| | Average user logon duration | | | |
| average\_extended\_logon\_duration | millisecond | Windows | | NU |
| | Average extended logon duration | | | |
| number\_of\_boots | integer | Windows | macOS | NU |
| | Number of boots | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| uptime | millisecond | Windows | macOS | NU |
| | Amount of time the machine has been running | | | |
| cumulated\_interaction\_duration | millisecond | Windows | macOS | NU |
| | Cumulated time with user interaction (mouse or keyboard events) | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
### device\_error
| Name | Type | Operating systems | Properties | |
| --------------------- | ----------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| number\_of\_errors | integer | Windows | macOS | |
| | Number of system errors | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
### device\_performance
| Name | Type | Operating systems | Properties | |
| ------------------------------- | ---------------------------- | ----------------- | ---------- | -- |
| average\_read\_operations | integer | Windows | | |
| | Average read IPOS | | | |
| average\_write\_operations | integer | Windows | | |
| | Average write IPOS | | | |
| average\_cpu\_queue\_length | integer | Windows | | |
| | Average CPU queue length | | | |
| average\_memory\_usage | byte | Windows | | NU |
| | Average memory usage | | | |
| average\_cpu\_usage | percent | Windows | | |
| | Average CPU usage | | | |
| average\_normalized\_cpu\_usage | percent | Windows | | |
| | Average normalized CPU usage | | | |
### device\_warning
| Name | Type | Operating systems | Properties | |
| ----------------------------------------- | -------------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| number\_of\_warnings | integer | Windows | macOS | |
| | Number of warnings | | | |
| cumulated\_warning\_duration | millisecond | Windows | macOS | NU |
| | Cumulated duration of the warning events | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
| high\_device\_overall\_cpu\_time\_ratio | permill | Windows | macOS | NU |
| | Indicates the ratio between the time the device is in high overall CPU usage and its uptime. | | | |
| high\_device\_memory\_time\_ratio | permill | Windows | macOS | NU |
| | Indicates the ratio between the time the device is in high memory usage and its uptime. | | | |
| high\_device\_io\_throughput\_time\_ratio | permill | Windows | | NU |
| | Indicates the ratio between the time the device is in high IO throughput and its uptime. | | | |
| high\_device\_page\_faults\_time\_ratio | permill | Windows | | NU |
| | Indicates the ratio between the time the device is in high page faults and its uptime. | | | |
### execution
| Name | Type | Operating systems | Properties | |
| --------------------------------------- | -------------------------------------------------------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | FP |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | FP |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | FP |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | FP |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | FP |
| | Number of binaries | | | |
| number\_of\_executions | integer | Windows | macOS | |
| | Number of executions | | | |
| cumulated\_execution\_duration | millisecond | Windows | macOS | NU |
| | Cumulated duration of executions | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| incoming\_traffic | byte | Windows | macOS | NU |
| | Total network incoming traffic | | | |
| outgoing\_traffic | byte | Windows | macOS | NU |
| | Total network outgoing traffic | | | |
| highest\_local\_privilege\_reached | privileges\_level | Windows | macOS | NU |
| | Highest local privilege level reached for executions (user, power user, administrator) | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
| average\_memory\_usage\_per\_execution | byte | Windows | macOS | NU |
| | Average memory usage per execution | | | |
| memory\_usage | byte | Windows | macOS | NU |
| | Memory usage | | | |
| focus\_time | millisecond | Windows | macOS | NU |
| | Focus time | | | |
| cpu\_usage\_ratio | permill | Windows | macOS | NU |
| | Average CPU usage | | | |
| total\_cpu\_time | millisecond | Windows | macOS | NU |
| | Total CPU time | | | |
| average\_process\_start\_time | millisecond | Windows | | NU |
| | Average process start time | | | |
| incoming\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average incoming network traffic | | | |
| outgoing\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average outgoing network traffic | | | |
| total\_network\_traffic | byte | Windows | macOS | NU |
