NQL data model
Data model concepts
Consult the Understanding key data platform concepts page for more information about the various data model concepts.
This page does not include the dynamic data model, such as custom trends, custom fields or custom organizational classification, which is individual for each organization based on specific content and product configurations.
Data model tables
devices
Table of devices. A device is a physical or virtual machine monitored by Nexthink Collector.
device.antiviruses
The list of antivirus registered on the device and reported through WMI.
device.cpus
The list of CPU model names and their nominal clock speeds.
device.disks
The list of storage devices.
device.firewalls
The list of firewalls registered on the device and exposed through the Windows Security Center.
device.gpus
The graphics processing unit.
device.local_admins
The list of users and groups that are members of the local Administrators group on the device.
device.monitors
The list of monitors connected to the device.
device.npus
The neural processing unit.
device.volumes
The list of logical storage volumes.
device.mobile_devices
Table of mobile devices. A mobile device is a smartphone or tablet monitored by the Nexthink app.
binaries
The table containing binaries. A binary is an executable binary file identified by its hash code.
users
Table of users. A user is an object that represents an individual user account on a device (local user) or multiple devices (domain user). The user account may identify a physical user or a system user.
agent.conversations
The list of conversations with the Spark agent.
ai.tools
The table of defined AI tools.
ai.interactions_summary
This table collects interactions and usage summary data of the defined AI tools.
alert.monitors
The table of defined alert monitors in the system.
alerts
The table collecting information about instances where metric values go outside normal parameters as defined in monitors.
alert.impacts
The table collecting information about instances of an alert impact.
applications
Table of defined Web and Desktop applications.
application.guides
A guide represents any type of in-app guidance for end-users, including Walkthroughs (step-by-step guidance), Tooltips, and Media (PDFs, links, etc).
application.guide_steps
A step represents an individual part of a walkthrough, tooltip, or document.
application.network_applications
Table of defined network applications.
application.pages
Table of defined key pages.
application.transactions
Table of defined transactions.
campaigns
The table collecting all active and retired campaigns.
campaign.responses
The table collecting responses (expected or given) of a campaign by an employee.
collaboration.sessions
Table collecting meetings performed with collaboration tools such as Teams or Zoom.
connection.events
The connections.events table contains events for outgoing TCP connections and UDP packages. Some metrics are only available for TCP connections. These metrics are 'NULL' for UDP events. Connection events are associated to binaries, users, devices, and applications (optional).
connection.tcp_events
The connections.tcp_events table has been deprecated. Please use 'connection.events' table instead.
connection.udp_events
The connections.udp_events table has been deprecated. Please use 'connection.events' table instead.
connectivity.events
Table collecting performance metrics and attributes specific to a device's connectivity.
connectivity.mobile_events
The table collecting connectivity metrics and attributes specific to a device.
device_performance.boots
The table collecting all exit-from-inactive events of a device.
device_performance.events
The table collecting performance metrics and attributes specific to a device.
device_performance.hard_resets
The table contains hard resets, when a device reboots without first completing the shutdown procedure. For example, when a device unresponsive and must be powered off manually, or during unexpexted power loss.
device_performance.mobile_events
The table collecting performance metrics and attributes specific to a mobile device.
device_performance.suspends
The table collecting all transition-to-inactive events of a device.
device_performance.system_crashes
The table collecting the system crashes of the devices.
dex.application_scores
application_score
dex.scores
A table of the DEX score.
execution.crashes
The table collecting crashes of a running process.
execution.events
The table collecting performance metrics and attributes specific to a process execution.
packages
The table of packages. A package is a group of files and executables that together constitute a software application.
package.installations
The table of package installation events.
package.uninstallations
The table of package uninstallation events.
package.installed_packages
The table of all installed packages on all devices.
platform.accounts
account
platform.audit_logs
The list of all the events audited on the Infinity platform. Requires permission 'View audit logs in NQL'
platform.custom_trends_logs
The list of all logs associated to custom trends computations. Requires permission 'View platform logs in NQL'.
platform.data_export_logs
The list of all logs associated to data export executions. Requires permission 'View platform logs in NQL'.
platform.guide_step_stability_statistics
Represents daily-aggregated information about the stability of selectors for guide steps.
platform.inbound_connector_logs
The list of all logs associated to inbound connector executions. Requires permission 'View platform logs in NQL'.
remote_actions
The table of defined remote actions.
remote_action.executions
The table collecting the executed remote actions.
remote_action.executions_summary
The table collecting the trend of executed remote actions.
services
A table of services. A service performs automated tasks, responds to hardware events, or listens for data requests from other software. These services are often loaded automatically at startup and run in the background without user interaction.
service.changes
Contains events triggered when an attribute of an existing service changes on a device. The attributes tracked by these events are the same as those in the 'installed_services' table, for example, 'logon_as' and 'startup_type'.
service.installations
Contains event triggered when a service was added to or removed from a specific device.
service.installed_services
A table containing all services currently installed on all devices.
session.vdi_sessions
vdi_session
session.connects
The table collecting connections linked to user sessions.
session.disconnects
The table collecting disconnections linked to user sessions.
session.events
The table collecting performance metrics and attributes specific to both local and remote sessions.
session.lifecycle_events
The table collecting all events linked to user sessions.
session.locks
The table collecting locks linked to the user sessions.
session.logins
The table collecting all session logins.
session.logouts
The table collecting all session logouts.
session.unlocks
The table collecting unlocks linked to user sessions.
session.vdi_events
VDI Events
software_metering.meter_configurations
meter_configuration
software_metering.events
event
usage.account_actions
The list of all logs associated to account actions.
web.context_help_executions
End user interactions with the context help (opened or closed)
web.errors
The table collecting errors of defined business-critical services.
web.errors_summary
The table collecting errors of defined business-critical services up to 90d
web.events
web.events represent periodic signals of active usage time while a user has a tab in focus, regardless of interaction type. They primarily measure engagement duration, with events generated every 30 seconds during continued usage, even in error states.
web.events_summary
The table collecting events of defined business-critical services up to 90d
web.guide_executions
Represents a user interaction with a guide. It can be triggered when a guide is targeted (e.g. the guide is available for the user) or when a user interacts with the guide. In this case the status of the event is replaced with the latest status of targeted, started, completed or closed.
web.guide_step_executions
Represents user interactions with the guide steps. It can be triggered when a user closes or completes a step
web.guide_step_interactions
Represents any type of user interaction with the step, for example which button was clicked.
web.page_views
web.page_views capture navigations—i.e., when a user loads or switches to a new page within the application. A user can generate a single page view upon arrival, regardless of how long they remain on the page afterward.
web.page_views_summary
Table collecting page views of defined business-critical services up to 90d
web.transactions
The table collecting transactions of defined business-critical services.
web.transactions_summary
The table collecting transactions of defined business-critical services up to 90d
workflows
workflow
workflow.executions
execution
workflow.executions_summary
execution_summary
Namespace device
The device namespace includes one large devices table, which has multiple fields referring to device properties such as hardware, operating system and also Nexthink Collector.
devices
Table of devices. A device is a physical or virtual machine monitored by Nexthink Collector.
ad_site
string
AD site: Indicates the site to which the device is assigned to in Active Directory (AD). Details: In case the device is not part of a domain, the value shows as "-".
Windows macOS
boot.days_since_last_full_boot
integer
Days since last full boot: The number of days since the device last boot following a restart or a complete shutdown.
Windows macOS
boot.last_full_boot_duration
duration
Last full boot duration: The duration of the device last boot following a restart or a complete shutdown.
Windows
boot.last_full_boot_time
datetime
Last full boot time: The date and time of the device last boot following a restart or a complete shutdown.
Windows macOS
collector.last_update_status
string
Collector last update status: The last update status received from a specific Collector instance.
Windows macOS
collector.last_update_status_date
datetime
Collector last update status date: The reception date of the last update status for a specific Collector instance.
Windows macOS
collector.local_ip
ipAddress
Collector local IP: The local IP used for the traffic between the endpoint and the Nexthink Instance.
Windows macOS
collector.tag_id
numeric
Collector tag: The configurable number that identifies a group of Collector instances. The tag is useful for defining the entities to build hierarchies. Details: An optional field that must be an integer number between 0 and 2147483647. Could complement the Collector string tag.
collector.tag_string
string
Collector string tag: The configurable label that identifies a group of Collector instances. The string tag is useful for defining the entities to build hierarchies. Details: An optional field, with a maximum length of 2048 characters. Could complement the Collector tag.
Windows macOS
collector.target_update_date
datetime
Collector target update date: The date when the devices install the target version.
Windows macOS
collector.target_version
version
Collector target version: The version to which all Collector instances update next.
Windows macOS
collector.uid
uuid
UID: The Collector unique identifier, provided using the UUID format.
collector.update_group
string
Collector update group: For scheduling separate waves of Collector updates, the devices are assigned to one of the available update groups.Possible values:
Pilot
Main
Unsupported OS
Details: By default, 10% of all the Collector instances are assigned to the Pilot update group. The Pilot group starts updating two days after a new Collector version is available. The Main group starts updates 14 days after the Pilot group.
Windows macOS
collector.version
version
Collector version: Indicates the version of the Collector instance installed on the device.
Windows macOS
configuration_tag
string
Configuration tag: A configurable label that identifies a group of devices. The string tag is useful for defining the entities to build hierarchies.
Windows macOS
connectivity.last_connectivity_type
enumeration
Connectivity type: Last type of network adapter used. Possible values are:
WiFi
Ethernet
Bluetooth
Windows macOS
connectivity.last_local_ip
ipAddress
Local IP: The last local IP address for the primary physical network adapter of the device.
Windows macOS
days_since_first_seen
integer
Days since first seen: The number of days since the first time the device was seen by the Nexthink instance.
Windows macOS
days_since_last_seen
integer
Days since last seen: The number of days since the last time the device was seen active by the Nexthink instance.
Windows macOS
distinguished_name
string
Distinguished name: The unique identifier of a device when joined to a domain or workgroup. Details: Shows as "-" when the device is not part of a domain or workgroup.
Windows macOS
entity
string
Entity: A customizable field used for organizing a group of devices into logical groups.
Windows macOS
first_seen
datetime
First seen: The date and time the device was first seen by the Nexthink instance.
Windows macOS
group_name
string
Group name: The name of the security group containing the device when joined to a domain or workgroup.
Windows macOS
hardware.bios_serial_number
string
BIOS serial number: The serial number of the motherboard. Details: On macOS, this is the same as the chassis serial number.
Windows macOS
hardware.chassis_serial_number
string
Chassis serial number: The chassis serial number. Details: On macOS, this is the same as the BIOS serial number.
Windows macOS
hardware.machine_serial_number
string
Machine serial number: The unique serial number of the device in a UUID format.
Windows macOS
hardware.manufacturer
string
Manufacturer: The short name of the device manufacturer. Details: While devices might natively report slight variations of it, for example, sometimes dependent on the model or year of introduction, the information is simplified to ensure consistency across different devices of the same manufacturer.
Windows macOS
hardware.memory
bytes
Installed memory: The total amount of random-access memory (RAM) installed on the device.
Windows macOS
hardware.model
string
Device model: The model of the device. Details: On Windows, it is provided by the device manufacturer using the WMI interface as the product name. On macOS it is the "model id" provided by System Profiler.
Windows macOS
hardware.product_id
string
Product ID: A variant of a specific device model, sometimes also referred to as the SKU number. Details: Provided by the device manufacturer through the WMI interface as the SKUNumber.
Windows macOS
hardware.product_line
string
Product line: The product line or hardware version information. Details: Provided by the device manufacturer through the WMI interface as the product version.
Windows macOS
hardware.type
enumeration
Device type: The device form factor:
desktop
laptop
virtual
Details: The Windows devices are considered to be a laptop if they have a "lid closed" sensor. For macOS this information comes from the device model.
Windows macOS
last_seen
datetime
Last seen: The date and time of the last device activity received by the Nexthink instance.
Windows macOS
license_type
enumeration
License type: Specifies the license category assigned to the device, based on the product type reported by the operating system. For example, multi-session Windows is reported as server. Possible values:
endpoint
server
thin_client
Details: Session-based (VDI) licenses are independent and must not be derived from this field.
Windows macOS
location.country
string
Country: The country where the device is located.
Windows macOS
location.site
string
Site: Custom-defined identifier (office, city, ...) where the device is located.
Windows macOS
location.state
string
State: The subdivision (for example, state) where the device is located.
Windows macOS
location.type
string
Location type: The type of location indicates whether the device is onsite or remote.
Windows macOS
login.last_login_user_name
string
Last logged in user: The name of the user associated to the last login on the device.
Windows macOS
membership_type
enumeration
Membership type: The type of computer group membership. Possible values:
standalone
workgroup
domain
open directory
Details: Possible values:
domain
workgroup
standalone
open directoryWhen not available, shows as "-".
Windows macOS
name
string
Name: The name of the device as used by the operating system for identification purposes on the local network. Details: Source:
For Windows: NetBios Name
For macOS: LocalHostName
Windows macOS
operating_system.architecture
enumeration
Architecture: The architecture of the device operating system. The instruction set it can natively execute. Details: Possible values:
x86
x64
ARM64
Windows macOS
operating_system.build
version
Build: The build number of the operating system. Details: The build number is set to "0.0.0.0" if the Collector version is incompatible or the data is not yet available.
Windows
operating_system.days_since_last_update
integer
Days since last system update: The number of days since the last system update.
Windows
operating_system.is_activated
bool
Is activated: The Windows license activation status. Details: macOS does not require a license since OSX 10.9 Mavericks (released in 2013), and shows as "-".
Windows
operating_system.last_update
datetime
Last system update: The date and time of the last system update.
Windows
operating_system.msi_status
enumeration
MSI status: MSI status Details: MSI status
Windows
operating_system.name
string
Name: The combination of the name, version and architecture (when applicable) of the operating system. Details: The operating system name is set to "Unknown" if the name or version cannot be retrieved or mapped to a valid value.
Windows macOS
operating_system.platform
enumeration
Platform: The software platform composed of a collection of operating system families providing access to the same objects, activities, events and properties. Details: Possible values are:
Windows
macOS
Linux
Windows macOS
operating_system.wmi_status (deprecated)
enumeration
WMI status: This field is deprecated and will be replaced in the future. Details: The status of the WMI extension the Collector relies on for device identification. Deprecation reason: This field has been depreciated since 2024.3 and This field is used internally to mitigate potential transient issues with this particular WMI source. It does not reflect the status of WMI generally.
Windows
organization.entity
string
Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
public_ip.city
string
City: The city where the device is located.
Windows macOS
public_ip.country
string
Country: The country where the device is located.
Windows macOS
public_ip.ip_address
ipAddress
Public IP address: The public IP address of the device.
Windows macOS
public_ip.isp
string
ISP: The internet service provider of the device.
Windows macOS
public_ip.state
string
State: The subdivision (for example, state) where the device is located.
Windows macOS
sid
string
SID: The Security Identifier (SID) of the device, often used for identification and permission control purposes.
Windows macOS
uid
uuid
Device UID: Unique identifier of the device.
Windows macOS
user_account_control_status
enumeration
User account control status: Indicates if the User Account Control (UAC) is configured, forcing applications to request explicit approval from the user to make changes to the computer or to run with elevated permissions. Details: Possible values:
ok (apps ask for approval)
at risk
unknown
virtualization.desktop_broker
enumeration
Desktop broker: VDI broker platform of the VM. Details: Derived from the configured Inbound Connector integration. Indicates which VDI management platform enriches VMs in the device inventory with broker-level metadata.
Windows
virtualization.desktop_pool
string
Desktop pool name: The hardware characteristics of the associated virtual machines.
Windows
virtualization.disk_image
string
Disk image: The disk image last observed in use by the virtual machine.
Windows
virtualization.environment_name
string
Environment name: Name of the connector used to retrieve the virtualization details.
Windows
virtualization.hostname
string
Virtualization hostname: The name of the virtualization host where the virtual machine was last observed running.
Windows
virtualization.hypervisor_name
string
Hypervisor name: The hardware virtualization system running the virtual machine.
Windows
virtualization.instance_size
string
Instance size: A predefined configuration that determines the CPU, memory and storage which is allocated to a virtual machine.
Windows
virtualization.last_update
datetime
Last update: Date and time when the desktop virtualization information was last updated.
Windows
virtualization.region
string
Region: Geographical areas where one or more Microsoft Azure data centers are located.
Windows
virtualization.type
enumeration
Desktop pool type: The type of the desktop pool. Possible values are:
shared, several users work on the same virtual machine at the same time
personal, the virtual machine is used by one user at a time and all changes to the system persist
pooled, the device is used by one user at a time and during the logoff all changes including documents and data are erased.
Windows
virtualization.vdi_reporting
enumeration
VDI reporting: Highlights whether the device supports VDI Experience and whether it has already been enabled. Details: Possible values are:
not_supported: device is not compatible with VDI Experience
inactive: a compatible agent is detected, but reporting is not yet enabled
active: a compatible agent is detected and it is reporting data
unknown: the Collector version running on the device does not yet report VDI Experience compatibility information.
Windows
antiviruses
The list of antivirus registered on the device and reported through WMI.
is_up_to_date
enumeration
Up to date: The up-to-date status of the antivirus. Possible values are:
yes
no
not_reported
not_applicable
Windows
name
string
Name: The name of the main antivirus.
Windows
real_time_protection
enumeration
Real-time protection: The status of the antivirus real time protection (RTP). Possible values are:
not_reported: incompatible Collector version or the data is not yet available
enabled: : indicates that the RTP is active
disabled: indicates that either the RTP is inactive or the antivirus is not detected
partially_enabled
not_applicable
Windows
cpus
The list of CPU model names and their nominal clock speeds.
frequency
integer
CPU frequency: The CPU base frequency in MHz. The base frequency can be much smaller than the maximum turbo frequency. For example, the Intel Core i7-8565U CPU has a base frequency of 1.80 GHz and a maximum frequency of 4.6 GHz.
Windows macOS
name
string
CPU name: The CPU model.
Windows macOS
number_of_cores
integer
Number of cores: The number of CPU cores.
Windows macOS
number_of_logical_processors
integer
Number of logical processors: The number of CPU cores multiplied by the number of threads that can run on each core using hyperthreading.
Windows macOS
disks
The list of storage devices.
capacity
bytes
Capacity: The disk capacity. Details: The metric is displayed in units based on the binary system. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
Windows macOS
is_bootable
bool
Is bootable: Returns the value "yes" when the device boots from that disk.
Windows macOS
name
string
Name: The name of the physical or virtual disk drive.
Windows macOS
type
enumeration
Type: The type of drive. Possible values are:
HDD
SSD
Other
Windows macOS
firewalls
The list of firewalls registered on the device and exposed through the Windows Security Center.
name
string
Name: The name of the main firewall.
Windows
real_time_protection
enumeration
Real-time protection: The status of the firewall real time protection (RTP). Possible values are:
not_reported: incompatible Collector version or the data is not yet available
enabled: indicates that RTP is active
disabled: indicates that either RTP isn’t active or no antivirus has been detected
partially_enabled
not_applicable
Windows
gpus
The graphics processing unit.
memory
bytes
Memory: The video memory in bytes.
Windows
name
string
Name: The graphics card name.
Windows
local_admins
The list of users and groups that are members of the local Administrators group on the device.
name
string
Name: The users who are members of the local Administrators group on the device.
