Combining logical conditions in investigations with Finder (classic)

Nexthink Finder is a Windows-only desktop application whose functionality is now available within the Nexthink web interface. Nexthink can now be used directly from a browser and most functions no longer require an additional desktop application.

Because of their strict logical interpretation, conditions may be difficult to get right in some kinds of investigations. Be especially aware of literal translations from natural language to logical conditions, because they may lead to unexpected results.

To express what you really mean in an investigation, keep in mind that relations between objects in the Nexthink solution are all related to events in some way. For example, if a device is linked to an application, it is because the application was executed at some point on that device. The system iterates through these relations to return the results of an investigation.

Combining logical conditions

Imagine you’d like to get a list of the devices that have executed two different applications (for example Internet Explorer and Firefox) within a particular time frame, whose duration is irrelevant to our discussion. You may be tempted to use a logical AND (the default) to combine the conditions of an investigation on devices:

  • Condition 1 Application name is Internet Explorer

  • Condition 2 Application name is Firefox

  • Logical expression 1 AND 2

If you run this investigation, the list of devices that you get is always empty. The reason is, that any relationship between a device and an application ultimately relies on executions and no execution may simultaneously satisfy the two conditions: it is either an Internet Explorer execution or a Firefox execution, but not both. When the system iterates through these relations, it discards them all because none matches the two conditions at the same time, as required by the logical operator AND. Hence the empty result.

To properly state the desired query, keep the same conditions but modify a couple of inputs. First, change the logical expression from AND to OR:

Logical expression 1 OR 2

In this way, the system keeps the relations that match either the first condition or the second. That is, you get all the devices that executed either Internet Explorer, Firefox, or both.

Last, restrict the output to only those devices that executed the two applications. Add the following aggregate condition at the end of the conditions section:

Aggregate condition: Number of applications is 2

If you change your mind afterward and decide to ask for the devices that executed either Internet Explorer or Firefox, but not both, use the following aggregate condition instead:

Aggregate condition Number of applications is 1

Although not useful in the example, the logical AND is still the most common operator to combine conditions. Use it when you want to enforce two compatible conditions at the same time. For example, to know the devices that use Internet Explorer for browsing a particular domain, like, create an investigation on devices with the following conditions:

  • Condition 1 Application name is Internet Explorer

  • Condition 2 Domain name is

  • Logical expression 1 AND 2

Negating with an aggregate condition

Consider now the case of getting the list of devices that have not executed Firefox. By translating from natural language, you may wrongly assume that the following condition in an investigation on devices yields the correct result:

Condition Application name is not Firefox

Instead, this investigation returns all the devices that have executed any application, except for those few devices that have exclusively executed Firefox (probably none, as devices typically execute multiple applications simultaneously). Most likely, the result will thus be the full list of active devices.

The correct way to negate a condition is to first state the condition in a positive way and then negate the statement with an aggregate condition that looks for zero instances. For our example, with Firefox that would be:

  • Condition: Application name is Firefox

  • Aggregate condition Number of applications is 0

This way of negating conditions applies to many types of objects and events, such as executables, binaries, connections, packages, etc.

Last updated