| | Network traffic | | | |
### execution\_error
| Name | Type | Operating systems | Properties | |
| ------------------------------------------------ | ------------------------------------------- | ----------------- | ---------- | -- |
| application\_not\_responding\_event\_ratio | permill | Windows | macOS | NU |
| | Application not responding event ratio | | | |
| application\_crash\_ratio | permill | Windows | macOS | NU |
| | Application crash ratio | | | |
| number\_of\_application\_not\_responding\_events | integer | Windows | macOS | |
| | Number of application not responding events | | | |
| number\_of\_application\_crashes | integer | Windows | macOS | |
| | Number of application crashes | | | |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | |
| | Number of binaries | | | |
| number\_of\_errors | integer | Windows | macOS | |
| | Number of errors | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
### execution\_warning
| Name | Type | Operating systems | Properties | |
| ------------------------------------------- | ---------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | |
| | Number of binaries | | | |
| number\_of\_warnings | integer | Windows | macOS | |
| | Number of warnings | | | |
| cumulated\_warning\_duration | millisecond | Windows | macOS | NU |
| | Cumulated duration of the warning events | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
| high\_application\_thread\_cpu\_time\_ratio | permill | Windows | macOS | NU |
| | High application thread CPU time ratio | | | |
### installation
| Name | Type | Operating systems | Properties | |
| ------------------------- | ----------------------------------- | ----------------- | ---------- | -- |
| number\_of\_packages | integer | Windows | macOS | |
| | Number of packages | | | |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| number\_of\_installations | integer | Windows | macOS | |
| | Number of installations | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
### network\_scan
| Name | Type | Operating systems | Properties | |
| --------------------------------------- | --------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | |
| | Number of binaries | | | |
| number\_of\_ports | integer | Windows | macOS | |
| | Number of ports | | | |
| number\_of\_connections | integer | Windows | macOS | |
| | Number of connections | | | |
| cumulated\_scan\_duration | millisecond | Windows | macOS | NU |
| | Cumulated duration of the network scan | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| incoming\_traffic | byte | Windows | macOS | NU |
| | Total network incoming traffic | | | |
| outgoing\_traffic | byte | Windows | macOS | NU |
| | Total network outgoing traffic | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
| incoming\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average incoming network traffic | | | |
| outgoing\_network\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Device average outgoing network traffic | | | |
| total\_network\_traffic | byte | Windows | macOS | NU |
| | Network traffic | | | |
### package
| Name | Type | Operating systems | Properties | |
| -------------------- | ------------------ | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | macOS | FP |
| | Number of devices | | | |
| number\_of\_packages | integer | Windows | macOS | FP |
| | Number of packages | | | |
### port\_scan
### session\_performance
| Name | Type | Operating systems | Properties | |
| ---------------------------------- | ------------------------------- | ----------------- | ---------- | -- |
| session\_duration | millisecond | Windows | | NU |
| | Session duration | | | |
| average\_citrix\_rtt | millisecond | Windows | | NU |
| | Average Citrix RTT | | | |
| average\_session\_network\_latency | millisecond | Windows | | NU |
| | Average session network latency | | | |
### user\_activity
| Name | Type | Operating systems | Properties | |
| ---------------------------------- | --------------------------------------------------------------- | ----------------- | ---------- | -- |
| number\_of\_devices | integer | Windows | | |
| | Number of devices | | | |
| number\_of\_users | integer | Windows | macOS | |
| | Number of users | | | |
| number\_of\_logons | integer | Windows | | |
| | Number of user logons | | | |
| activity\_start\_time | datetime | Windows | | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | | NU |
| | Stop time of investigated activity | | | |
| cumulated\_interaction\_duration | millisecond | Windows | | NU |
| | Cumulated time with user interaction (mouse or keyboard events) | | | |
| average\_logon\_duration | millisecond | Windows | | NU |
| | Average user logon duration | | | |