Windows
type
enumeration
Type: The type of the user. Possible values are:
user
group
Windows
monitors
The list of monitors connected to the device.
diagonal_size
float
Diagonal size: The diagonal size in inches.
Windows
horizontal_resolution
integer
Horizontal resolution: The maximum horizontal resolution in pixels.
Windows
name
string
Name: The monitor name.
Windows
serial_number
string
Serial number: The monitor serial number.
Windows
vendor
string
Vendor: The monitor vendor.
Windows
vertical_resolution
integer
Vertical resolution: The maximum vertical resolution in pixels.
Windows
npus
The neural processing unit.
manufacturer
string
Manufacturer: The NPU vendor or manufacturer (for example, Qualcomm, AMD, Intel).
Windows
name
string
Name: The neural processing unit (NPU) name.
Windows
shared_memory
bytes
Shared memory: The maximum amount of system memory that can be used by the NPU.
Windows
volumes
The list of logical storage volumes.
capacity
bytes
Capacity: The volume capacity in bytes. Details: The metric is displayed in units based on the binary system. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
Windows macOS
name
string
Name: The name of the volume.
Windows macOS
system
bool
Operating system volume: Returns the value "yes" when the volume contains the operating system.
Windows macOS
usage
percentage
Usage: The volume usage in percent.
Windows macOS
mobile_devices
Table of mobile devices. A mobile device is a smartphone or tablet monitored by the Nexthink app.
days_since_last_seen
integer
Days since last seen: The number of days since the last time the mobile device was seen active by the Nexthink instance.
governance.compliance_state
string
Compliance state: The current compliance status of the device as reported by the MDM. Details: Shows whether the device meets the organization's compliance policies. Compliance is usually determined by policies on OS version, encryption, or password settings.
governance.enrollment_type
string
Enrollment type: Defines how the device was enrolled into MDM management. Details: The enrollment method used when the device was registered in MDM. Helps determine management depth and available policy controls.
governance.is_encrypted
bool
Encryption enabled: Indicates whether the device storage is encrypted. Details: True if device storage is encrypted according to MDM reports. Encryption ensures that device data is protected if the device is lost or stolen.
governance.is_supervised
bool
Supervised device: Indicates if the device is supervised by the MDM, allowing deeper management capabilities. Details: True if the device is supervised. Supervision allows advanced management features such as app restrictions or silent app installation. On iOS, supervision is typically applied during setup via Apple Configurator or DEP enrollment.
governance.last_synced
datetime
Last synced: The last time the MDM successfully synced data with the device. Details: Timestamp of the most recent successful sync between the device and the MDM. A stale timestamp may indicate a device that is inactive or unreachable.
governance.name
string
Managed device name: The device name as assigned in the Mobile Device Management (MDM) system. Details: Represents the device name configured by inside the MDM. Useful for identifying devices in enterprise inventory. May differ from the local device name.
governance.ownership_type
string
Ownership type: Specifies whether the device is company-owned or personally-owned.
hardware.battery_type
enumeration
Battery type: The battery type of the installed battery. Details: Specifies the installed battery’s type (e.g., Li-ion, Li-Poly).
hardware.imei
string
IMEI: The International Mobile Equipment Identity (IMEI) of the device. Details: A globally unique hardware identifier for cellular devices. Used to identify devices on mobile networks. Collected via MDM for inventory purposes.
hardware.main_display.diagonal
float
Diagonal size: The physical size of the display in inches.
hardware.main_display.horizontal
integer
Horizontal: The horizontal size of the main display in px.
hardware.main_display.vertical
integer
Vertical: The vertical size of the main display in px.
hardware.manufacturer
string
Manufacturer: The name of the mobile device manufacturer. Details: Always shown as “Apple” for iOS; based on the hardware information for Android devices.
hardware.memory
bytes
Available memory: The total amount of random-access memory (RAM) available to the system.
hardware.model
string
Device model: The model of the device.
hardware.remaining_battery_capacity
numeric
Remaining capacity of the battery: The remaining capacity of the installed battery. Details: The total charge the battery can hold when fully charged, reflecting some wear and aging compared to the original design capacity (in mAh).
hardware.serial_number
string
Serial number: The hardware serial number of the device. Details: Unique identifier assigned by the manufacturer. Used for asset tracking and warranty lookup.
last_seen
datetime
Last seen: The date and time of the last mobile device activity received by the Nexthink instance.
name
string
Name: The name of the mobile device as used by the operating system. Details:
nexthink_app.tag_string
string
Nexthink app string tag: The configurable label that identifies a group of mobile devices. The string tag is useful for defining the entities to build hierarchies. Details: An optional field, with a maximum length of 2048 characters.
nexthink_app.uid
string
UID: DEPRECATED/HIDDEN: The nexthink app unique identifier.
nexthink_app.version
version
Nexthink app version: Indicates the version of the nexthink app instance installed on the mobile device.
operating_system.api_version
integer
API version: Indicates the highest API level the device supports, reflecting its OS capabilities. Details: On Android, the latest API version is retrieved as a specific API level. On iOS, the operating system version itself (e.g., iOS 16.4) serves as the equivalent of the latest API level.
operating_system.architecture
enumeration
Architecture: The architecture of the mobile device operating system. The instruction set it can natively execute.
operating_system.build
string
Build: The build number of the operating system. Details: The build number is set to "0.0.0.0" if the Nexthink app version is incompatible or the data is not yet available.
operating_system.language
string
Operating system language: The defined language by the operating system.
operating_system.name
string
Name: The combination of the name, version and architecture (when applicable) of the operating system. Details: The operating system name is set to "Unknown" if the name or version cannot be retrieved or mapped to a valid value.
operating_system.patch_level
string
Patch level: The current patch level of the mobile device. Details: The patch level is set to 0 if the app is incompatible or the data is not yet available.
operating_system.platform
enumeration
Platform: The software platform composed of a collection of operating system families providing access to the same objects, activities, events and properties. Details: Possible values are:
Android
iOS
Windows macOS
operating_system.timezone
string
Operating system timezone: The defined timezone by the operating system.
primary_user_upn
string
Primary user UPN: Primary User Principal Name (UPN) provided by the MDM. Used as a soft linkage between the mobile device and its assigned user. Details: This value is retrieved from the MDM and represents the assigned user for the device.
uid
string
UID: The mobile device unique identifier.
Namespace binary
Table of binaries. A binary is an executable binary file identified by its hash code.
binaries
The table containing binaries. A binary is an executable binary file identified by its hash code.
architecture
enumeration
Architecture: The OS architecture for which the binary is compiled (32-bit or 64-bit).
Windows macOS
company
string
Company: The name of the company that produced the binary. Details: Information retrieved from the file properties.
Windows macOS
description
string
Description: A description explaining the purpose of the binary, or providing additional details. Details: Description is generated by AI.
Windows macOS
first_seen
datetime
First seen: The date and time the binary was first seen by the Nexthink instance.
Windows macOS
has_user_interface
bool
Has user interface: An indication whether the binary has an interactive window while running. Details: On Windows platform, the reported value is 'true' or 'false' if the binary has no interactive window, or if the information is not available. On other platforms, the value is always NULL.
Windows
last_seen
datetime
Last seen: The date and time of the last binary activity received by the Nexthink instance.
Windows macOS
md5_hash
bytea
MD5 hash: The MD5 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The MD5 hash represented in base64 format.
Windows macOS
md5_hash_hex
bytea
MD5 hash hex: The MD5 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The MD5 hash represented in hex format.
Windows macOS
name
string
Name: The filename of the binary.
Windows macOS
platform
enumeration
Platform: The OS family on which the binary natively runs. Details: Possible values:
Windows
macOS
Linux
Windows macOS
product_category
string
Product category: A broad, general classification of similar products. Details: Category is generated by AI.
Windows macOS
product_name
string
Product name: The name of the application associated with the file. Details: Information retrieved from the file properties.
Windows macOS
product_subcategory
string
Product subcategory: A more specific classification or subdivision within a larger category. Details: Subcategory is generated by AI.
Windows macOS
sha-1_hash
bytea
SHA-1 hash: The SHA-1 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The SHA-1 hash represented in base64 format.
Windows macOS
sha-1_hash_hex
bytea
SHA-1 hash hex: The SHA-1 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The SHA-1 hash represented in hex format.
Windows macOS
sha-256_hash
bytea
SHA-256 hash: The SHA-256 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The SHA-256 hash represented in base64 format.
Windows macOS
sha-256_hash_hex
bytea
SHA-256 hash hex: The SHA-256 fingerprint calculated by the Collector instance. It can be used to uniquely identify a binary. Details: The SHA-256 hash represented in hex format.
Windows macOS
size
bytes
Size: The size of the binary file, shown in bytes.
Windows macOS
uid
uuid
Binary UID: The unique identifier for the binary.
Windows macOS
version
version
Version: The version of the binary file, retrieved from the file properties.
Windows macOS
Namespace user
The users table within the user namespace, includes information about the individual accounts across the IT infrastructure. It contains all employees recognized by your Nexthink instance. Most of the table fields are derived from Entra ID and are included in the "ad" grouping. A user may have access to more than one device.
users
Table of users. A user is an object that represents an individual user account on a device (local user) or multiple devices (domain user). The user account may identify a physical user or a system user.
ad.city
string
City: The name of the city the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.country_code
string
Country code: The country or region the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: The country or region is represented as a two-character code based on the ISO-3166 standard. Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.department
string
Department: The name of the department the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.distinguished_name
string
Distinguished name: The unique identifier of a domain user for an on-premises Active Directory (AD). Requirements: Requires one or more connectors for Entra ID correctly configured, and Entra ID needs to be synchronized with an on-premises AD. Details: The distinguished name follows the LDAP syntax. Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.email_address
string
Email address: The email address of the user. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.full_name
string
Full name: The name displayed in the address book for the user. This is usually the combination of the user's first name, middle initial and last name. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.job_title
string
Job title: The job title assigned to the user in Active Directory. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.last_update
datetime
Last update: The date and time of the last update received for the user information from Entra ID.
Windows macOS
ad.office
string
Office: The name of the physical location or office the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.organizational_unit
string
Organizational unit name: The name of the directory folder containing the user account. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
ad.username
string
AD Username: The name of the user account as it appears in Entra ID. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.
Windows macOS
days_since_first_seen
integer
Days since first seen: The number of days since the first time the user account was seen by the Nexthink instance.
Windows macOS
days_since_last_seen
integer
Days since last seen: The number of days since the last time the user account was seen active by the Nexthink instance.
Windows macOS
first_seen
datetime
First seen: The date and time the user account was first seen by the Nexthink instance.
Windows macOS
last_seen
datetime
Last seen: The date and time of the last user account activity received by the Nexthink instance.
Windows macOS
name
string
Username: The name of the user account on the local device. Requirements: The collector is configured to report the username: Configuring Collector level anonymization Details: Depending on the configuration, the Collector reports username in cleartext, as a hashed value or not at all.
Windows macOS
sid
string
SID: The unique security identifier (SID) of the user account on Windows. Details: On Windows, each user account has a unique security identifier (SID) used to provide access to system resources. On macOS, a unique SID is generated by Nexthink to facilitate user identification.
Windows macOS
type
enumeration
Type: The type of the user account. Details: Nexthink recognizes three types of user accounts:
A local user account is an account that only exists on a single device. It cannot be used to login to systems other than that specific device.
A domain user account is a user account managed by Microsoft Active Directory, enabling users to log in across various devices and access multiple services.
A system account is a form of a local account that has special privileges on a device.
Windows macOS
uid
uuid
User UID: The value that uniquely identifies a user on the Nexthink platform.
Windows macOS
upn
string
UPN: The User Principal Name (UPN), a unique identifier for a user account. Requirements: The Collector reports the UPN for Active Directory and Microsoft Entra ID user accounts on Windows, and for mobile and Jamf Connect-linked local user accounts on macOS. Nexthink does not report UPNs for system accounts or local accounts (without Jamf Connect for macOS). The collector must be configured to report the UPN: Configuring Collector level anonymization Details: The User Principal Names (UPN) is a standardized identifier for users (RFC822). Normally, it takes the form of an email address. The UPN allows to uniquely identify a user across systems, for example, devices with different OS platforms. Nexthink uses the UPN to enrich user objects with data from third-party services. If the Collector cannot retrieve the UPN for a user, the UPN is NULL (displayed as “-”) and the upn_privacy_level is set to no_import (independent from the Collector configuration).
Windows macOS
upn_privacy_level
enumeration
UPN privacy level: Indicates how securely the User Principal Name (UPN) is stored by the Nexthink instance. Requirements: The collector is configured to report the UPN: Configuring Collector level anonymization Details: The User Principal Name (UPN) privacy level is a Collector configuration parameter on the user device. Depending on the configuration, the Collector reports UPN in cleartext, as a hashed value or not at all. The options are represented by the following values:
cleartext
hashed
no_import
Windows macOS
Namespace agent
The agent namespace contains a set of tables that store information about conversations between users and the Spark agent.
conversations
The list of conversations with the Spark agent.
conversations are punctual events.
conversations are associated to device, user
category
string
Category: The category of the issue to which the conversation relates. Details: Automatically categorized by AI based on the contents of the conversation. If the conversation includes several topics, the category is set to the main topic.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
conversation_duration
duration
Conversation duration: The elapsed time between the first and last messages in the conversation.
conversation_id
uuid
Conversation ID: The unique identifier of the conversation. Details: The identifier is automatically generated by the system when the conversation starts.
first_message_time
datetime
First message time: The time at which the user initiated the conversation.
intent
string
Intent: A short summary of the issue that the user faced. Details: Automatically generated by AI based on the user's problem or request.
interactions
integer
Interactions: The number of interactions in the conversation between the user and the agent. Details: It counts the number of times the conversation alternates between the user and the agent. It does not count intermediate messages.
number_of_conversations
integer
Number of conversations: Used for calculating aggregated metrics (like count, etc) in NQL. The value for every event is always 1
number_of_turns
integer
Number of turns: The number of turns in the conversation between the user and the agent. Details: It counts the number of time the conversation alternates between the user and the agent. It does not count intermediate messages.
outcome
enumeration
Outcome: The outcome of the conversation. Only set for completed conversations. Details: Possible values:
unspecified
resolved
escalated
abandoned
non_support
state
enumeration
State: The current state of the conversation. Details: Possible values:
in progress
completed
time
datetime
Time: The date and time at which the last message in the conversation was sent or received.
type
enumeration
Type: The classification of the conversation. Details: Possible values:
incident
request
question
security_concern
non_support
Namespace ai
The ai namespace contains tables detailing AI tool usage and configurations, which define the tools available for monitoring.
tools
The table of defined AI tools.
name
string
Name: The name of an AI tool.
nql_id
string
NQL ID: The unique identifier of an AI tool configuration. Details: NQL ID cannot be changed after initial creation.
status
enumeration
Status: The status of the AI tool as set in the "Manage AI tools". Details: Possible values are:
active
deleted
interactions_summary
This table collects interactions and usage summary data of the defined AI tools.
interactions_summary are sampled events.
interactions_summary are associated to user, tool
bucket_duration
duration
Bucket duration: The duration of the bucket.
end_time
datetime
Bucket end: The date and time of the bucket end.
engagement_time
duration
Engagement time: The user's engagement time with AI.
host_application
string
Host application: The application through which AI interaction occurred.
license_type
enumeration
License type: Represents if the AI tool is licensed or not. Possible values are:
licensed
not_licensed
number_of_interactions
integer
Number of interactions: The number of interactions with AI.
start_time
datetime
Bucket start: The date and time of the bucket start.
usage_type
enumeration
Usage type: The AI tool usage type. Values are:
web
desktop
api
Namespace alert
The alert namespace consists of two tables: alerts and monitors. Monitors store sets of rules configured by Nexthink users (monitor name, threshold, priority, etc.), describing acceptable limits for metrics. Alerts store information about instances where metric values go outside normal parameters as defined in monitors. You may want to query the alerts table if you have permission to run investigations but are not allowed to access alerts dashboards or when creating dashboards for reporting.
monitors
The table of defined alert monitors in the system.
comparison_operator
enumeration
Comparison operator: Determines when a monitor should trigger an alert. Details: One of the key elements used to define the conditions within a monitor in order to trigger an alert. It is specifically utilized when setting up the breaching criteria for the primary metric. A comparison operator allows for the comparison of values to determine if the specified condition is met. Possible values are:
at_least
less_or_equal
multiple_contexts
bool
Multiple-context: Indicates if the monitor triggers alerts with different contexts. Details: The value is set to "Yes" when NQL has a "group by" clause.
name
string
Monitor name: The assigned name of a configured monitor. Details: A monitor is a defined set of metrics and conditions used to continuously observe a system or process and trigger an alert when certain criteria are met. The name of the custom monitor can be changed after creation. Do not consider it as a unique identifier.
nql_id
string
NQL ID: The unique NQL identifier of the monitor. Details: NQL ID cannot be changed after initial creation.
origin
enumeration
Monitor origin: Indicates where the monitor originates from. Monitors can be built-in to the Nexthink platform (system), installed using a library pack (library) or created manually (custom)
priority
enumeration
Priority: The importance of alerts that are triggered by the monitor. Details: Possible values are:
critical
high
medium
low
defined by the user in the monitor configuration.
status
enumeration
Status: The status of the monitor as set in the "Manage monitors". Details: Possible values are:
active
deleted
tags
jsonArrayString
Alert tags: List of user-defined labels that are assigned to a monitor and subsequently utilized for filtering alerts that are generated by the monitor. Details: Tags are created and specified within the monitor configuration. By assigning tags to monitors, users can categorize and organize monitors based on specific criteria, making it easier to filter and manage alerts based on these tags. Up to 10 custom tags are allowed per monitor.
threshold
float
Threshold: It defines the value of the primary metric that must be exceeded for the monitor to trigger an alert. Details: The threshold value serves as a reference point against which the metric actual value is compared to determine if it breaches the defined condition and triggers an alert.
thresholds
jsonArrayString
Thresholds: It contains the values of all metrics that need to be breached to trigger an alert.
type
enumeration
Monitor type: The chosen method used for monitoring. It identifies the specific approach employed to observe and evaluate the system or process being monitored. Details: Possible values are:
metric_threshold
metric_change
alerts
The table collecting information about instances where metric values go outside normal parameters as defined in monitors.
alerts are punctual events.
alerts are associated to user, device, monitor
context
jsonArrayString
Context: Relevant information required for understanding the alert. Details: Depending on the alert, the context information may contain the name of the binary, device or user associated with the alert. It is the JSON-formatted payload of the alert.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
context_hash
string
Context hash: The unique fingerprint of the alert context. Details: The fingerprint is created by calculating an MD5 hash context.
duration
duration
Alert duration: The duration of the alert's activity. Details: Calculated as the time between the trigger and the recovery if the alert is closed, or between the trigger and the current time if the alert is open.
is_auto_recovery
bool
Auto-recovery: Indicates whether the alert was auto-recovered. Details: Auto-recovery takes place when there are no events recorded for the metric(s) specified in the monitor configuration within the selected timeframe. Yes, if the alert is auto-recovered
is_grouped
bool
Group alert: Represents a situation where too many alerts have been simultaneously generated by a single monitor. The monitor will not generate any more alerts until the situation has been resolved.
number_of_alerts
long
Number of alerts: The number of triggered alerts.
recovery_reference_value
float
Recovery reference value: The reference value of the main (first) monitored metric that is checked to recover an alert.
recovery_time
datetime
Recovery time: Date and time at which the alert was recovered.
recovery_value
float
Recovery value: The value of the metric that caused the alert to be recovered. Equal to the first metric value if more than one trigger condition is defined.
recovery_values
jsonArrayString
Recovery values: The lists of values of all the monitored metrics reported when the alert has recovered.
status
enumeration
Status: Status of the alert event. Can be open or closed. Details:
Open: the alert is currently active.
