Customizing built-in monitors

Customize system and library monitors and use them as the starting point for a more complex monitor configuration that increases the relevancy of alerts. System monitors are available for configuration from the Manage alerts page. Refer to the Nexthink Library documentation for more information about installing content.

Any modifications to a library monitor are not reflected in future updates to the original library monitor created by Nexthink.

Click on the action menu of the system or library monitor and select Configure.


Use the General tab to configure a built-in monitor.


View the type of detection mode the monitor is using. Built-in monitors offer the following detection modes:

  • Metric threshold: Compares the value of the NQL query-defined metric to a threshold defined by the user. For example, a monitor triggers an alert when 20% of devices running a binary experienced a crash. This option is available for custom and library monitors.

  • Metric change: Compares the value of the NQL query metric to a reference value. The system computes the reference value as the average of the metric values retrieved over the past 7 days. This option is available only for library monitors.

  • Metric seasonal change: Compares the value of the NQL query-defined metric with the expected averaged value of the last 7 days, based on the time of the day. The monitor triggers an alert when the value falls outside of the expected range, calculated using standard deviations.

  • Global detection: Detects issues based on anonymized data from all organizations using Nexthink. The monitor triggers an alert when a specified number of devices use a particular binary version or binary configuration that performs worse than other versions or configurations across organizations using Nexthink. You can adjust the threshold for this alert within your organization. This option is only available for system monitors.


View the name of the built-in monitor. The system uses this name to send notifications and visualize monitors on the Alerts overview page.


View the monitor NQL ID. Use it to query this monitor using NQL.

The Global issue detection type is based on anonymized data from all organizations using Nexthink and, therefore, does not require an NQL query.


Set the priority level. The default level is medium.


Create custom tags for monitors. This allows you to filter alerts using tags in the Overview dashboard and in the Webhooks integration. Currently, there is a maximum of 10 tags per monitor.

Query and conditions

NQL query

A built-in monitor uses a predefined query to determine which metric it evaluated. View the query directly in Investigations by clicking on the Show in Investigations button.

Trigger conditions

Define the condition that triggers an alert. Define a condition for each metric computed in the NQL query. In a metric change type monitor, only the first condition verifies the change of the metric, whereas all the additional conditions compare it against the threshold. In built-in monitors, some conditions are preconfigured, but you can adjust them to fit your organization's needs.

Use multiple metric thresholds to increase the relevancy of alerts. For example, use multiple metrics to ensure that the system does not raise alerts during low usage of the service or if a small number of devices are impacted.


Add additional filters to include or exclude certain applications or devices from being monitored. Filtering is only available for built-in monitors that evaluate the following inventory objects: users, devices, applications and binaries.

Additional ‘group-by’ clause

Add metrics for monitors that track device performance issues and call quality issues per organizational hierarchy breakdown, including custom levels and location breakdowns. Grouping is only available for built-in monitors that evaluate devices.

Scheduling frequency

The time interval determines how often the system evaluates the trigger condition. The scheduling frequency is fixed for built-in monitors.


Configure email or webhook notifications for built-in monitors as you would for any other monitor. Refer to the Configuring email and webhook notifications for alerts for more information.

Prerequisites and dependencies

  • The following library monitors require the Collaboration Experience expansion product:

    • Call quality - Zoom number of poor calls (increase)

    • Call quality - Teams number of poor calls (increase)

  • The following system monitors require Nexthink instances fully transitioned to Infinity :

    • Binary connection establishment time increase

    • Binary failed connection ratio increase

  • To use breakdown by location as an optional group by in device performance monitors, you need to enable the geolocation on the Product configuration page of the Administration module.

Go to


Last updated