| average\_extended\_logon\_duration | millisecond | Windows | | NU |
| | Average extended logon duration | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
### web\_request
| Name | Type | Operating systems | Properties | |
| ------------------------------------- | ------------------------------------------------------------------------------------------------------- | ----------------- | ---------- | ----- |
| total\_web\_traffic | byte | Windows | macOS | NU |
| | Web traffic | | | |
| outgoing\_web\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Outgoing web traffic per device | | | |
| incoming\_web\_traffic\_per\_device | byte | Windows | macOS | NU |
| | Incoming web traffic per device | | | |
| number\_of\_devices | integer | Windows | macOS | FP |
| | Number of devices | | | |
| number\_of\_domains | integer | Windows | macOS | FP |
| | Number of domains | | | |
| number\_of\_users | integer | Windows | macOS | FP |
| | Number of users | | | |
| number\_of\_applications | integer | Windows | macOS | FP/NU |
| | Number of applications | | | |
| number\_of\_executables | integer | Windows | macOS | FP |
| | Number of executables | | | |
| number\_of\_binaries | integer | Windows | macOS | FP |
| | Number of binaries | | | |
| number\_of\_destinations | integer | Windows | macOS | |
| | Number of destinations | | | |
| number\_of\_ports | integer | Windows | macOS | |
| | Number of ports | | | |
| activity\_start\_time | datetime | Windows | macOS | NU |
| | Start time of investigated activity | | | |
| activity\_stop\_time | datetime | Windows | macOS | NU |
| | Stop time of investigated activity | | | |
| average\_network\_response\_time | microsecond | Windows | macOS | |
| | Average TCP connection establishment time | | | |
| highest\_local\_privilege\_reached | privileges\_level | Windows | macOS | NU |
| | Highest local privilege level reached for executions (user, power user, administrator) | | | |
| number\_of\_web\_requests | integer | Windows | macOS | |
| | Number of web requests | | | |
| protocols\_used\_in\_requests | web\_protocol\_combination | Windows | macOS | NU |
| | Protocols used in web requests (HTTP, TLS, HTTP/TLS) | | | |
| lowest\_protocol\_version | min\_web\_protocol\_version | Windows | macOS | NU |
| | Lowest protocol version observed in web requests (excluding web requests with unknown protocol version) | | | |
| incoming\_traffic | byte | Windows | macOS | NU |
| | Total web incoming traffic | | | |
| outgoing\_traffic | byte | Windows | macOS | NU |
| | Total web outgoing traffic | | | |
| average\_incoming\_bitrate | bps | Windows | macOS | NU |
| | Average incoming bitrate of all underlying web requests, consolidated over time | | | |
| average\_outgoing\_bitrate | bps | Windows | macOS | NU |
| | Average outgoing bitrate of all underlying web requests, consolidated over time | | | |
| cumulated\_web\_request\_duration | millisecond | Windows | macOS | NU |
| | Cumulated duration of web requests | | | |
| cumulated\_web\_interaction\_duration | millisecond | Windows | macOS | NU |
| | Cumulated time during which web requests occurred, counted with a 5 minutes resolution. | | | |
| average\_request\_size | byte | Windows | macOS | NU |
| | Average size of web requests | | | |
| average\_response\_size | byte | Windows | macOS | NU |
| | Average size of web responses | | | |
| average\_request\_duration | millisecond | Windows | macOS | |
| | Average time between request and last response byte | | | |
| successful\_http\_requests\_ratio | permill | Windows | macOS | NU |
| | Percentage of successful HTTP requests (1xx, 2xx and 3xx) | | | |
| number\_of\_events | integer | Windows | macOS | NU |
| | Number of events | | | |
## Definitions
The following document lists all objects, fields and aggregates available through NXQL. Each field and aggregate have a name, a type, properties and a description.
Platforms can have the following values:
* **W**: The field, aggregate or table is available on the Windows platform.
* **X**: The field, aggregate or table is available on the Mac OS platform.
* **M**: The field, aggregate or table is available on the Mobile platform.
Properties can have the following values:
* **DE**: The field or aggregate is deprecated.
* **PB**: The field or aggregate is in Public Beta.
* **FP**: The field or aggregate can be used without a between clause.
* **NU**: The field or aggregate can be nil.
* **SE**: The field or aggregate is only available with a license containing the **security** feature.
* **WE**: The field or aggregate is only available with a license containing the **web monitoring** feature.
* **NC**: The field is not comparable.