Closed: the alert has been recovered.
time
datetime
Alert time: Start time of the 15-minute bucket in which the alert occurred.
trigger_reference_value
float
Trigger reference value: The reference value of the metric against which the current value was compared to trigger the alert.
trigger_time
datetime
Trigger time: Date and time when the alert was raised.
trigger_value
float
Trigger value: The value of the metric that bypassed the threshold defined in the monitor configuration and caused the alert to be raised. Details: This is equal to the first metric value if more than one trigger condition is defined.
trigger_values
jsonArrayString
Trigger values: The values of the metrics that bypassed their monitor configuration-defined thresholds and caused the alert to be raised.
uid
uuid
Alert event UUID: The unique identifier of the alert event.
impacts
The table collecting information about instances of an alert impact.
impacts are punctual events.
impacts are associated to user, device, monitor
alert_uid
uuid
Associated alert event UUID: The unique identifier of the associated alert event.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Impact duration: The duration of the impact. Details: It is calculated as the time between the "from_time" and the "to_time" if there is more than one trigger, or between the "from_time" and now if there is only one trigger.
from_time
datetime
Impact from: Impact from
to_time
datetime
Impact to: Impact to
Namespace application
The application namespace contains a set of tables that store information about business-critical services configured by Nexthink users in the Application module. The tables include configuration data such as the name and ID of each application, as well as defined key pages and transactions. These tables can be queried alongside associated tables to help identify issues with business-critical services.
applications
Table of defined Web and Desktop applications.
category
enumeration
Category: The category of the application: Collaboration, Connectivity, and Standard. Requirements: Define the application category from the application configurations. Details: Connectivity applications (for example, VPN, ZTNA, and XDR) are highlighted in the device view to correlate their activity with any employee connectivity issues. Collaboration applications (for example, Teams or Zoom) are displayed in the device view timeline under the Collaboration section. Any other application falls under the Standard category. Applications are assigned the Standard category by default; select the Connectivity or Collaboration category when applicable. Refer to the Configuring applications documentation
name
string
Name: The name of the web, desktop, or hybrid application. Requirements: Define the application name from the application configurations. Details: Refer to the Configuring applications documentation
guides
A guide represents any type of in-app guidance for end-users, including Walkthroughs (step-by-step guidance), Tooltips, and Media (PDFs, links, etc).
name
string
Guide name: Name of the guide should be unique on an application level, but not at the tenant level.
nql_id
uuid
Guide unique identifier: Unique identifier of the guide
type
enumeration
Guide type: Type of the guide: Walkthrough (step-by-step guidance), Tooltip, or Media (PDFs, links, etc).
guide_steps
A step represents an individual part of a walkthrough, tooltip, or document.
completion_element_version
integer
Completion element version: Version of the completion element definition. If no completion element is defined, the value is null
guide_nql_id
uuid
Guide UID: Guide identifier containing this step.
name
string
Step name: Name of the step is generated from the first sentence within its content
nql_id
string
Step unique identifier: Unique identifier of the step
position_element_version
integer
Position element version: Version of the position element definition. If no position element is defined, the value is null
rank
integer
Step rank: Position or sequence of the step in the guide
trigger_element_version
integer
Trigger element version: Version of the trigger element definition. If no trigger element is defined, the value is null
type
enumeration
Type of step: The type of step depends on the guide type. For Walkthroughs: Action or Decision. For Media: Video, PDF, or Link. For Tooltips: Tooltip steps.
network_applications
Table of defined network applications.
category
enumeration
Category: The category of the network application: Collaboration, Connectivity, and Standard. Requirements: Define the network-application category from the application configurations. Details: Connectivity applications (for example, VPN, ZTNA, and XDR) are highlighted in the device view to correlate their activity with any employee connectivity issues. Collaboration applications (for example, Teams or Zoom) are displayed in the device view timeline under the Collaboration section. Any other application falls under the Standard category. Applications are assigned the Standard category by default; select the Connectivity or Collaboration category when applicable. Refer to the Configuring applications documentation
name
string
Name: The name of the network application. Requirements: Define the network-application name from the application configurations. Details: Refer to the Configuring applications documentation
pages
Table of defined key pages.
name
string
Name: The name of the key page defined for a web application. Key pages divide a web application into functionally relevant parts based on URL patterns. Requirements: Define the key pages from the application configurations, under the Key pages tab. Details: Refer to the Configuring key pages documentation
transactions
Table of defined transactions.
name
string
Name: The name of the transaction defined for a web application. A transaction is an employee action or event in a web application that creates business value for the company. Requirements: Define the transactions from the application configurations, under the Transactions tab. Details: Refer to the Configuring transactions documentation
Namespace campaign
The campaign namespace consists of two tables. The campaign table stores information about campaigns configured by Nexthink users (such as campaign id, name, trigger method, etc.). The responses table collects all responses to campaigns. It indicates whether the employee declined or postponed the campaign or how many questions they answered.
campaigns
The table collecting all active and retired campaigns.
name
string
Name: The name of the campaign. Details: User defined through the Campaigns user interface or Finder For Infinity campaigns, only configured campaigns in the state published and retired are available in the data model. The name of the campaign can be changed after its creation and should not be considered as a unique identifier.
nql_id
string
NQL ID: The unique identifier of the campaign. Details: The NQL ID cannot be changed after its initial creation.
priority
enumeration
Priority: The configured priority of the campaign. Details: The campaign priority influences which employee protection rules are applied: urgent campaign bypass the do-not-disturb rules unlike normal campaigns. Possible values:
urgent
normal
status
enumeration
Status: The current status of the campaign. Details: Possible values:
draft - a campaign in creation that has not been finalized
published - an active campaign that can currently collect responses from employees
retired - a campaign that was active but has now been retire and cannot collect new responses
Only published campaign can be triggered, and only published and retired campaigns can have responses. Refer to the campaign.responses table for details.
trigger_method
enumeration
Trigger: The possible methods of triggering the campaign. Details: Possible values:
manual - triggered from an investigation's results for one or more employees
investigation (Classic campaigns only) - triggered automatically based on an investigation that is evaluated regularly
schedule - triggered only once based on an investigation evaluated at the time the campaign is published
schedule_again_after - triggered automatically based on an investigation that is evaluated regularly
remediation - triggered within a remote action script
api - triggered via a call to the Campaign API
workflow - triggered from a Nexthink Workflow
Campaigns with trigger type remediation do not have their responses available.
responses
The table collecting responses (expected or given) of a campaign by an employee.
responses are punctual events.
responses are associated to user, device, campaign
analysis_data
string
Analysis data: The answers classification by topic and sentiment analysis. Details: The analysis is structured as a JSON object that includes the free-text comment analysis.
analysis_timestamp
datetime
Analysis data: The date and time when the analysis data was generated. Details: Show the time when the analysis data was generated.
answers
string
Answers: The campaign answers (details and values) given by the employee. Details: The answers are structured as a JSON object that includes, for each answered question: Inspecting answers of a given campaign is best performed using the dynamic data model: for each campaign, you can use fields of campaign.nql_id.responses.answers.nql_id to inspect the answer type, the answer labels and the free-text comment.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
displayed_language
enumeration
Displayed language: The language in which the content of a multilingual campaign was shown to the employee. Details: Applicable only to multilingual campaigns. Possible values:
not_applicable, for campaigns without multiple languages activated or not answered yet
language name (english, french, etc.), once the campaign has been answered
expiry_date
datetime
Expiry Date: The expiry date and time of an employee campaign request.
first_displayed
datetime
First displayed time [Local]: The date and time when the employee saw the campaign for the first time, adjusted to your local time.
first_planned
datetime
First planned time [Local]: The date and time when the campaign is first set to the planned state, adjusted to your local time.
first_targeted
datetime
First targeted time [Local]: The date and time when the campaign is first set to the targeted state, adjusted to your local time.
historical_state
jsonArrayString
Historical states: The historical state updates for an employee campaign response. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.
historical_state_details
jsonArrayString
Historical state details: The historical state details updates for an employee campaign response, as a chronologically sorted array. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.
historical_time
jsonArrayString
Historical times: The historical update times for an employee campaign response, as a chronologically sorted array. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.
number_of_answered_questions
integer
Number of answered questions: The number of questions answered by the employee.
parameters
string
Parameters: The value of all campaign parameters as defined when triggering this campaign response.
request_id
string
Request ID: The unique identifier generated at the time the user was targeted for this campaign. Details: The request ID is the unique identifier for a campaign response. The same user may have different requests with different request ID if the user was targeted several times for the same campaign. When triggering an API campaign, the request ID is returned in the API response and can be stored for later inspection of the campaign answers.
state
enumeration
State: The current state of the campaign response by a user (expected or actual). Details: Possible values:
planned - the campaign sent to a user who was online and pending display
targeted - the campaign pending answer, refer to state details for more information
answered - the campaign partially or fully answered by the user
declined - the campaign declined by the user
canceled - the response not expected anymore, refer to state details for more information
retired - the campaign retired without responses
unknown_state - the response state not reported by Nexthink
For more information, refer to response state documentation
state_details
enumeration
State Details: Indicates additional details about the current state of the campaign response by a user (expected or actual). Details: The state_details value depends on the state value Nexthink registers for a particular response. For state targeted, possible state details are:
notified - the user saw the campaign popup
opened - the user saw the first question fully
offline - the user was offline when the campaign was triggered
delayed - the campaign was delayed due to user protection (classic)
postponed - the user clicked on 'remind me later' For state answered, possible state details are:
partially - the user answered only some of the required questions
fully - the user answered all required questions For state canceled, possible state details are:
user_not_found - the campaign sent to a deleted user
expired - the response not received before its expiration time
already_pending - another response for the same user expected For states planned, declined, retired and unkown_state, the state detail is:
not_applicable - no additional details
For more information, refer to response state documentation
time
datetime
Time [Local]: The date and time when the response was last updated, adjusted to your local time.
trigger_method
enumeration
Trigger method: The trigger method that was used to target the user for the campaign. Details: Possible values:
manual
schedule
api
Namespace collaboration
The collaboration namespace consists of only one table: sessions, which refers to all meetings performed with collaboration tools such as Teams and Zoom. It stores detailed information about each meeting, including its duration, connection type, equipment used, audio and video quality, among other details. This data is used to monitor critical collaboration applications, for example, using dashboards with call quality overview.
sessions
Table collecting meetings performed with collaboration tools such as Teams or Zoom.
sessions are punctual events.
sessions are associated to user, device
application.type
enumeration
Application type: The type of the application used for a given call. The possible values are:
Teams
Zoom
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
application.version
version
Application version: The version of the application used during the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
audio.inbound_jitter
duration
Audio inbound jitter: Indicates the average change in delay between successive inbound audio packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. When it is higher than 30ms, the related session is considered as having a poor audio quality.
audio.inbound_latency
duration
Audio inbound latency: Indicates the time an inbound audio packet takes to reach a participant's device. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. It's only available for Zoom sessions. When it is higher than 500ms, the related Zoom session is considered as having a poor audio quality.
audio.inbound_packet_loss
float
Audio inbound packet loss: Indicates the ratio of inbound audio packets that never reach their destination compared to the total of audio packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. When it is higher than 10%, the related session is considered as having a poor audio quality.
audio.inbound_rocs
float
Audio inbound ROCS: Indicates the ratio comparing the number of audio frames generated by packet loss healing mechanisms to the total number of audio frames. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Teams sessions. When it is higher than 0.07, the related Teams session is considered as having a poor audio quality.
audio.inbound_rtt
duration
Audio inbound RTT: Indicates the time an audio packet takes to reach a participant's device and the response to reach its origin. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Teams sessions. When it is higher than 500ms, the related Teams session is considered as having a poor audio quality.
audio.outbound_jitter
duration
Audio outbound jitter: Indicates the average change in delay between successive outbound audio packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is higher than 30ms, the related session is considered as having a poor audio quality.
audio.outbound_latency
duration
Audio outbound latency: Indicates the time an outbound audio packet takes to reach its destination from a participant’s device. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Zoom sessions. When it is higher than 500ms, the related Zoom session is considered as having a poor audio quality.
audio.outbound_packet_loss
float
Audio outbound packet loss: Indicates the ratio of outbound audio packets that never reach their destination compared to the total number of outbound audio packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is higher than 10%, the related session is considered as having a poor audio quality.
audio.outbound_rocs
float
Audio outbound ROCS: Indicates the average ratio comparing the number of outbound audio frames with concealed samples generated by packet loss healing mechanisms to the total number of audio frames. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Teams sessions. When it is higher than 0.07, the related Teams session is considered as having a poor audio quality.
audio.outbound_rtt
duration
Audio outbound RTT: Indicates the time an outbound audio packet takes to reach its destination from a participant's device and for the response to come back. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Teams sessions. When it is higher than 500ms, the related Teams session is considered as having a poor audio quality.
audio.quality
enumeration
Audio call quality: Provides an assessment of the audio call quality. Possible values are:
Good
Poor
Unknown
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: When the audio quality is poor, end-users might experience some distorted, breaking up or robotic sound. Assessment of the quality is based on multiple metrics, like jitter, packet loss... See more details on the related documentation.
call.end_time
datetime
Call end time: The timestamp indicating when the last user left the call. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
call.id
string
Call ID: The unique identifier (UID) for the call record.
call.quality
enumeration
Call quality: Indicates the overall call quality computed as a combination of the following metrics:
Audio quality
Video quality
Screen share quality (Teams only)
Failed to connect to the call (Teams only) Possible values
Poor: If any of the metric is poor.
Good: If more than two metrics is good.
Unknown: If majority of the metrics is unknown.
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
call.start_time
datetime
Call start time: The timestamp indicating when the first user joined the call.
call.type
enumeration
Call type: Indicates if the call type was a group call or a peer-to-peer call. This value is available only for Microsoft teams calls. Possible values are:
Group call
Peer-to-peer
Unknown
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: Group call indicates that the call was either scheduled or a call that involves more than two participants. Peer-to-peer indicates it was a direct call between two participants.
connection_type
enumeration
Connection type: The internet connection type for a participant in a given call. Possible values are:
Ethernet
WiFi
cellular
PPP
tunnel
point_to_point
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Session duration: Time between the start time and end time of the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
end_time
datetime
Session end time: Time when the user left the call. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
has_screen_share
bool
Has screen share: Indicates if screen sharing was used during the call. Requirements: This requires
The Collaboration Experience license..
Configured inbound connectors.
macOS requires Jamf as an identity provider..
See more details in the related documentation.
has_video
bool
Session contains video: Indicates if video was used during the call. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
id
string
Session ID: Unique identifier of the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: Peer-to-peer calls typically only have one session, whereas group calls typically have at least one session per participant.
participant_device.camera
string
Camera: The camera used during the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
participant_device.camera_driver
string
Camera driver: Indicates the name and version of the camera driver detected during the session. This information is available only for Teams calls on Windows devices. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
See more details in the related documentation.
participant_device.mac_address
string
MAC address: The MAC address of the participants' devices used during the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
participant_device.microphone
string
Microphone: The microphone used during the session. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
participant_device.microphone_driver
string
Microphone driver: Indicates the name and version of the audio driver detected during the session. This information is available only for Teams calls on Windows devices. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
See more details in the related documentation.
participant_device.speaker
string
Speaker: The speaker used during the session. Requirements: This requires
The Collaboration Experience license..
Configured inbound connectors.
macOS requires Jamf as an identity provider..
See more details in the related documentation.
participant_device.speaker_driver
string
Speaker driver: Indicates the name and version of the audio driver detected during the session. This information is available only for Teams calls on Windows devices. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
See more details in the related documentation.
participant_device.type
enumeration
Device type: Indicates the device type of the participants used during the session. Possible values are:
Windows
macOS
iOS
Android
web
IP_phone
room_system
Surface_Hub
HoloLens
PSTN
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
participant_device.vendor_wifi_driver
string
WiFi vendor driver: Indicates the name of the WiFi driver detected during the session. This information is available only for Teams calls on Windows devices. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
See more details in the related documentation.
participant_device.vendor_wifi_driver_version
string
WiFi vendor driver version: Indicates the version of the WiFi driver detected during the session. This information is available only for Teams calls on Windows devices. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
See more details in the related documentation.
participant_failed_to_connect
string
Participant failed to connect: Indicates whether the participant failed to connect to the call. This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
participant_got_disconnected
string
Participant got disconnected: Indicates if participant got disconnected during the call. This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
screen_share.inbound_frame_loss_percentage
percentage
Screen share inbound frames loss percentage: Displays a percentage of inbound frames loss. This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: Inbound frame loss percentage refers to the proportion of lost frames during screen sharing. When someone shares their screen, frames (individual images) are transmitted over the network. If any frames are lost or delayed, it affects the viewing experience. The issue may be related to network problems, and troubleshooting involves analysing the network path and seeking community insights. If inbound frame loss percentage > 50%, you will see an issue in screen sharing quality.
screen_share.inbound_frame_rate
integer
Screen share inbound frame rate: Indicates the frames per second received by viewers during screen sharing. This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: Inbound frame rate refers to the frames per second (fps) received by viewers during screen sharing. If inbound frame rate as well as outbound frame rate is less than 1 FPS, the screen sharing quality is marked as poor.
screen_share.outbound_frame_rate
integer
Screen share outbound frame rate: Displays the frames per second transmitted by the person's device who is sharing screen. This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: Outbound frame rate pertains to the fps at which shared content is transmitted from a person's device who is sharing screen. If inbound frame rate as well as outbound frame rate is less than 1 FPS, the screen sharing quality is marked as poor.
screen_share.quality
enumeration
Screen share quality: Provides an assessment of the screen share quality. The assessment is based on inbound frame loss percentage, inbound and outbound frame rate metrics. Possible values are:
Good
Poor
Unknown
This information is available only for Teams calls. Requirements: This requires
The Collaboration Experience license.
Inbound connectors for Microsoft Teams configured.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: When the screen share quality is poor, end-users might experience lags in the screen share display. The screen share quality is considered:
Good when inbound frame loss percentage <= 50% OR (inbound frame loss percentage is null AND inbound frame rate >= 1 AND outbound frame rate >= 1).
Poor when inbound frame loss percentage > 50% OR (inbound frame loss percentage is null AND inbound frame rate < 1 AND outbound frame rate < 1).
Unknown when inbound frame loss percentage is null AND inbound frame rate is null AND outbound frame rate is null.
