domain object NXQL (classic)

A domain is a domain name e.g. www.nexthink.com.

NameTypeOperating systemsProperties

database_usage

permill

Windows | macOS

Percentage of the database used by information related with the domain

domain_category

string

Windows | macOS

SE

Indicates the category of the domain:

  • '-': Not yet tagged or internal domain.

first_seen

datetime

Windows | macOS

NU

The first time the domain has been seen.

hosting_country

string

Windows | macOS

SE

Indicates in which country the domain is hosted:

  • '-': Not yet tagged, internal domain or not known by Nexthink Library.

hostname

string

Windows | macOS

NU

The hostname of the fully qualified domain name

id

identifier

Windows | macOS

Unique domain identifier

internal_domain

boolean

Windows | macOS

Indicates whether the domain is considered internal:

  • yes: The domain is not reported to Nexthink Library and subdomains are not compressed using the '*' pattern;

  • no: The domain is reported to the Nexthink Library (if the license includes the Security module); complex subdomains are compressed using the '*' pattern.

last_seen

datetime

Windows | macOS

NU

The last time the domain has been seen.

name

string

Windows | macOS

The fully qualified domain name

protocol

enum

Windows | macOS

Protocols used in web requests (HTTP, TLS, HTTP/TLS)

response_size

byte

Windows | macOS

Total web incoming traffic

storage

enum

Windows | macOS

Event storage policy for the domain (web request or none)

threat_level

enum

Windows | macOS

SE

Indicates the threat level of the domain:

  • '-': Not yet tagged or internal domain;

  • none detected: No known threat;

  • low: low threat;

  • intermediate: Intermediate threat;

  • high: High threat.

Last updated