See more details on the related documentation.
start_time
datetime
Session start time: Time when the user joined the call. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation.
video.inbound_frame_rate
integer
Video inbound frame rate: Indicates the frequency at which inbound frames appear on a display. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is lower than 7 FPS, the related session is considered as having a poor video quality.
video.inbound_jitter
duration
Video inbound jitter: Indicates the average change in delay between successive inbound video packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is higher than 30ms, the related session is considered as having a poor video quality.
video.inbound_latency
duration
Video inbound latency: Indicates the time it takes an inbound video packet to reach a participant's device. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Zoom sessions. When it is higher than 500ms, the related Zoom session is considered as having a poor video quality.
video.inbound_packet_loss
float
Video inbound packet loss: Indicates the ratio of inbound video packets that never reach their destination compared to the total number of inbound video packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is higher than 10%, the related session is considered as having a poor video quality.
video.inbound_rtt
duration
Video inbound RTT: Indicates the time an inbound video packet takes to reach a participant's device and for the response to reach its origin. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. It's only available for Teams sessions. When it is higher than 500ms, the related Teams session is considered as having a poor video quality.
video.outbound_frame_rate
integer
Video outbound frame rate: Indicates the frequency at which outbound frames appear on a display. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. When it is lower than 7 FPS, the related session is considered as having a poor video quality.
video.outbound_jitter
duration
Video outbound jitter: Indicates the average change in delay between successive outbound video packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged throughout the whole session. When it is higher than 30ms, the related session is considered as having a poor video quality.
video.outbound_latency
duration
Video outbound latency: Indicates the time it takes an outbound video packet to reach its destination from a participant’s device. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. It's only available for Zoom sessions. When it is higher than 500ms, the related Zoom session is considered as having a poor video quality.
video.outbound_packet_loss
float
Video outbound packet loss: Indicates the ratio of outbound video packets that never reach their destination compared to the total number of outbound video packets. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. When it is higher than 10%, the related session is considered as having a poor video quality.
video.outbound_rtt
duration
Video outbound RTT: Indicates the time an outbound video packet takes to reach its destination from a participant’s device and for the response to come back. Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: The metric is aggregated and averaged on the whole session. It's only available for Teams sessions. When it is higher than 500ms, the related Teams session is considered as having a poor video quality.
video.quality
enumeration
Video call quality: Provides an assessment of the video call quality. Possible values are:
Good
Poor
Unknown
Requirements: This requires
The Collaboration Experience license.
Configured inbound connectors.
macOS requires Jamf as an identity provider.
See more details in the related documentation. Details: When the video quality is poor, end-users might experience video display delays. Assessment of the video quality is based on multiple metrics, like jitter, frame rate... See more details on the related documentation.
Namespace connection
The connections namespace contains a set of tables which allow troubleshooting connections-related issues along three dimensions: binary/ application, device (incl. location), and destination (incl. location). The tables contain sampled events with data and metrics about network connections initiated by an application on the device of the user. Please note: Connections events are only available for devices with Collectors that report "Infinity only".
events
The connections.events table contains events for outgoing TCP connections and UDP packages. Some metrics are only available for TCP connections. These metrics are 'NULL' for UDP events. Connection events are associated to binaries, users, devices, and applications (optional).
events are sampled events.
events are associated to binary, device, user, application, network_application
bucket_duration
duration
Bucket duration: The duration of the time bucket. Requirements: Exclusive to Nexthink Infinity
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
destination.country
string
Country: Country of the destination based on GeoIP information. Requirements: Exclusive to Nexthink Infinity Details: The country is NULL if the destination.type equals 'intranet' or the destination type is NULL.
destination.datacenter_region
string
Data center region: Region of the data center as provided by the data center owner Requirements: Exclusive to Nexthink Infinity Details: Nexthink assigns the following regions:
the regions as provided by the data center owner, if destination.type equals 'datacenter'
NULL, if the destination.type equals 'intranet' or 'internet' or the destination type is NULL.
destination.domain
string
Domain name: The DNS domain name of the destination as reported by Collector. Requirements: Exclusive to Nexthink Infinity. Domain name reporting is optional and must be activated for the Collectors, see Configuring Collector level anonymization . Details: The destination domain name is 'multiple domain names', if a binary establishes multiple connections to the same destination with different domain names. The destination domain name is NULL, if the Collector did not report a domain name or if a binary establishes 512 or more connections within one time bucket.
destination.ip_address
ipAddress
IP address: IPv4 or IPv6 IP address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The IP address is only available for buckets of 15 minutes duration. The system sets the IP address to NULL, when aggregating the data into buckets of one day duration. The destination IP address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.ip_subnet
ipAddress
Subnet address: Network address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The system sets the last 8 bit of the IP address to zero. You can query the subnet IP address with the CIDR (Classless Inter-Domain Routing) subnet notation, for example '198.51.100.0/24' for IPv4 or ' 2600:1401:4000::1724:2625/120' for IPv6. The destination subnet address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.owner
string
Owner: Owner of the destination Requirements: Exclusive to Nexthink Infinity Details:
Owner of the autonomous system for destinations of type 'internet'
Operator of the data center for destinations of type 'datacenter'
'Intranet' for destinations of type 'intranet'
The destination owner is NULL, if the destination type is NULL.
destination.port
numeric
Port: The network port number of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The destination port is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.type
enumeration
Type: Classifies the destination and allows to group destinations. Requirements: Exclusive to Nexthink Infinity Details: Nexthink determines the destination type based on the IP address. There are three supported destination types: datacenter, internet, and intranet. The destination type is NULL, if a binary establishes 512 or more connections within one time bucket.
end_time
datetime
Bucket end: Time bucket's end time and date. Requirements: Exclusive to Nexthink Infinity
establishment_time
duration
Connection RTT: Average round trip time of the TCP connection establishment. Requirements: Exclusive to Nexthink Infinity Details: Average round trip time for all established connections. The round trip time is measured between sending the SYN (synchronize) message and receiving the SYN-ACK (synchronize-acknowledge) message from the remote party during the TCP connection establishment, a 3-way handshake.
failed_connection_ratio
float
Failed connection ratio: The ratio of all failed TCP connections over all attempted TCP connections i.e., all established and failed TCP connections. Requirements: Exclusive to Nexthink Infinity Details: When aggregating the data, the average is weighted with number of attempted connections i.e., the sum of failed and established TCP connections.
incoming_traffic
bytes
Incoming traffic: Bytes received by the application. Requirements: Exclusive to Nexthink Infinity Details: Bytes received by the application include the traffic from all TCP connections.
ip_version
enumeration
IP version: The Internet Protocol (IP) version used for this connection: IPv4 or IPv6. Requirements: Exclusive to Nexthink Infinity Details: The IP version is NULL, if a binary establishes 512 or more connections within one time bucket.
number_of_alive_connections
long
Alive connections: The number of connections that were established in a previous time bucket and continue into the current time bucket. Requirements: Exclusive to Nexthink Infinity Details: Alive connections may end in the current time bucket or continue into the next time bucket.
The system counts alive connections as successful.
number_of_attempted_connections
long
Attempted connections: The number of TCP connections a process tried to establish in a bucket. Requirements: Exclusive to Nexthink Infinity Details: Attempted connections are the sum of established and failed TCP connections in a bucket.
number_of_connections
long
Total number of connections: The total number of failed and successful connections. Requirements: Exclusive to Nexthink Infinity
number_of_established_connections
long
Established connections: The number of connections that have been established in the current time bucket. Requirements: Exclusive to Nexthink Infinity Details: Established connections may continue into the next time bucket or they might end in the bucket they were established in.
The system counts established connections as successful.
number_of_failed_connections
long
Failed connections: The total number of failed connections. Requirements: Exclusive to Nexthink Infinity Details: Failed connections are calculated as the sum of rejected, no host, and no service connections.
number_of_no_host_connections
long
Failed connections - no host: The number of connections that failed due to the device not reaching the destination host. Requirements: Exclusive to Nexthink Infinity Details: A connection fails to reach the destination host when the destination host does not acknowledge the TCP SYN message, for example, the remote party does not exist or a firewall blocks the connection request.
The system counts 'no host' connections as failed connections.
number_of_no_service_connections
long
Failed connections - no service: The number of connections that failed due to the device not reaching the service on the destination host. Requirements: Exclusive to Nexthink Infinity Details: A connection fails to reach the service on the destination host when the destination host acknowledges the initial TCP SYN message by an RST message but no service is bound to the requested port. Note that a firewall protects most personal computers and discards RST messages to prevent port scanning.
The system counts 'no service' connections as failed connections.
number_of_rejected_connections
long
Failed connections - rejected: The number of outgoing connections that have been rejected on the device of the user. Requirements: Exclusive to Nexthink Infinity Details: The operating system of the device or a local firewall rejects an outgoing connection.
The system counts rejected connections as failed connections.
number_of_successful_connections
long
Successful connections: The total number of successful connections. Requirements: Exclusive to Nexthink Infinity Details: The system calculates successful connections as the sum of established and alive connections.
outgoing_traffic
bytes
Outgoing traffic: Bytes sent by the application. Requirements: Exclusive to Nexthink Infinity Details: Bytes sent by the application include the traffic from all TCP and UDP connections.
start_time
datetime
Bucket start: Time bucket's start time and date. Requirements: Exclusive to Nexthink Infinity
transport_protocol
enumeration
Transport protocol: The transport protocol of this connection: TCP or UDP. Requirements: Exclusive to Nexthink Infinity
tcp_events
The connections.tcp_events table has been deprecated. Please use 'connection.events' table instead.
tcp_events are sampled events.
tcp_events are associated to binary, device, user, application, network_application
bucket_duration
duration
Bucket duration (deprecated): This field has been deprecated. Please use 'connection.event.bucket_duration' instead. Requirements: Exclusive to Nexthink Infinity
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
destination.country
string
Country: Country of the destination based on GeoIP information. Requirements: Exclusive to Nexthink Infinity Details: The country is NULL if the destination.type equals 'intranet' or the destination type is NULL.
destination.datacenter_region
string
Data center region: Region of the data center as provided by the data center owner Requirements: Exclusive to Nexthink Infinity Details: Nexthink assigns the following regions:
the regions as provided by the data center owner, if destination.type equals 'datacenter'
NULL, if the destination.type equals 'intranet' or 'internet' or the destination type is NULL.
destination.domain
string
Domain name: The DNS domain name of the destination as reported by Collector. Requirements: Exclusive to Nexthink Infinity. Domain name reporting is optional and must be activated for the Collectors, see Configuring Collector level anonymization . Details: The destination domain name is 'multiple domain names', if a binary establishes multiple connections to the same destination with different domain names. The destination domain name is NULL, if the Collector did not report a domain name or if a binary establishes 512 or more connections within one time bucket.
destination.ip_address
ipAddress
IP address: IPv4 or IPv6 IP address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The IP address is only available for buckets of 15 minutes duration. The system sets the IP address to NULL, when aggregating the data into buckets of one day duration. The destination IP address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.ip_subnet
ipAddress
Subnet address: Network address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The system sets the last 8 bit of the IP address to zero. You can query the subnet IP address with the CIDR (Classless Inter-Domain Routing) subnet notation, for example '198.51.100.0/24' for IPv4 or ' 2600:1401:4000::1724:2625/120' for IPv6. The destination subnet address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.owner
string
Owner: Owner of the destination Requirements: Exclusive to Nexthink Infinity Details:
Owner of the autonomous system for destinations of type 'internet'
Operator of the data center for destinations of type 'datacenter'
'Intranet' for destinations of type 'intranet'
The destination owner is NULL, if the destination type is NULL.
destination.port
numeric
Port: The network port number of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The destination port is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.type
enumeration
Type: Classifies the destination and allows to group destinations. Requirements: Exclusive to Nexthink Infinity Details: Nexthink determines the destination type based on the IP address. There are three supported destination types: datacenter, internet, and intranet. The destination type is NULL, if a binary establishes 512 or more connections within one time bucket.
end_time
datetime
Bucket end (deprecated): This field has been deprecated. Please use 'connection.event.end_time' instead. Requirements: Exclusive to Nexthink Infinity
establishment_time
duration
Connection RTT (deprecated): This field has been deprecated. Please use 'connection.event.establishment_time' instead. Requirements: Exclusive to Nexthink Infinity
incoming_traffic
bytes
Incoming traffic (deprecated): This field has been deprecated. Please use 'connection.event.incoming_traffic' instead. Requirements: Exclusive to Nexthink Infinity
ip_version
enumeration
IP version (deprecated): This field has been deprecated. Please use 'connection.event.ip_version' instead. Requirements: Exclusive to Nexthink Infinity Details: The IP version is NULL, if a binary establishes 512 or more connections within one time bucket.
number_of_alive_connections
long
Alive connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_alive_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_connections
long
Total number of connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_established_connections
long
Established connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_established_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_failed_connections
long
Failed connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_failed_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_no_host_connections
long
Failed connections - no host (deprecated): This field has been deprecated. Please use 'connection.event.number_of_no_host_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_no_service_connections
long
Failed connections - no service (deprecated): This field has been deprecated. Please use 'connection.event.number_of_no_service_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_rejected_connections
long
Failed connections - rejected (deprecated): This field has been deprecated. Please use 'connection.event.number_of_rejected_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_successful_connections
long
Successful connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_successful_connections' instead. Requirements: Exclusive to Nexthink Infinity
outgoing_traffic
bytes
Outgoing traffic (deprecated): This field has been deprecated. Please use 'connection.event.outgoing_traffic' instead. Requirements: Exclusive to Nexthink Infinity
start_time
datetime
Bucket start (deprecated): This field has been deprecated. Please use 'connection.event.start_time' instead. Requirements: Exclusive to Nexthink Infinity
udp_events
The connections.udp_events table has been deprecated. Please use 'connection.events' table instead.
udp_events are sampled events.
udp_events are associated to binary, binary, device, user, application, network_application
bucket_duration
duration
Bucket duration (deprecated): This field has been deprecated. Please use 'connection.event.bucket_duration' instead. Requirements: Exclusive to Nexthink Infinity
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
destination.country
string
Country: Country of the destination based on GeoIP information. Requirements: Exclusive to Nexthink Infinity Details: The country is NULL if the destination.type equals 'intranet' or the destination type is NULL.
destination.datacenter_region
string
Data center region: Region of the data center as provided by the data center owner Requirements: Exclusive to Nexthink Infinity Details: Nexthink assigns the following regions:
the regions as provided by the data center owner, if destination.type equals 'datacenter'
NULL, if the destination.type equals 'intranet' or 'internet' or the destination type is NULL.
destination.domain
string
Domain name: The DNS domain name of the destination as reported by Collector. Requirements: Exclusive to Nexthink Infinity. Domain name reporting is optional and must be activated for the Collectors, see Configuring Collector level anonymization . Details: The destination domain name is 'multiple domain names', if a binary establishes multiple connections to the same destination with different domain names. The destination domain name is NULL, if the Collector did not report a domain name or if a binary establishes 512 or more connections within one time bucket.
destination.ip_address
ipAddress
IP address: IPv4 or IPv6 IP address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The IP address is only available for buckets of 15 minutes duration. The system sets the IP address to NULL, when aggregating the data into buckets of one day duration. The destination IP address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.ip_subnet
ipAddress
Subnet address: Network address of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The system sets the last 8 bit of the IP address to zero. You can query the subnet IP address with the CIDR (Classless Inter-Domain Routing) subnet notation, for example '198.51.100.0/24' for IPv4 or ' 2600:1401:4000::1724:2625/120' for IPv6. The destination subnet address is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.owner
string
Owner: Owner of the destination Requirements: Exclusive to Nexthink Infinity Details:
Owner of the autonomous system for destinations of type 'internet'
Operator of the data center for destinations of type 'datacenter'
'Intranet' for destinations of type 'intranet'
The destination owner is NULL, if the destination type is NULL.
destination.port
numeric
Port: The network port number of the connection's destination. Requirements: Exclusive to Nexthink Infinity Details: The destination port is NULL, if a binary establishes 512 or more connections within one time bucket.
destination.type
enumeration
Type: Classifies the destination and allows to group destinations. Requirements: Exclusive to Nexthink Infinity Details: Nexthink determines the destination type based on the IP address. There are three supported destination types: datacenter, internet, and intranet. The destination type is NULL, if a binary establishes 512 or more connections within one time bucket.
end_time
datetime
Bucket end (deprecated): This field has been deprecated. Please use 'connection.event.end_time' instead. Requirements: Exclusive to Nexthink Infinity
ip_version
enumeration
IP version (deprecated): This field has been deprecated. Please use 'connection.event.ip_version' instead. Requirements: Exclusive to Nexthink Infinity Details: The IP version is NULL, if a binary establishes 512 or more connections within one time bucket.
number_of_alive_connections
long
Alive connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_alive_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_connections
long
Total number of connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_established_connections
long
Established connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_established_connections' instead. Requirements: Exclusive to Nexthink Infinity
number_of_successful_connections
long
Successful connections (deprecated): This field has been deprecated. Please use 'connection.event.number_of_successful_connections' instead. Requirements: Exclusive to Nexthink Infinity
outgoing_traffic
bytes
Outgoing traffic (deprecated): This field has been deprecated. Please use 'connection.event.outgoing_traffic' instead. Requirements: Exclusive to Nexthink Infinity
start_time
datetime
Bucket start (deprecated): This field has been deprecated. Please use 'connection.event.start_time' instead. Requirements: Exclusive to Nexthink Infinity
Namespace connectivity
Connectivity events offers details about IP networking performance. It can be used to detect and diagnose networking issues such as misconfigurations, poor Wi-Fi signal strength and other issues affecting employees in particular offices or when working from home. Useful trend data can also be obtained using this table.
events
Table collecting performance metrics and attributes specific to a device's connectivity.
events are sampled events.
events are associated to device
bucket_duration
duration
Bucket duration: Duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
end_time
datetime
Bucket end: End time of the bucket.
primary_physical_adapter.dns_ips
ipAddressArray
List of DNS servers: List of DNS server IP addresses set for the primary physical network adapter.
primary_physical_adapter.gateway_ips
ipAddressArray
List of gateways: List of gateway IP addresses set for the primary physical network adapter.
primary_physical_adapter.local_ips
ipAddressArray
List of local IPs: List of local IP addresses set for the primary physical network adapter.
primary_physical_adapter.type
enumeration
Network adapter type: Type of the primary network adapter:
WiFi
Ethernet
Bluetooth
start_time
datetime
Bucket start: Start time of the bucket.
wifi.band
enumeration
WiFi band (preview): The WiFi frequency band used:
wifi_900MHz
wifi_2dot4GHz
wifi_3dot65GHz
wifi_5GHz
Requirements: Requires 'Location services' to be activated since Windows 11 24H2. Details: The WiFi frequency bands:
wifi_900MHz: 900 MHz
wifi_2dot4GHz: 2.4 GHz
wifi_3dot65GHz: 3.65 GHz
wifi_5GHz: 5 GHz
wifi.bssid
string
WiFi BSSID: The physical address of the access point or wireless router used to connect to the WiFi. Requirements: By default, Collector does not report the BSSID. Reporting has to be enabled with the WiFi network Collector configuration parameter. Requires 'Location services' to be activated since Windows 11 24H2.
Windows
wifi.channel_id
integer
WiFi channel ID: The channel ID of the WiFi used. Requirements: Requires 'Location services' to be activated since Windows 11 24H2.
wifi.channel_width
integer
WiFi channel width: Width of the used WiFi channel in MHz.
macOS
wifi.noise_level
signalStrength_Dbm
WiFi noise level: Average WiFi noise level in dBm. Details: The WiFi noise is a negative number. The lower, the better. A noise level below -80 dBm is considered good.
macOS
wifi.p5_signal_strength
signalStrength_Dbm
WiFi p5 signal strength (deprecated): This field is deprecated and should not be used. Requirements: Details: 5th percentile of the RSSI. During the 15minutes period, the rssi was 95% of the time equal or larger than the receive value.
wifi.physical_layer_protocol
enumeration
WiFi physical layer protocol: The WiFi protocol used. Requirements: Requires 'Location services' to be activated since Windows 11 24H2. Details: The possible values based on the IEEE 802.11 protocols:
802_11a
802_11b
802_11g
802_11n
802_11ac
802_11ad
802_11ax
wifi.receive_rate
throughput_Mbps
WiFi receive rate: Receive rate for the WiFi adapter in Mbit/sec. Requirements: Requires 'Location services' to be activated since Windows 11 24H2.
Windows
wifi.signal_strength
signalStrength_Dbm
WiFi signal strength: Average WiFi signal strength in dBm. Requirements: Requires 'Location services' to be activated since Windows 11 24H2. Details: The WiFi signal strength (RSSI) is a negative number. The higher (closer to 0), the better. A signal strength above -60 dBm is considered good.
wifi.ssid
string
WiFi SSID: The WiFi network name (SSID). Requirements: By default, Collector does not report the SSID. Reporting has to be enabled with the WiFi network Collector configuration parameter. Requires 'Location services' to be activated since Windows 11 24H2.
Windows
wifi.transmission_rate
throughput_Mbps
WiFi transmission rate: Transmission rate for the WiFi adapter in Mbit/sec. Requirements: Requires 'Location services' to be activated since Windows 11 24H2. Details: This metric provides the best understanding of the quality of the WiFi connection. Higher values are better.
mobile_events
The table collecting connectivity metrics and attributes specific to a device.
mobile_events are sampled events.
mobile_events are associated to mobile_device
bucket_duration
duration
Bucket duration: The duration of the bucket.
cellular.bytes_received
bytes
Cellular data received: Total amount of data received over the cellular adapter, measured in bytes. Details: This metric shows the total volume of data received via cellular in a given bucket.
cellular.bytes_sent
bytes
Cellular data sent: Total amount of data sent over the cellular adapter, measured in bytes. Details: This metric shows the total volume of data transmitted via cellular in a given bucket.
cellular.network_technology
enumeration
Cellular network technology: Cellular technology used. Details: Represents the underlying technology within a network type. Typical values: GSM, UMTS, LTE, etc.
cellular.network_type
enumeration
Cellular network type: Cellular network type. Details: Represents the cellular Radio Access Technology in use. Typical values: 2G, 3G, 4G, 5G, Unspecified.
cellular.receive_rate
throughput_Mbps
Cellular receive rate: Receive rate for the cellular adapter in Mbit/s.
cellular.signal_strength
signalStrength_Dbm
Cellular signal strength: Average cellular signal strength in dBm. Details: The cellular signal strength (RSSI) is a negative number. The higher (closer to 0), the better. A signal strength above -60 dBm is considered good.
cellular.transmission_rate
throughput_Mbps
Cellular transmission rate: Transmission rate for the cellular adapter in Mbit/s. Details: This metric is a key indicator of the cellular connection quality. Higher values represent better performance.
end_time
datetime
Bucket end: The end time of the bucket.
start_time
datetime
Bucket start: The start time of the bucket.
wifi.bytes_received
bytes
WiFi data received: Total amount of data received over the WiFi adapter, measured in bytes. Details: This metric shows the current volume of data received via WiFi in a given bucket.
wifi.bytes_sent
bytes
WiFi data sent: Total amount of data sent over the WiFi adapter, measured in bytes. Details: This metric shows the cumulative volume of data transmitted via WiFi in a given bucket.
wifi.receive_rate
throughput_Mbps
WiFi receive rate: Receive rate for the WiFi adapter in Mbit/s.
wifi.signal_strength
signalStrength_Dbm
WiFi signal strength: Average WiFi signal strength in dBm. Details: The WiFi signal strength (RSSI) is a negative number. The higher (closer to 0), the better. A signal strength above -60 dBm is considered good.
wifi.transmission_rate
throughput_Mbps
WiFi transmission rate: Transmission rate for the WiFi adapter in Mbit/s. Details: This metric is a key indicator of the WiFi connection quality. Higher values represent better performance.
Namespace custom_trend
custom_trend
Namespace device_performance
The device_performance namespace gathers tables that store information related to boots, crashes, and other device performance indicators. Query these tables to investigate system issues.
boots
The table collecting all exit-from-inactive events of a device.
boots are punctual events.
boots are associated to device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Boot duration: The duration of the boot sequence. Details: For 'sleep_resume' and 'idle_resume' boot duration is NULL, displayed as '-'.
Windows
number_of_boots
integer
Number of boots: The number of device boots.
time
datetime
Time: The date and time of the boot.
type
enumeration
Type: The type of boot or resume event, representing a transition from an inactive (non-operational) to an active (operational) state. Requirements: 'hibernate_resume', 'sleep_resume', and 'idle_resume' require Collector version 25.7 or higher. 'full_boot' is available for Windows and macOS. 'fast_startup', 'hibernate_resume', 'sleep_resume', and 'idle_resume' are available on Windows only. Details: Possible values:
full_boot: Cold boot from a complete shutdown
fast_startup: Resume using Fast Startup. A hybrid shutdown that preserves system state.
hibernate_resume: Resume from hibernation. It restores the system state from disk.
sleep_resume: Resume from traditional sleep. Memory is retained in low-power mode.
idle_resume: Resume from Modern Standby or Low Power Idle. An instant-on wake for supported devices.
events
The table collecting performance metrics and attributes specific to a device.
events are sampled events.
events are associated to device
bucket_duration
duration
Bucket duration: The duration of the bucket.
cached_memory
bytes
Cached memory: The average amount of RAM used for caching, which can be freed up without writing it to the storage first. A higher value indicates that the OS is optimizing access to more content that otherwise would be available from slower storage. Details: Low values, such as below 1GB, may indicate that the system could benefit from additional memory.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
cpu_interrupt_usage
percentage
CPU usage by interrupts: The average percentage of time the processor spends handling hardware interrupts. Interrupts take priority over applications and other tasks. Sustained high values may indicate hardware or driver issues, or contention between applications for shared hardware resources. Details: It is recommended to be below 2%. Values above 5% are considered high and often have a perceivable effect on user experience, such as input lag and degraded responsivity.
Windows
cpu_queue_length
integer
CPU queue length: The average CPU queue length. It indicates the number of threads waiting to get execution time on one of the available logical processors during the observed period of time. Details: Values exceeding twice the number of available logical processors indicate that the workload may benefit from a CPU with a higher core count and stronger multi-threading capabilities.
Windows
cpu_usage
percentage
CPU usage: The average of the total CPU usage of all logical processors for the time period. Maximum value is 100% * number of logical processors available in the system. Details: Suitable for sizing purposes. For example, to see how many vCPUs it would require if a given workload moved to a remote desktop.
disk_queue_length
float
Queue length of the system drive: The average number of storage input and output tasks waiting to be executed on the system drive. Details: A high value indicates slow storage devices and may result in reduced application performance due to waiting for storage access. It is recommended to avoid values above 1.
Windows
disk_read_latency
duration
Read latency of the system drive: The average time the OS and applications wait for read tasks to be queued and executed on the system drive. Details: While latency heavily dependends on the type of used storage device, it is recommended to keep the average disk latency under 5 milliseconds, and below 10 milliseconds during peak periods.
Windows
disk_write_latency
duration
Write latency of the system drive: The average time the OS and applications wait for write tasks to be queued and executed on the system drive. Details: While latency heavily dependends on the type of used storage device, it is recommended to keep the average disk latency under 5 milliseconds, and below 10 milliseconds during peak periods.
Windows
duration_with_high_cpu_interrupt_usage
duration
Duration with high CPU interrupt usage: The duration with high CPU interrupt usage. It is calculated based on the number of samples above the 5% threshold and a 30-second sampling frequency.
Windows
duration_with_high_memory_pressure
duration
Duration with high memory pressure: The cumulative number of seconds a device was in critical (red) memory pressure during the aggregation window. Requirements: Requires Collector version 25.8 or higher
macOS
duration_with_medium_cpu_interrupt_usage
duration
Duration with medium CPU interrupt usage: The duration with medium CPU interrupt usage. It is calculated based on the number of samples above the 2% threshold and a 30-second sampling frequency.
Windows
duration_with_medium_memory_pressure
duration
Duration with medium memory pressure: The cumulative number of seconds a device was in warning (yellow) memory pressure during the aggregation window. Requirements: Requires Collector version 25.8 or higher
macOS
end_time
datetime
Bucket end: The end time of the bucket.
free_memory
bytes
Free memory: The average amount of additional RAM available for applications or the OS. Details: A healthy amount of free memory depends on the workload, such as how bursty its memory demands are, and can vary significantly. Less than 10% of the installed memory is generally considered as a potential bottleneck.
gpu_1_name
string
Name of the first GPU: The full name of the first GPU returned by the OS.
gpu_1_usage
percentage
GPU usage (1st GPU): The average utilization of the integrated GPU (gpu_1) during the selected time period. It Indicates whether applications are using integrated GPU acceleration. Details: Sustained high usage, such as 80-90%, may indicate that the GPU is a bottleneck. The value is NULL if the GPU is virtual (vGPU).
gpu_2_name
string
Name of the second GPU: The full name of the second GPU returned by the OS.
gpu_2_usage
percentage
GPU usage (2nd GPU): The average utilization of the discrete GPU (gpu_2) during the selected time period. It indicates whether applications are using discrete GPU acceleration. Details: Sustained high usage, such as 80-90%, may indicate that the GPU is a bottleneck. The value is NULL if no discrete GPU is present or if the GPU is virtual (vGPU).
installed_memory
bytes
Installed memory: The total size of the RAM that is physically installed in the device. Details: For VMs, this is the amount of memory allocated for the OS. It does not include the memory that is reserved by the hypervisor for memory-mapped I/O and other virtual hardware overhead.
memory_commit_limit
bytes
Commit limit: The maximum amount of virtual memory that can be committed without failure. Requirements: Requires Collector version 25.9 or higher Details: It is defined as the sum of physical RAM and the total size of all page files.
Windows
memory_commited_bytes_in_use
percentage
Committed bytes in use: The total amount of virtual memory currently committed by the system. It shows the combined usage of physical memory (RAM) and the page file. It is displayed in Task Manager → Performance → Memory under the Committed section. Requirements: Requires Collector version 25.9 or higher
Windows
memory_committed_bytes
bytes
Committed bytes: The total amount of virtual memory that has been committed to all processes. This includes physical memory in use and potential page file usage. Requirements: Requires Collector version 25.9 or higher Details: If the system approaches the commit limit, new memory allocations can fail, and applications may crash.
Windows
memory_pressure
percentage
Average memory pressure: The average percent of memory pressure during the bucket. Requirements: Requires Collector version 25.8 or higher Details: Memory Pressure is a system-level indicator that reflects the availability and efficiency of memory resources. It represents the overall impact of memory usage on system performance and responsiveness.
macOS
memory_swap_rate
bytes
Bytes wrote to swap memory per second: The rate at which memory content is written to disk to free up physical memory. Details: Sustained frequent spikes may indicate that memory is a bottleneck for the current workload and can correspond to periods of reduced performance.
memory_swap_size
bytes
Swap memory size: The average size of the swap file that is actively used by the OS. This can impact the amount of available storage for other applications. Details: Sustained high values may result in overall performance degradation. What qualifies as high depends on the workload. Swap space exceeding 5 GB is generally considered excessive. As a best practice, storage capacity should support swap space at least equal to the amount of installed physical memory to handle heavier-than-usual workloads.
non_paged_pool_memory
bytes
Non-paged pool memory: The amount of memory used by the OS kernel and drivers that must remain in memory all the time. Details: A steadily increasing high value may indicate a memory leak at the kernel or driver level.
Windows
non_system_drive_capacity
bytes
Non system drive capacity: The total size of all non-system drives. Details: The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
non_system_drive_free_space
bytes
Non system drive free space: The amount of space available on all non-system drives. Details: It is recommended to leave 10-20% of free storage on spinning disk drives for better performance. For SSDs, maintaining more than 25% free space most of the time helps preserve performance and longevity. The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
non_system_drive_usage
bytes
Non system drive usage: The amount of used space on all non-system drives. Details: The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
normalized_cpu_usage
percentage
Normalized CPU usage: The average CPU usage on a 0-100% scale for the time period. Indicates how much of the time the CPU is busy. Details: Sustained values of 80-90% or higher indicate that the CPU is a bottleneck for the workload. It does not account for clock speed and can report high utilization even when the CPU could theoretically run at higher frequencies but is being thermally throttled.
number_of_logical_processors
integer
Number of logical CPU cores: The number of logical CPUs available for the OS to execute tasks simultaneously. Details: Based on the number of CPUs, their core count, and their multi-threading capability.
paged_pool_memory
bytes
Paged pool memory: The amount of memory used by the OS kernel and drivers that can be written to storage if necessary. Details: A steadily increasing high value may indicate a memory leak at the kernel or driver level.
Windows
read_operations_per_second
integer
Read operations per second: The total number of read operations per second across all available physical storages in the device. Details: It is useful for assessing the intensity of read operations required by the workflow when moving workloads between physical devices or to VMs.
Windows
start_time
datetime
Bucket start: The start time of the bucket.
system_drive_capacity
bytes
System drive capacity: The total capacity of the system drive. Details: The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays the data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
system_drive_free_space
bytes
System drive free space: The free space on the system drive. Details: It is recommended to leave 10-20% of free storage on spinning disk drives for better performance. For SSDs, maintaining more than 25% free space most of the time helps preserve performance and longevity. The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays the data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
system_drive_usage
bytes
System drive usage: The amount of used space on the system drive. Details: The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.
used_memory
bytes
Used memory: The average amount of RAM actively used by the applications and the OS. Details: When the OS needs to free up memory, for example to prioritize other applications or bring them to the foreground, it writes memory contents to the disk.
write_operations_per_second
integer
Write operations per second: The total number of write operation per second across all available physical storages on the device. Details: It is useful for assessing the intensity of write operations required by the workflow when moving workloads between physical devices, or to VMs.
Windows
hard_resets
The table contains hard resets, when a device reboots without first completing the shutdown procedure. For example, when a device unresponsive and must be powered off manually, or during unexpexted power loss.
hard_resets are punctual events.
hard_resets are associated to device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_hard_resets
integer
Number of hard resets: The number of hard resets.
time
datetime
Time: The date and time of the crash.
mobile_events
The table collecting performance metrics and attributes specific to a mobile device.
mobile_events are sampled events.
mobile_events are associated to mobile_device
battery.charge_cycle
numeric
Battery charge cycle: The highest number of charge cycles recorded for the current device battery.
battery.charge_rate
percentage
Battery charge rate: The average level of charge gained by a device battery in a time bucket, expressed as a percentage. Details: The average battery percentage gained during the selected time bucket.
battery.charge_type
enumeration
Battery charge type: The device charging method, such as USB or AC power.
battery.current_health
enumeration
Battery health: The current health state of the battery reported by the operating system in a time bucket.
battery.discharge_rate
percentage
Battery discharge rate: The average level of charge lost by a device battery in a time bucket, expressed as a percentage. Details: The average battery percentage lost during the selected time bucket.
battery.last_state
enumeration
Battery charge state: It indicates whether the battery was charging or not during the last recorded period.
battery.level
percentage
Battery level: The minimum charge level of a device in a time bucket, expressed as a percentage.
battery.temperature
float
Temperature: The maximum recorded battery temperature during the selected time period, expressed in Celsius (°C).
battery.voltage
float
Voltage: The average battery voltage in a time bucket, expressed in volts (V). Details: The average recorded battery voltage during the selected time period.
bucket_duration
duration
Bucket duration: The duration of the bucket.
end_time
datetime
Bucket end: The end time of the bucket.
memory.free
bytes
Free memory: The average amount of RAM available for applications or the OS. Details: A healthy amount of free memory depends on the workload, such as how bursty its memory demands are, and can vary significantly. Less than 10% of the installed memory is generally considered as a potential bottleneck.
memory.used
bytes
Used memory: The average amount of RAM actively used by the applications and the OS. Details: When the OS needs to free up memory, for example to prioritize other applications or bring them to the foreground, it writes memory contents to the disk.
start_time
datetime
Bucket start: The start time of the bucket.
storage.free
bytes
Free storage: The amount of free space on the main disk of the device. Details: It is recommended to leave 10-20% of free storage on spinning disk drives for better performance. The metric is displayed in binary units, for example, 1024 MB corresponds to 1 GB.
storage.used
bytes
Used storage: The amount of used space on the mobile device. Details: The metric is displayed in binary units. For example, 1024 MB corresponds to 1 GB.
suspends
The table collecting all transition-to-inactive events of a device.
suspends are punctual events.
suspends are associated to device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_suspends
integer
Number of suspends: The number of transitions the device went into a non-active state.
time
datetime
Time: The date and time the device entered a non-active state.
Windows
type
enumeration
Type: The type of the suspend event, representing a transition from an active (operational) to an inactive (non-operational) state. Requirements: Requires Collector version 25.8 or higher Details: Possible values are:
shut_down: Complete shutdown initiated by the user or system.
hybrid_shut_down: Hybrid shutdown that preserves system state.
hibernate: Hibernate state.
sleep: Traditional sleep state.
idle: Modern Standby or S0 Low Power Idle on supported devices.
Windows
system_crashes
The table collecting the system crashes of the devices.
system_crashes are punctual events.
system_crashes are associated to device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
error_code
long
Error code: The error code for system crashes.
Windows
error_code_hexadecimal
string
Error code in hexadecimal: The hexadecimal error code for system crashes.
Windows
label
string
Label: The error label for system crashes.
Windows
number_of_system_crashes
integer
Number of system crashes: The number of system crashes.
time
datetime
Time: The date and time of the system crash.
Namespace dex
The dex namespace holds a set of the DEX score tables that give an overview of digital employee experience for all employees or a specific subset of employees. For example, you can query DEX scores for specific locations, devices with a specific operating system, and other parameters.
application_scores
application_score
application_scores are punctual events.
application_scores are associated to device, user, application
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
node.score_impact
float
Score impact: The estimated drop in technology score for this node within the application impact structure. Use it with the field application_score.node.type to specify which node impact score you are targeting.
node.type
enumeration
Node type: The node type within the application score structure. Use it with the field application_score.node.value to specify which node you are targeting for the score computation. Details: Possible values:
Page_loads: Returns the page load score of an application,
Transactions: Returns the transaction score of an application,
Web_reliability: Returns the web reliability score of an application,
Crashes: Returns the crash score of an application,
Freezes: Returns the freeze score of an application,
Application: Returns the score of an application.
Refer to the DEX score documentation for more information.
node.value
float
Node score: The score of a node within the application score structure. Use it with the field application_score.node.type to specify which node score you are targeting. Details: It is computed based on the metric corresponding to the application_score.node.type specified in the query:
Page_loads: Based on the average value of the load time (for example, field perceived_duration divided by field perceived_count )
Transactions: Based on the average value of the field transaction.duration
Web_reliability: Based on the sum of web errors (field number_of_errors )
Crashes: Based on the sum of execution crashes (field number_of_crashes )
Freezes: Based on the sum of execution freezes (field number_of_freezes )
Application: Based on all the above metrics. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
score_computation_approximation
enumeration
Score computation approximation: Indicates whether a device or context approximation affected the score computation. Possible values:
unknown
none
multi_device
multi_context
When the device or context changes, this field indicates that the score cannot be associated beyond the user to device and context levels. Details: Approximations can occur, for example, when a user uses multiple devices simultaneously or when device context changes within an hour, such as location changes. See the Computation of the DEX score documentation for more information.
time
datetime
Time: Time when the DEX application score event occurred.
scores
A table of the DEX score.
scores are punctual events.
scores are associated to device, user
applications.score_impact
float
Applications score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
applications.value
float
Applications score: The Applications score is based on hard metrics around applications' performance and reliability. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.score_impact
float
Collaboration score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.teams_audio_quality_score_impact
float
Teams (collaboration) - audio quality score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.teams_audio_quality_value
float
Teams (collaboration) - audio quality score: The Teams audio quality score is based on the number of calls with poor audio quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Teams audio quality score based on the count of virtual meeting events with poor audio quality. For example, the field audio.quality is equal to POOR. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.teams_score_impact
float
Teams (collaboration) score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.teams_value
float
Teams (collaboration) score: The Teams score is based on hard metrics around the video and audio quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.teams_video_quality_score_impact
float
Teams (collaboration) - video quality score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.teams_video_quality_value
float
Teams (collaboration) - video quality score: The Teams video quality score is based on the number of calls with poor video quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Teams video quality score based on the count of virtual meeting events with poor video quality. For example, the field video.quality is equal to POOR. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.value
float
Collaboration score: The Collaboration score is based on hard metrics around collaboration applications, such as Zoom or Teams. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.zoom_audio_quality_score_impact
float
Zoom (collaboration) - audio quality score impact: The Zoom audio quality score is based on the number of calls with poor audio quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Zoom audio quality score based on the count of virtual meeting events with poor audio quality. For example, field audio.quality is equal to POOR. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.zoom_audio_quality_value
float
Zoom (collaboration) - audio quality score: The Zoom audio quality score is based on the number of calls with poor audio quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Zoom audio quality score based on the count of virtual meeting events with poor audio quality. For example, field audio.quality is equal to POOR. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.zoom_score_impact
float
Zoom (collaboration) score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.zoom_value
float
Zoom (collaboration) score: The Zoom score is based on hard metrics around video and audio quality. The score represents the level of digital experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
collaboration.zoom_video_quality_score_impact
float
Zoom (collaboration) - video quality score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
collaboration.zoom_video_quality_value
float
Zoom (collaboration) - video quality score: The Zoom video quality score is based on the number of calls with poor video quality. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Zoom video quality score based on the count of virtual meeting events with poor video quality. For example, field video.quality is equal to POOR. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
endpoint.CPU_interrupt_usage_score_impact
float
CPU interrupt usage score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.CPU_interrupt_usage_value
float
CPU interrupt usage score: The CPU interrupt usage score is based on the amount of CPU interrupts over time. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the CPU interrupt usage score based on the value of the field cpu_interrupt_usage, which is highlighted when applications compete for shared hardware CPU resources. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
Windows
endpoint.CPU_queue_length_score_impact
float
CPU queue length score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.CPU_usage_score_impact
float
CPU usage score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.CPU_usage_value
float
CPU usage score: The CPU usage score is based on the amount of CPU usage over time. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the CPU usage score based on the value of the field normalized_cpu_usage, which is the average percentage of the CPU usage across all logical cores. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.GPU_1_usage_score_impact
float
GPU 1 usage score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.GPU_1_usage_value
float
GPU 1 usage score: The GPU 1 usage score is based on the amount of GPU usage over time. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the GPU 1 usage score based on the value of the field gpu_1_usage, which is the average percentage of the GPU usage. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.GPU_2_usage_score_impact
float
GPU 2 usage score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.GPU_2_usage_value
float
GPU 2 usage score: The GPU 2 usage score is based on the amount of GPU usage over time. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the GPU 2 usage score based on the value of the field gpu_2_usage, which is the average percentage of the GPU usage. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.boot_speed_score_impact
float
Boot speed score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.boot_speed_value
float
Boot speed score: The boot speed score is based on the duration of boot events. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the boot speed score based on the value of the field boot.duration , which is the time between powering on a device and the display of the sign-in screen. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
Windows
endpoint.device_performance_score_impact
float
Device performance score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.device_performance_value
float
Device performance score: The device performance score is based on hard metrics around CPU usage, GPU usage, memory usage, and system free space. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.device_reliability_score_impact
float
Device reliability score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.device_reliability_value
float
Device reliability score: The Device reliability score is based on hard metrics regarding system crashes and hard resets. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: The value could be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.device_responsiveness_score_impact
float
Device responsiveness score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.device_responsiveness_value
float
Device responsiveness score: The Device responsiveness score is based on the delay between a user action (such as moving the mouse, pressing a key, and so on) and the OS acting upon it. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the amount of time per hour with noticeable input delay for the user (fields duration_with_high_user_input_delay, duration_with_medium_input_delay ). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.disk_queue_length_score_impact
float
Disk queue length score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.disk_queue_length_value
float
Disk queue length score: The disk queue length score is based on the number of disk tasks waiting to be executed. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the disk queue length score based on the value of the field disk_queue_length, which is the number of storage input and output tasks waiting to be executed on the system drive. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
Windows
endpoint.hard_reset_score_impact
float
Hard reset score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.hard_reset_value
float
Hard reset score: The Device responsiveness score is based on the number of hard resets. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the field number_of_hard_resets , which captures abrupt stops of a device caused by pressing the reset button, power failures or crashes. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.logon_speed_score_impact
float
Logon speed impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.logon_speed_value
float
Logon speed score: The Logon speed score is based on the duration of logon events. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the value of the field time_until_desktop_is_visible , which is the number of seconds between the user logging on and the desktop being shown. The value could be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
Windows
endpoint.memory_swap_rate_score_impact
float
Memory swap rate score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.memory_swap_rate_value
float
Memory swap rate score: The memory swap rate score is based on the speed at which memory is written from RAM to the disk to free up memory. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the memory swap rate score based on the value of the field memory_swap_rate, which is the average speed at which memory is written to the swap file. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.memory_swap_size_score_impact
float
Memory swap size score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.memory_swap_size_value
float
Memory swap size score: The memory swap size score is based on the amount of space used by the operating system to move application data from RAM to the disk. A score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the memory swap size score based on the value of the field memory_swap_size, which is the average amount of disk space the operating system allocates to store the state of less frequently used applications from RAM to the disk. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.memory_usage_score_impact
float
Memory usage score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.memory_usage_value
float
Memory usage score: The memory usage score is based on the amount of RAM over time. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the memory usage score based on the value of the field free_memory divided by the value of the field installed_value, which measures the average percentage of free RAM. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.network_quality_score_impact
float
Network quality score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.network_quality_value
float
Network quality score: The network quality score is based on hard metrics around the Wi-Fi signal strength, download speed, and upload speed. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.os_activation_score_impact
float
OS activation score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
Windows
endpoint.os_activation_value
float
OS activation score: The OS activation score is based on the number of devices used by the users that do not have an activated OS. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the count of devices operated by the user with a non-activated operating system (that is, field operating_system.is_activated is equal to False). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
Windows
endpoint.score_impact
float
Endpoint score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_performance_score_impact
float
Software performance impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_performance_value
float
Software performance score: The Software performance score is based on hard metrics regarding software freezes occurring across the devices. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: The value could be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.software_performance_with_gui_score_impact
float
Software performance (with GUI) impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_performance_with_gui_value
float
Software performance (with GUI) score: The Software performance score is based on freezes of binaries with a GUI. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the execution freezes (field number_of_freezes ) of binaries with a GUI (that is, field has_user_interface is equal to TRUE). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.software_performance_without_gui_score_impact
float
Software performance (without GUI) score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_performance_without_gui_value
float
Software performance (without GUI) score: The Software performance score is based on freezes of binaries without a GUI. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the execution freezes (field number_of_freezes ) of binaries without a GUI (that is, field has_user_interface is equal to false). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.software_reliability_score_impact
float
Software reliability impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_reliability_value
float
Software reliability score: The Software reliability score is based on hard metrics regarding software crashes occurring across the device. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.software_reliability_with_gui_score_impact
float
Software reliability (with GUI) impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_reliability_with_gui_value
float
Software reliability (with GUI) score: The Software reliability score is based on crashes of binaries with a GUI. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the execution crashes (field number_of_crashes ) of binaries with a GUI (that is, field has_user_interface is equal to TRUE). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.software_reliability_without_gui_score_impact
float
Software reliability (without GUI) score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.software_reliability_without_gui_value
float
Software reliability (without GUI) score: The Software reliability score is based on crashes of binaries without a GUI. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the execution crashes (field number_of_crashes ) of binaries without a GUI (that is, field has_user_interface is equal to false). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.system_crash_score_impact
float
System crash score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.system_crash_value
float
System crash score: The Device responsiveness score is based on the number of system crashes. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the field number_of_system_crashes , which captures crashes of a device such as Blue Screen on Windows. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.system_free_space_score_impact
float
System free space score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.system_free_space_value
float
System free space score: The system free space score is based on the amount of free system disk space. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the system free space score based on the value of the field system_drive_free_space, which is the amount of free space available on the system drive. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.value
float
Endpoint score: The Endpoint score is based on hard metrics focused on device performance and reliability. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.virtual_session_lag_score_impact
float
Virtual session lag impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.virtual_session_lag_value
float
Virtual session lag score: The Virtual session lag score is based on the network latency for virtual sessions. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: It is computed based on the value of the field average_network_latency , which measures the lag for virtual sessions. The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.wifi_download_speed_score_impact
float
WiFi download speed score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.wifi_download_speed_value
float
WiFi download speed score: The Wi-Fi download speed score is based on the receiving rate of the Wi-Fi network. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Wi-Fi download speed score based on the value of the field receive_rate, which is the transmission rate of the Wi-Fi adapter. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.wifi_signal_strength_score_impact
float
WiFi signal strength score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.wifi_signal_strength_value
float
WiFi signal strength score: The Wi-Fi signal strength score is based on the signal quality of the Wi-Fi network. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Wi-Fi signal strength score based on the value of the field signal_strength, which is the Wi-Fi signal strength or Received Signal Strength Indicator (RSSI). The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
endpoint.wifi_upload_speed_score_impact
float
WiFi upload speed score impact: Estimated decrease in the Technology component of the DEX score due to issues monitored by this node.
endpoint.wifi_upload_speed_value
float
WiFi upload speed score: The Wi-Fi upload speed score is based on the transmission rate of the Wi-Fi network. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The system computes the Wi-Fi upload speed score based on the value of the field transmission_rate, which is the transmission rate for the Wi-Fi adapter. The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes the value once per day and it is based on data from the last 7 days. See the DEX score documentation for more information.
score_computation_approximation
enumeration
Score computation approximation: Indicates whether a device or context approximation affected the score computation. Possible values:
unknown
none
multi_device
multi_context
When the device or context changes, this field indicates that the score cannot be associated beyond the user to device and context. Details: Approximations can occur, for example, when a user uses multiple devices simultaneously or when device context changes within an hour, such as location changes. See the Computation of the DEX score documentation for more information.
sentiment.value
integer
Sentiment score: The Sentiment score is based on survey data collected via a sentiment campaign. A score represents the level of satisfaction with IT. Details: The value can be between 0 and 100 and corresponds to:
0-30: Dissatisfied employee
31-70: Not dissatisfied, nor satisfied employee
71-100: Satisfied employee
It is computed once per day and is based on survey data from the last 30 days. See the DEX score documentation for more information.
technology.value
float
Technology score: The Technology score is based on hard metrics for endpoints, applications, and collaboration solutions. A score represents the level of digital experience for the combination of a user, device, and user context, such as location. Details: The value can be between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
It is computed once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
time
datetime
Time: The time of the DEX metric.
value
float
DEX score: The Digital Employee Experience (DEX) score is based on hard metrics and soft metrics. The score represents the level of digital employee experience for the combination of the following factors: user, device, and user context, such as employee location. Details: The value is between 0 and 100 and corresponds to:
0-30: Frustrating experience
31-70: Average experience
71-100: Good experience
The system computes it once per day and is based on data from the last 7 days. See the DEX score documentation for more information.
Namespace execution
The execution namespace consists of two tables: crashes and events. The crashes table contains instances of executables crashing. The execution events table stores information about the performance of executables in 15-minute or 24-hour time blocks.
crashes
The table collecting crashes of a running process.
crashes are punctual events.
crashes are associated to binary, device, user, application
binary_path
string
Binary path: The file path of the crashing binary.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
crash_on_start
bool
Crashed on start: Indicates whether the binary crashed immediately after launch. Details: Returns 'Yes' if the process crashes within the first second.
number_of_crashes
integer
Number of crashes: The number of crashes of the same binary that happened within one minute. Details: Collector creates only one event if the same binary crashes multiple times within one minute.
process_visibility
enumeration
Process Visibility: Indicates the process visibility at the time of the crash. Requirements: Requires Collector version 25.3 or higher. Details: The logic is applied in the following order: 1. Foreground: non-minimized GUI, and the device is unlocked. 2. System: run under privileged users (e.g., system, root). 3. Background: minimized or non-GUI processes, processes on locked devices, and other non-privileged background processes.
time
datetime
Time: The date and time when the crash occurred.
events
The table collecting performance metrics and attributes specific to a process execution.
events are sampled events.
events are associated to user, binary, device, application
bucket_duration
duration
Bucket duration: The duration of the time bucket.
connection_establishment_time
duration
Connection establishment time: The average round trip time during TCP connection establishment. Requirements: TCP connections only Details: The average RTT for all established connections. The round trip time is measured between sending the SYN message and receiving the SYN-ACK message from the remote party during the TCP connection establishment (3-way handshake).
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
cpu_time
duration
CPU time: The sum of the CPU time of all the underlying processes during this time bucket. Details: The CPU time can be much higher than the bucket duration as multiple processes can run in parallel on several CPU cores.
end_time
datetime
Bucket end: The end of the time bucket.
execution_duration
duration
Execution duration: The duration of the process in this time bucket. Details: It represents the total time for which at least one instance of the process was running.
focus_time
duration
Focus time: The amount of time any window related to this execution was in focus. Details: A window is in 'focus' when it is selected to receive input from the user. Only one window has the focus at any point in time.
The focus time of all windows related to this execution is summed up to a maximum that equals the bucket duration.
highest_process_visibility
enumeration
Highest Process Visibility: Indicates the highest process visibility observed during a given time interval. Requirements: Requires Collector version 25.3 or higher. Details: The logic is applied in the following order: 1. Foreground: non-minimized GUI, and the device is unlocked. 2. System: run under privileged users (e.g., system, root). 3. Background: all other cases, such as minimized or non-GUI processes, processes on locked devices, and other non-privileged background processes. If a process is detected with multiple visibility levels within the same time interval, only the highest one—based on the above priority—is reported.
incoming_throughput
throughput_Mbps
Incoming throughput: The average download speed in Mbit/sec. Requirements: TCP connections only
incoming_traffic
bytes
Incoming traffic: The amount of application traffic received. Requirements: TCP connections only
memory
bytes
Memory used: The average memory usage of the executed binary, in bytes. Details: This metric represents the average memory used by all processes running the same binary during the time bucket. The value is weighted by each process’s execution duration.
number_of_established_connections
integer
Established connections: The number of established connections in this time bucket.
number_of_freezes
integer
Number of freezes: The number of execution freezes. Details: The sampling of unresponsive applications every 30 second might lead to missed execution freezes.
number_of_logical_processors
integer
Logical processors: The number of logical processors on the device. Details: Use this metric to calculate normalized CPU usage by dividing through the number of logical processors.
number_of_no_host_connections
integer
Failed connections - no host: The number of connections that failed because the device cannot reach the destination host. Requirements: TCP connections only Details: A connection fails with 'no host' when the destination host (remote party) does not acknowledge the TCP SYN message. For example, the remote party does not exist or a firewall blocks the connection request.
number_of_no_service_connections
integer
Failed connections - no service: The number of connections that failed because the device cannot reach the service on the destination host. Requirements: TCP connections only Details: A connection fails with 'no service' when the destination host (remote party) acknowledged the initial TCP SYN message by an RST message. For example, the remote party exists, but no service is bound to the request port.
Note that a firewall protects most personal computers and discards RST messages to prevent effective port scanning.
number_of_page_faults
long
Page faults: The total number of page faults. Details: A page fault happens, when a process tries to access a part of the memory that has not yet been loaded into memory. Page faults degrade the performance of the execution and the system.
Windows
number_of_rejected_connections
integer
Failed connections - rejected: The number of outgoing connections that have been rejected on the device of the user. Requirements: TCP connections only Details: The operating system of the device or a local firewall can reject an outgoing connection on the device.
number_of_started_processes
integer
Started processes: The total number of started processes. Requirements: Requires Collector version 25.3 or above.
Windows macOS
number_of_stopped_processes
integer
Stopped processes: The total number of processes terminated without error.
outgoing_throughput
throughput_Mbps
Outgoing throughput: The average upload speed in Mbit/sec.
outgoing_traffic
bytes
Outgoing traffic: The amount of application traffic sent. Details: This includes the traffic from all TCP and UDP connections.
primary_physical_adapter_type
enumeration
Network adapter type: The type of the primary physical network adapter at the time of this execution. Details: There are three types of physical network adapters: :
WiFi
Ethernet
Bluetooth
real_memory
bytes
Memory used by binary: The average memory usage of the executed binary, in bytes. Requirements: Requires Collector version 25.4 or higher. Details: This metric represents the average memory used by all processes running the same binary during the time bucket. The value is weighted by each process’s execution duration.
start_time
datetime
Bucket start: The start of the time bucket.
startup_duration
duration
Startup duration: The average startup duration. Requirements: Requires Collector version 25.3 or above. Details: Weighted average of all startup durations of all new processes in this bucket with the number_of_started_processes as the weight.
Windows
startup_time
datetime
Startup time: The date and time of the first process in the bucket. Requirements: Requires Collector version 25.3 or above. Details: The point in time when the process was started for the first time in this bucket. The field is NULL if no process was started in the bucket.
Windows macOS
Namespace package
The package namespace includes information about software products in their distributable form: applications and updates. In addition to the packages and installed_packages tables, it includes two event tables: installations and uninstallations.
packages
The table of packages. A package is a group of files and executables that together constitute a software application.
first_seen
datetime
First seen: The date and time the package was first detected by Nexthink.
Windows macOS
name
string
Package name: The name of the packages as it is listed in the operating system. Details: Nexthink scans for new packages once per hour. Installation and uninstallation events align with the hourly scans.
Windows macOS
parent_name
string
Parent package name: The name of the original package for which an update was installed. Details: Applies only to updates. The field is empty for regular installation packages.
Windows
platform
enumeration
Package platform: The operating system platform to which the installed package belongs. Details: Possible values:
Windows
macOS
Windows macOS
publisher
string
Package publisher: The name of the company that publishes the software.
Windows macOS
type
enumeration
Package type: Indicates whether the package contains a program or an update to a previously installed package. Details: Possible values:
Program
Update (Windows only)
Windows macOS
uid
uuid
Package UID: The numerical value that uniquely identifies a package in Nexthink.
Windows macOS
version
string
Package version: The version of the package, stored as a string. Details: It is stored as a string because the package version reported by the operating system is not always numerical. This contrasts with binary.version, which consistently follows the x.y.z.t format.
Windows macOS
installations
The table of package installation events.
installations are punctual events.
installations are associated to package, device, user
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
time
datetime
Installation time: The time of the installation event.
uninstallations
The table of package uninstallation events.
uninstallations are punctual events.
uninstallations are associated to package, device, user
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
time
datetime
Uninstallation time: The time of the uninstallation event.
installed_packages
The table of all installed packages on all devices.
installed_packages are associated to device, user, package,
first_seen
datetime
First seen: The date and time the package was first detected by Nexthink.
Windows macOS
name
string
Package name: The name of the packages as it is listed in the operating system. Details: Nexthink scans for new packages once per hour. Installation and uninstallation events align with the hourly scans.
Windows macOS
parent_name
string
Parent package name: The name of the original package for which an update was installed. Details: Applies only to updates. The field is empty for regular installation packages.
Windows
platform
enumeration
Package platform: The operating system platform to which the installed package belongs. Details: Possible values:
Windows
macOS
Windows macOS
publisher
string
Package publisher: The name of the company that publishes the software.
Windows macOS
type
enumeration
Package type: Indicates whether the package contains a program or an update to a previously installed package. Details: Possible values:
Program
Update (Windows only)
Windows macOS
uid
uuid
Package UID: The numerical value that uniquely identifies a package in Nexthink.
Windows macOS
version
string
Package version: The version of the package, stored as a string. Details: It is stored as a string because the package version reported by the operating system is not always numerical. This contrasts with binary.version, which consistently follows the x.y.z.t format.
Windows macOS
Namespace platform
The platform namespace contains administrative logs of events occurring in the Infinity platform.
accounts
account
account_uuid
uuid
UUID: account uuid
full_name
string
Full Name: Full name of the account used to access the feature
name
string
Name: Name of the account used to access the feature
roles
jsonArrayString
Roles: List of roles of the account
audit_logs
The list of all the events audited on the Infinity platform. Requires permission 'View audit logs in NQL'
audit_logs are punctual events.
account
string
Account: The name of the account or the API credentials that triggered the action.
category
enumeration
Category: The category of the event (e.g., "login" for all events related to authentication).
code
numeric
Code: The code that identifies the event. Please refer to the audit documentation for more details.
message
string
Message: The full audit event message.
time
datetime
Time: The timestamp of the event.
custom_trends_logs
The list of all logs associated to custom trends computations. Requires permission 'View platform logs in NQL'.
custom_trends_logs are punctual events.
details
jsonType
Details: Custom Trends log details.
status
enumeration
Status: The status of the custom trend execution.
time
datetime
Time: The timestamp of the event.
data_export_logs
The list of all logs associated to data export executions. Requires permission 'View platform logs in NQL'.
data_export_logs are punctual events.
details
jsonType
Details: Data Export log details.
status
enumeration
Status: The status of the data export execution.
time
datetime
Time: The timestamp of the event.
guide_step_stability_statistics
Represents daily-aggregated information about the stability of selectors for guide steps.
guide_step_stability_statistics are sampled events.
guide_step_stability_statistics are associated to binary, device, user, application, page, guide, guide_step
browser_language
string
Browser language: Language configured in the user's browser.
bucket_duration
integer
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
element_stability
integer
Element stability rate: Minimum selector success rate (percentage) observed across all step evaluations for the user during the day. Each evaluation computes the share of enabled selectors that successfully matched the element. This field stores the minimum of those evaluation-level rates.
element_type
enumeration
Element type: Type of step element represented by this row: trigger - used to trigger the step, completion - used to complete the step, position - used to position the step.
element_version
integer
Element version: Version number of the step element definition for the given element type. Increments whenever that element definition changes.
end_time
datetime
Bucket end: The date and time of the bucket end.
language
string
Language: Either the value of the user’s browser language or the value of the underlying application’s language.
start_time
datetime
Bucket start: The date and time of the bucket start.
inbound_connector_logs
The list of all logs associated to inbound connector executions. Requires permission 'View platform logs in NQL'.
inbound_connector_logs are punctual events.
details
jsonType
Details: Inbound connectors platform log details
status
enumeration
Status: The status of the execution
time
datetime
Time: The timestamp of the event
Namespace remote_action
The remote action namespace consists of tables giving details about remote actions, including the configuration data and the remote action executions. Nexthink Remote Actions allows you to execute small scripts on employee devices. It provides several opportunities for the prevention and remediation of employee issues and for gathering additional information from endpoints running Nexthink Collector.
remote_actions
The table of defined remote actions.
name
string
Name: The name of the remote action. Details: User defined name created through the remote action configuration page. The name of the remote action can be changed after creation and should not be considered as a unique identifier.
nql_id
string
NQL ID: The unique identifier of the remote action. Details: The NQL ID cannot be changed after the initial creation.
source
enumeration
Remote action source: The platform that was used to create the remote action. Details: Possible values:
cloud
finder
Note that cloud references Nexthink Infinity.
executions
The table collecting the executed remote actions.
executions are punctual events.
executions are associated to device, user, remote_action
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
external_reference
string
External reference: The identifier of the external web application record associated with the remote action execution. Details: The field could contain the values such as the ticket identifier of the ITSM ticket.
external_source
string
External source: The name of the system external to Nexthink from where the remote action was triggered. Details: External source contains the name of the external system which either used Nexthink product or directly the API to trigger the remote action.
inputs
string
Inputs: The list of the inputs provided for the remote action execution. Details: The list of inputs provided for the remote action execution at the point it was triggered. These inputs are used by the remote action to influence how it behaves.
internal_source
string
Internal source: The name of the feature from which the remote action was triggered. Possible values: Amplify, Workflow, Investigation, Device view, or blank for no value.
message_uuid
string
Message UUID: The unique identifier of the remote action execution. Details: The message UUID is used to identify a single remote action execution and is generated when a remote action is triggered.
number_of_executions
long
Number of executions: The number of times the remote execution attempted to run on the device.
outputs
string
Outputs: The list of outputs collected by the remote action execution.
purpose
enumeration
Purpose: The purpose of the remote action defined in the configuration. Details: The purpose is part of the remote action configuration and describes whether the remote action is collecting data, remediating an issue or performing both functions. Possible values:
data_collection
remediation
both
request_id
string
Request ID: The unique identifier for the request that created the remote action execution. Details: The request ID is generated and linked to individual remote action executions when a remote action is triggered against one or multiple devices. This field can be used as a method of grouping remote action executions
request_time
datetime
Request time: The date and time when the remote action execution was triggered.
status
enumeration
Status: The current status of the remote action execution. Details: The status can be used to monitor whether a remote action execution has finished or not. Possible values:
in_progress
expired
failure
success
no_script
cancelled
old_collector
waiting_on_device (only for device-targeted remote actions)
waiting_on_user (only for session-targeted remote actions)
status_details
string
Status details: The latest message returned by the remote action execution. Details: The status details field contains the return message and exit codes from the remote action.
time
datetime
Time: The date and time when the remote action execution was last updated.
trigger_method
enumeration
Trigger method: The mode of trigger used to start the remote action execution. Details: Possible values:
manual: the remote action is executed on manually selected devices
automatic: the remote action is executed on a recurring basis based on a centrally-managed schedule
automatic_local_schedule: the remote action is executed on a recurring basis based on a schedule on the endpoint
API: the remote action is executed programmatically using the Remote Actions API on selected devices
workflow: the remote action is executed as part of a Nexthink workflow
executions_summary
The table collecting the trend of executed remote actions.
executions_summary are sampled events.
executions_summary are associated to remote_action
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
inputs
string
Inputs: The list of inputs provided for the remote action execution. Details: The list of inputs provided for the remote action execution at the point that it was triggered. These inputs are used by the remote action to influence how it behaves.
number_of_executions
long
Number of executions: The number of times the remote execution attempted to run on the device.
purpose
enumeration
Purpose: The purpose of the remote action defined in the configuration. Details: The purpose is part of the remote action configuration and describes whether the remote action is collecting data, remediating an issue or performing both functions. Possible values:
data_collection
remediation
both
status
enumeration
Status: The current status of the remote action execution. Details: The status can be used to monitor whether a remote action execution has finished or not. Possible values:
in_progress
expired
failure
success
no_script
cancelled
old_collector
waiting_on_device (only for device-targeted remote actions)
waiting_on_user (only for session-targeted remote actions)
status_details
string
Status details: The latest message returned by the remote action execution. Details: The status details field contains the return message and exit code that came back from the remote action.
time
datetime
Time: The date and time when the remote action execution was last updated.
trigger_method
enumeration
Trigger method: The trigger used to start the remote action execution. Details: Possible values:
null
automatic
api
manual
Namespace service
The service namespace is an inventory of critical system components and specialised applications that run in the background on user devices. It allows for efficient status or configuration tracking and optimisation to ensure system reliability and security.
services
A table of services. A service performs automated tasks, responds to hardware events, or listens for data requests from other software. These services are often loaded automatically at startup and run in the background without user interaction.
arguments
string
Arguments: Parameters used for launching the service. Details: Unique IDs or hashes contained in arguments may be replaced with ellipses to correlate the same services more accurately. File paths in arguments may be tokenised. For example, they can be matched with binary paths captured for execution crashes.
Windows
dependency_of
jsonArrayString
Dependency of: List of other services and drivers that depend on this service. Details: Based on data reported by the first device that runs the same service.
Windows
depends_on
jsonArrayString
Depends on: List of services and drivers that this service depends on. Details: Based on data reported by the first device that runs the same service.
Windows
description
string
Description: Purpose of the service as stated by the developer. Details: Based on data reported by the first device that runs the same service. The English version takes precedence.
Windows
display_name
string
Display name: User-friendly name of the service. Details: Based on data reported by the first device that runs the same service. The English version takes precedence.
Windows
module_path
string
Module path: DLL module loaded by the main executable.
Windows
name
string
Name: Short name of the service used for identification.
Windows
path
string
Path: Location of the binary that runs the service. Details: Unique IDs or hashes contained in the path may be replaced with ellipses to correlate the same services more accurately.
Windows
uid
uuid
Service UID: Numerical value that uniquely identifies a service on the Nexthink platform.
Windows
changes
Contains events triggered when an attribute of an existing service changes on a device. The attributes tracked by these events are the same as those in the 'installed_services' table, for example, 'logon_as' and 'startup_type'.
changes are punctual events.
changes are associated to service, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
field
enumeration
Field: Name of the attribute of the related service that changed.
Windows
new_value
string
New value: Updated value of the field that changed.
Windows
old_value
string
Old value: Previous value of the field before the change.
Windows
time
datetime
Time: Timestamp indicating when the change in value was detected.
Windows
installations
Contains event triggered when a service was added to or removed from a specific device.
installations are punctual events.
installations are associated to service, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
event_type
enumeration
Installation type: Indicates if the service was installed or uninstalled; Possible values are 'install' and 'uninstall'.
Windows
time
datetime
Time: Timestamp indicating when the item was detected as added or removed.
Windows
installed_services
A table containing all services currently installed on all devices.
installed_services are associated to device, service,
first_seen
datetime
Service first seen: Timestamp when the service was first seen on the given device.
Windows
last_updated
datetime
Service info last updated: Timestamp of the last recorded change to the service on the given device.
Windows
logon_as
string
Service logs on as: Account under which the service runs, either one of the four main options (Local System, Local Service, Network Service, Per user) or an explicit user account. Details: The 'Per user' option refers to per-user services, which are started at user login and run within the user’s own session.
Windows
startup_type
enumeration
Service startup type: Startup type of the service, with possible values being 'Automatic', 'Manual', 'Disabled' or 'Delayed'. This defines how and when a Windows service starts. Details: Automatic services are started after the device boot. Delayed services are typically launched 120s after the last Automatic service starts (this dalay is configurable). Manual services are started on demand.
Windows
Namespace session
The session namespace consists of several tables related to a user session on a device. The session.events table contains sampled metrics aggregated in 5-minute and 24-hour buckets. The session.vdi_events table contains VDI-specific session metrics aggregated in 30-second, 5-minute, and 24-hour buckets. The remaining tables store punctual events related to a session.
vdi_sessions
vdi_session
agent_version
version
VM agent version: The version of the VDI agent application running within the VM that facilitates communication between the VM and the management infrastructure.
Windows
desktop_pool
string
Desktop pool: A logical group of VMs that share the same configuration. A specified group of users can access these VMs.
Windows
disk_image
string
Disk image: The disk image used by the VM at the time the VDI session was established.
Windows
first_seen
datetime
First seen: The date and time when the VDI session was first seen by the Nexthink instance.
Windows
hostname
string
Virtualization host: The name of the virtualization host that the VM was running on at the time the VDI session was established. Requirements: To populate this field for AVD, AWS, Citrix, and Horizon VMs, the respective Connector integrations must be installed and enabled. For Citrix DaaS, enable public IP-based GeoIP resolution to allow the appropriate cloud provider label to be used as the hostname. Details: For cloud-hosted VMs where the underlying hostname is not exposed by the cloud provider, a provider-specific value is used. Examples for possible values are:
AVD host
Windows 365 host
AWS host
Google host
Windows
id
integer
Session ID: A temporary identifier assigned to each user session by the OS.
Windows
initial_program
string
Initial program: The path and name of the binary launched when the VDI session is configured to start a specific application instead of providing access to the full desktop.
Windows
last_client.app_version
version
Client application version: The version of the VDI remote client application running on the client device that was used for accessing the VM most recently. Requirements: In case of AVD and Windows 365 remote desktop sessions, this data is only available if Nexthink VDI Extension is installed on the client device. For Citrix and Horizon, this information does not require the Extension to be installed.
Windows
last_client.device.collector.uid
uuid
UID: The client device collector UID.
last_client.device.name
string
Client device name: The name of the client device as used by the OS for identification purposes on the local network. Details: This information dependens on the VDI vendor's ability to retrieve the device name from the remote client.
last_client.device.operating_system.platform
enumeration
Platform: The client device OS platform. Details: Client device operating system platform
Windows
last_client.device.uid
uuid
Client device UID: The unique identifier of the client device that has Collector installed, as shown in the Nexthink platform. Requirements: Requires Nexthink Collector to be installed on the client device.
last_client.plugin_version
version
Client plugin version: The version of the Nexthink VDI Extension used for capturing additional information about the health of the end-to-end VDI remote session on the most recent occasion. Requirements: Requires Nexthink VDI Extension to be installed on the client device.
Windows
last_interaction_time
datetime
Last interaction time: The timestamp indicating when the user last interacted with the session.
Windows
last_seen
datetime
Last seen: The date and time when the VDI session was last seen by the Nexthink instance.
Windows
logon_server
string
Logon server: The domain controller that authenticates the user credentials during the login process. Details: Logon server is not applicable for environments where user authentication relies on EntraID.
Windows
name
string
Session name: The name of the VDI session, as assigned by the OS. It indicates whether the user has logged on using the physical console or a remote connection protocol.
Windows
region
string
Region: The name or id of the cloud service provider's hosting region where the server running the VM for the session is located. Requirements: This metric is currently available only for AVD remote desktop sessions.
Windows
remote_protocol
string
Remote protocol: The VDI protocol used for transmitting data and user input between the remote applications/desktops and the client device. Possible values:
BLAST
ICA
PCOIP
RDP
Windows
session_type
string
Session type: The delivery model that indicates whether the VDI session is sharing a full desktop or published application.
Windows
state
enumeration
Session state: The last seen state of the VDI session, as reported by the OS. It provides context for troubleshooting and optimization use cases to understand the lifecycle state of the session, and whether there is a remote user connected. Details: Possible values:
active
connected
connect_query
shadow
disconnected
idle
list
reset
down
init
Windows
transport_protocol
string
Transport protocol: The underlying network-level protocol employed by the VDI vendor to facilitate communication and to establish a session between the client and server.
Windows
uid
uuid
Session UID: The unique identifier of a session on the Nexthink platform.
Windows
virtualization_type
enumeration
Session virtualization type: The desktop assignment model. Requirements: This metric is currently available only for Citrix remote desktop sessions. Details: Possible values:
personal: users have dedicated, persistent VMs
pooled: users access identical but seperate, non-persistent VMs
shared: multiple users access the same multi-session, non-persistent VM
Windows
connects
The table collecting connections linked to user sessions.
connects are punctual events.
connects are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_connects
integer
Number of connects: The number of session connects.
session_uid
string
Session UID: The session UID.
time
datetime
Time: The date and time of the connection.
disconnects
The table collecting disconnections linked to user sessions.
disconnects are punctual events.
disconnects are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_disconnects
integer
Number of disconnects: The number of session disconnects.
session_uid
string
Session UID: The session UID.
time
datetime
Time: The date and time of the disconnect.
events
The table collecting performance metrics and attributes specific to both local and remote sessions.
events are sampled events.
events are associated to user, device
average_network_latency
duration
Average network latency: The average network latency. It indicates how long it took on average for remote access protocol packets to travel from the endpoint to the virtual desktop and back. Users may notice slowness if it exceeds 150 milliseconds. Requirements: This metric is only available for remote sessions accessed through a remote access protocol. Furthermore, this metric requires Nexthink Collector installed on the virtual desktop machine.
Windows
average_rtt
duration
Average RTT: The average RTT. It indicates how long the virtual desktop takes on average to respond to user input. Users may notice slowness if it exceeds 150 milliseconds. Requirements: This metric is only available for remote desktop sessions that are accessed through the Citrix ICA/HDX remote access protocol. Furthermore, this metric requires Nexthink Collector installed on the virtual desktop machine. Details: The session input RTT combines network performance and performance of the virtual desktop in a single measurement. To diagnose a high value, review the session network latency. If it is also high, investigate the network connection first. Otherwise, focus on the performance of the virtual desktops.
Windows
bucket_duration
duration
Bucket duration: The bucket duration. It represents the timespan over which the metrics were measured and aggregated.
client_ip
ipAddress
Client IP address: The IP address of the device used to access the remote virtual desktop. Requirements: This value is only available for remote sessions, accessed through a remote access protocol. Furthermore, this metric requires Nexthink Collector installed on the virtual desktop machine. Certain modern desktop virtualization solutions no longer support this value due to security and network routing restrictions.
Windows
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration_with_high_user_input_delay
duration
Duration with high user input delay: The amount of time the session took longer than 200 milliseconds to respond to a user input. Requirements: The user input delay requires Windows 11 or Window Server 2022.
Windows
duration_with_medium_user_input_delay
duration
Duration with medium user input delay: The amount of time the session took longer than 100 milliseconds to respond to a user input. Requirements: The user input delay requires Windows 11 or Window Server 2022.
Windows
end_time
datetime
Bucket end: The end time of the bucket. It represents the date and time at which the data collection ended for the given timespan.
max_network_latency
duration
Maximum network latency: The maximum amount of time it took for the remote access protocol packets to travel from the endpoint to the virtual desktop and back. Users may notice slowness if it exceeds 150 milliseconds. Requirements: This metric is only available for remote sessions accessed through a remote access protocol. Furthermore, this metric requires Nexthink Collector installed on the virtual desktop machine.
Windows
max_rtt
duration
Maximum RTT: The maximum amount of time it took for the virtual desktop to respond to a user input. Users may notice slowness if it exceeds 150 milliseconds. Requirements: This metric is only available for remote desktop sessions that are accessed through the Citrix ICA/HDX remote access protocol. Furthermore, this metric requires Nexthink Collector to be installed on the virtual desktop machine. Details: The session input RTT combines network performance and performance of the virtual desktop in a single measurement. To diagnose a high value, review the session network latency. If it is also high, investigate the network connection first. Otherwise, focus on the performance of the virtual desktops.
Windows
protocol
enumeration
Protocol: The remote access protocol used to connect to the session. Possible values:
Citrix - ICA
VMware - Blast
VMware - PCOIP
RDP
Local session
Amazon PCOIP
session_id
long
Session ID: A temporary identifier assigned to each user session on a Windows computer. On a macOS device, the session ID represents the program ID of the process that is hosting the session. Details: On a Windows device, typically only one interactive user is active at a time. On a virtual desktop, multiple users may interact with the device simultaneously. Each user session is assigned a unique ID at login, which remains associated with the session until logout. After logout, the session ID may be reused for a new session. The session ID cannot be used to uniquely identify sessions in the Nexthink platform.
session_uid
string
Session UID: The unique identifier of a session in the Nexthink platform.
start_time
datetime
Bucket start: The start time of the bucket.
user_interaction_time
duration
Interaction time: The time that the user was actively interacting with the session. Details: Collector periodically checks when the user is actively interacting with the computer using a keyboard or pointing device and sums these periods into the reported duration. Passive activities, such as attending a video call without interaction, are not included.
lifecycle_events
The table collecting all events linked to user sessions.
lifecycle_events are punctual events.
lifecycle_events are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_lifecycle_events
integer
Number of events: The number of session events.
session_uid
string
Session UID: The session UID.
time
datetime
Time: The date and time of the lifecycle event.
type
enumeration
Lifecycle event type: The type of lifecycle event. Possible values:
login
logout
lock
unlock
connect
disconnect
Details: Connect and disconnect events correspond to the WTSConnected and WTSDisconnected functions in Microsoft Windows. A connection event may occur without a corresponding login event when a user establishes a remote connection but does not complete authentication.
locks
The table collecting locks linked to the user sessions.
locks are punctual events.
locks are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_locks
integer
Number of locks: The number of session locks.
session_uid
string
Session UID: The session UID.
time
datetime
Time: The date and time of the lock event.
logins
The table collecting all session logins.
logins are punctual events.
logins are associated to vdi_session, user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
context.vdi_client.location.country
string
VDI client -> Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.vdi_client.location.site
string
VDI client -> Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.vdi_client.location.state
string
VDI client -> State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.vdi_client.location.type
string
VDI client -> Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.vdi_client.organization.entity
string
VDI client -> Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_logins
integer
Number of logins: The number of logins.
session_uid
string
Session UID: The session UUID
time
datetime
Time: The date and time of the login.
time_until_desktop_is_ready
duration
Time until desktop ready: The number of seconds between the user login and the device is ready to use. Desktops and laptops are considered fully functional once the CPU usage drops below 15% and the disk usage drops below 80%. Servers are fully functional once the CPU usage of all processes belonging to the corresponding user drops below 15%.
Windows
time_until_desktop_is_visible
duration
Time until desktop visible: The number of seconds between the last user login and the time the desktop appears.
Windows
logouts
The table collecting all session logouts.
logouts are punctual events.
logouts are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_logouts
integer
Number of logouts: The number of logouts.
session_uid
string
Session UID: The session UUID.
time
datetime
Time: The date and time of the logout.
unlocks
The table collecting unlocks linked to user sessions.
unlocks are punctual events.
unlocks are associated to user, device
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
number_of_unlocks
integer
Number of unlocks: The number of session unlocks.
session_uid
string
Session UID: The session UID.
time
datetime
Time: The date and time of the unlock event.
vdi_events
VDI Events
vdi_events are sampled events.
vdi_events are associated to vdi_session, device, user
bucket_duration
duration
Bucket duration: The bucket duration. It represents the timespan over which the metrics were measured and aggregated.
client.app_version
version
Client application version: The version of the VDI remote client application running on the client device that was used for accessing the VM during the observed period. Requirements: In case of AVD and Windows 365 remote desktop sessions, this data is only available if Nexthink VDI Extension is installed on the client device. For Citrix and Horizon, this information does not require the Extension to be installed.
Windows
client.cpu.normalized_usage
percentage
Normalized usage: The average CPU usage during the selected time period, shown on a scale from 0 to 100 percent. It indicates how much of the time the CPU is busy. Requirements: Requires the Nexthink VDI plugin to be installed on the client device. Details: Sustained values of 80-90% or higher indicate that the CPU is a bottleneck for the workload. It does not account for clock speed and can report high utilization even when the CPU could theoretically run at higher frequencies but is being thermally throttled.
Windows
client.device.collector.uid
uuid
UID: The unique identifier of a Collector on the Nexthink platform. Requirements: Nexthink Collector must be installed on the VDI client device as well.
client.device.name
string
Client device name: The name of the client device as used by the OS for identification purposes on the local network. Details: This information dependens on the VDI vendor's ability to retrieve the device name from the remote client.
client.device.operating_system.platform
enumeration
Platform: The OS platform of the client device as reported by the VDI vendor. Details: Possible values:
windows
macos
linux
mobile
browser
unspecified
Windows
client.device.uid
uuid
Client device UID: The unique identifier of a device that has the Collector installed, as shown in the Nexthink platform. Requirements: Requires the Nexthink Collector to be installed on the client device.
client.network.active_network_adapter
string
Client active network adapter: The type of the physical network adapter that had the highest traffic during the selected time period. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.incoming_errors
integer
Client incoming errors: The total amount of incoming errors during the selected time period across all physical adapters of the VDI client device. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.incoming_packets
integer
Client incoming packets: The total amount of incoming packets during the selected time period across all physical adapters of the VDI client device. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.incoming_throughput
throughput_Bps
Client incoming throughput: The total incoming throughput across all physical adapters of the VDI client device, shown in bytes/second. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.ip_address
ipAddress
Client device IP address: The local IP address reported by the VDI vendor for the connection of the client application to the VM. Requirements: This metric is currently available only for Citrix and Horizon remote desktop clients.
Windows
client.network.outgoing_errors
integer
Client outgoing errors: The total amount of outgoing errors during the selected time period across all physical adapters of the VDI client device. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.outgoing_packets
integer
Client outgoing packets: The total amount of outgoing packets during the selected time period across all physical adapters of the VDI client device. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.outgoing_throughput
throughput_Bps
Client outgoing throughput: The total outgoing throughput across all physical adapters of the VDI client device, shown in bytes/second. Requirements: Nexthink VDI Client Plugin must be installed on the client device.
Windows
client.network.wan_latency
duration
WAN latency: The latency of ICMP/ping messages between the VDI client device and a latency host. Requirements: It must be enabled by configuring the Collector running on the VM with the desired latency host address. Also requires the Nexthink VDI Client Plugin to be installed on the client device. Details: Generally, ping times in a metropolitan area with robust internet infrastructure should be below 20-30ms. Values between 50-100ms could be still suitable for browsing and streaming, but real-time applications might start to experience minor lag.
Windows
client.network.wifi_signal_strength
signalStrength_Dbm
WiFi signal strength: The network Wi-Fi signal strength of the VDI client device, shown in dB. Requirements: Nexthink VDI Client Plugin must be installed on the client device. Details: The Wi-Fi signal strength (RSSI) is a negative number. The higher, closer to 0, the better. A signal strength above -60 dBm is considered good. In case there are multiple Wi-Fi adapters, it considers the one with the highest traffic.
Windows
client.network.wifi_transmission_rate
throughput_Mbps
WiFi transmission rate: The maximum achievable bandwidth for the period between the wireless adapter of the VDI client device and the hotspot, shown in Mbits/s. Requirements: Nexthink VDI Client Plugin must be installed on the client device. Details: For HD streaming, browsing and work from home use cases in general 100-300Mbps is expected to provide a reliable experience. In case there are multiple Wi-Fi adapters, it considers the one with the highest traffic.
Windows
client.network.wired_link_speed
throughput_Bps
Client wired link speed: The link speed between the ethernet adapter to the switch/router it is connected to. Requirements: Nexthink VDI Client Plugin must be installed on the client device. Details: For most applications, it is recommended to have at least 1Gbps wired connection. 100Mbps might be suitable for simpler, limited use cases that have smaller bandwidth requirements. In case there are multiple wired adapters, it considers the one with the highest traffic.
Windows
client.plugin_version
version
Client plugin version: The version of the Nexthink VDI Extension used for capturing additional information about the health of the end-to-end VDI remote session during the observed period. Requirements: The version of the Nexthink VDI Extension used for capturing additional information about the health of the end-to-end VDI remote session.
Windows
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
context.vdi_client.location.country
string
VDI client -> Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.vdi_client.location.site
string
VDI client -> Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.vdi_client.location.state
string
VDI client -> State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.vdi_client.location.type
string
VDI client -> Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.vdi_client.organization.entity
string
VDI client -> Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
end_time
datetime
Bucket end: The end time of the bucket.
framerate
integer
Framerate: The number of frames per second that are delivered to the client device display, directly affecting the smoothness and responsiveness of the visual experience during VDI sessions. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_average_client_processor
duration
Duration with average client processor health: The time during which the CPU usage of the VDI client device was between 50-80%. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_average_network
duration
Duration with average network health: The time during which the network RTT was between 150-250ms. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_average_responsiveness
duration
Duration with average responsiveness health: The time during which user the input delay was between 100-200ms.
Windows
health.duration_with_average_session
duration
Duration with average session health: The time during which at least one of the session health indicators was average and none of them were bad.
Windows
health.duration_with_average_vm_memory
duration
Duration with average VM memory health: Time during which the VM page output throughput was between 250-500 pages/s.
Windows
health.duration_with_average_vm_processor
duration
Duration with average VM processor health: The time during which the normalized CPU queue length of the VM was between 2-5.
Windows
health.duration_with_average_vm_storage
duration
Duration with average VM storage health: The time during which the VM storage latency is between 1 and 5ms or disk queue length is between 1 and 2, and neither the latency, nor the queue length is above these thresholds.
Windows
health.duration_with_bad_client_processor
duration
Duration with bad client processor health: The time during which the CPU usage of the VDI client device was 80% or higher. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_bad_network
duration
Duration with bad network health: The time during which the network RTT was 250ms or higher. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_bad_responsiveness
duration
Duration with bad responsiveness health: The time during which user the input delay was 200ms or higher.
Windows
health.duration_with_bad_session
duration
Duration with bad session health: The time during which at least one session health indicator was bad.
Windows
health.duration_with_bad_vm_memory
duration
Duration with bad VM memory health: The time during which the VM page output throughput was 500 pages/s or higher.
Windows
health.duration_with_bad_vm_processor
duration
Duration with bad VM processor health: The time during which the normalized CPU queue length of the VM was 5 or higher.
Windows
health.duration_with_bad_vm_storage
duration
Duration with bad VM storage health: The time during which the VM storage latency exceeds 5ms or disk queue length is equal to or greater than 2.
Windows
health.duration_with_good_client_processor
duration
Duration with good client processor health: The time during which the CPU usage of the VDI client device was below 50%. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_good_network
duration
Duration with good network health: The time during which the network RTT was below 150ms. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
health.duration_with_good_responsiveness
duration
Duration with good responsiveness health: The time during which user input delay was below 100ms.
Windows
health.duration_with_good_session
duration
Duration with good session health: The time during which all session health indicators were good.
Windows
health.duration_with_good_vm_memory
duration
Duration with good VM memory health: Time during which the VM page output throughput was below 250 pages/s.
Windows
health.duration_with_good_vm_processor
duration
Duration with good VM processor health: The time during which the normalized CPU queue length of the VM was below 2.
Windows
health.duration_with_good_vm_storage
duration
Duration with good VM storage health: The time during which the VM storage latency is below 1ms and disk queue length is below 1.
Windows
ica.input_bandwidth_available
throughput_Bps
Input bandwidth available: The maximum bandwidth available for the ICA session to send data from the VDI client to the VM.
Windows
ica.input_bandwidth_used
throughput_Bps
Input bandwidth used: The actual bandwidth consumed by the ICA session to send data from the VDI client to the VM.
Windows
ica.input_session_bandwidth
throughput_Bps
Input session bandwidth: The bandwidth allocated for the ICA session to send data from the VDI client to the VM.
Windows
ica.input_session_linespeed
throughput_Bps
Input session linespeed: The perceived effective bandwidth for the entire ICA session, from the VDI client to the VM. It factors in compression, latency, and network conditions.
Windows
ica.latency
duration
Latency: The ICA latency is the time interval between a user action and the graphical response, measured on the client side. This metric represents the screen lag that a user experiences. Details: Perceived ICA latency varies with workload and used applications. Most users will not notice latency under 150-200 ms, while momentary spikes up to 250 ms are often tolerable. However, sustained latency over 300 ms typically results in a degraded user experience. This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states. Network round trip time contributes to this metric. However, due to the different sampling frequency used by Citrix and client side optimizations such as local text echo and predictive rendering, which provide visual feedback before the full server round trip completes, the perceived latency may be lower than the underlying network RTT.
Windows
ica.output_bandwidth_available
throughput_Bps
Output bandwidth available: The maximum bandwidth available for the ICA session to send data from the VM to the VDI client.
Windows
ica.output_bandwidth_used
throughput_Bps
Output bandwidth used: The actual bandwidth consumed by the ICA session to send data from the VM to the VDI client.
Windows
ica.output_session_bandwidth
throughput_Bps
Output session bandwidth: The bandwidth allocated for the ICA session to send data from the VM to the VDI client.
Windows
ica.output_session_linespeed
throughput_Bps
Output session linespeed: The perceived effective bandwidth for the entire ICA session, from the VM to the VDI client. It factors in compression, latency, and network conditions.
Windows
idle_duration
duration
Idle duration: The duration during which the session was idle, and the user was not interacting with the remote desktop or application.
Windows
network_rtt
duration
Network RTT: The network level latency. It represents the message RTT between the client and the remote device. Details: Latency below 150ms is generally considered acceptable. Sustained latency above 250ms typically results in a degraded user experience. This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
rdp.frame_quality
percentage
Frame quality: The quality of the output frame of an RDP session, expressed as a percentage of the source frame quality.
Windows
rdp.frames_skipped_client
integer
Frames skipped client: The number of frames skipped per second due to insufficient client resources
Windows
rdp.frames_skipped_network
integer
Frames skipped network: The number of frames skipped per second due to insufficient network resources
Windows
rdp.frames_skipped_server
integer
Frames skipped server: The number of frames skipped per second due to insufficient server resources
Windows
rdp.tcp_bandwidth
throughput_Bps
TCP bandwidth: The estimated bandwidth in bits per second (bps) available for the RDP session over the TCP protocol, considering the latency, packet loss, and network congestion. Details: It is useful for assessing whether the available network bandwidth meets the requirements for the RDP session to perform smoothly.
Windows
rdp.tcp_receive_rate
throughput_Bps
TCP receive rate: The rate in bits per second (bps) at which data is actually received over TCP.
Windows
rdp.tcp_send_rate
throughput_Bps
TCP send rate: The rate in bits per second (bps) at which data is actually sent over TCP.
Windows
rdp.udp_bandwidth
throughput_Bps
UDP bandwidth: The estimated bandwidth in bits per second (bps) available for the RDP session over the UDP protocol, considering the latency, packet loss, and network congestion. Details: It is useful for assessing whether the available network bandwidth meets the requirements for the RDP session to perform smoothly.
Windows
rdp.udp_receive_rate
throughput_Bps
UDP receive rate: The rate in bits per second (bps) at which data is actually received over UDP.
Windows
rdp.udp_send_rate
throughput_Bps
UDP send rate: The rate in bits per second (bps) at which data is actually sent over UDP.
Windows
resolution
integer
Resolution: The total amount of pixels that compose the remote view. In case of published applications, it sums up all screens or windows attached to the session regardless of their aspect ratio. Details: This metric is only available while a client device is connected to the VDI session, for example, during active and connected session states.
Windows
start_time
datetime
Bucket start: The start time of the bucket.
state
enumeration
Session state: The state of the VDI session at the end of the bucket period, as reported by the OS. It provides context for troubleshooting and optimization use cases to understand the lifecycle state of the session, and whether there is a remote user connected. Details: Possible values:
active
connected
connect_query
shadow
disconnected
idle
list
reset
down
init
Windows
transport_protocol
string
Transport protocol: The underlying network-level protocol employed by the VDI vendor to facilitate communication, and to establish a session between the client and server.
Windows
user_input_delay
duration
User input delay: The user input delay, as reported by the VM's OS, for the application that responded most slowly to user interactions in the session. Details: Collector samples the worst (highest) user input delay every 3 seconds, and will expose the average value for the duration of the bucket event.
Windows
vm.agent_version
version
VM agent version: The version of the VDI agent application running within the VM that facilitates communication between the VM and the management infrastructure.
Windows
vm.cpu.context_switches
integer
Context switches: The amount of context switches per second normalised by the number of available logical processors. A context switch occurs when the CPU changes states during multitasking. Details: Depending on CPU usage, 1000-10000 switches per second may indicate CPU bottlenecks, but might also be typical under heavy workload. Exceeding 10000-14000 switches per second per available CPU often indicates excessive multitasking or contention for CPU resources.
Windows
vm.cpu.interrupt_usage
percentage
Interrupt usage: The average percentage of time the processor spends handling hardware interrupts. Interrupts have higher priority than applications and other tasks. A high value may indicate hardware or driver issues, or applications competing for shared hardware resources. Details: This value should generally remain below 2%. Values above 5% are considered high and often have a noticeable impact on user experience, such as input lag and reduced responsiveness.
Windows
vm.cpu.normalized_queue_length
float
Normalized queue length: The average amount of processes waiting to be executed per available CPU. Details: During normal operation, the queue length should remain under 2. A value of 5 or higher usually indicates noticable lag, unresponsiveness, and that the workload may benefit from a CPU with higher core count and stronger multi-threading capabilities.
Windows
vm.cpu.normalized_usage
percentage
Normalized usage: The average CPU usage during the selected time period, shown on a scale from 0 to 100 percent. It indicates how much of the time the CPU is busy. Details: Sustained values of 80-90% or higher indicate that the CPU is a bottleneck for the workload.
Windows
vm.cpu.usage
percentage
Usage: The average of the total CPU usage of all logical processors for the time period. The maximum value is 100% * number of logical processors available in the system. Details: Suitable for sizing purposes. For example, to see how many vCPUs are required for a specific workload.
Windows
vm.memory.available
bytes
Memory available: The amount of VM memory available, shown in bytes. Available memory includes both unused memory and standby memory used for caching.
Windows
vm.memory.cached
bytes
Memory cached: The amount of VM memory used for caching, shown in bytes. It reduces load times and improves overall system performance by allowing faster access to data without repeatedly retrieving it from slower storage devices. Details: Cache can be freed up if the OS or applications require more memory, therefore it is reported as part of the available memory.
Windows
vm.memory.installed
bytes
Memory installed: The amount of memory allocated for the VM, shown in bytes. Details: For VMs, it is the amount of memory allocated for the OS. It does not include the memory that is reserved by the hypervisor for memory-mapped I/O and other virtual hardware overhead.
Windows
vm.memory.non_paged_pool
bytes
Non paged pool: The amount of memory used by the VM's OS kernel and drivers that must remain in memory all the time. Details: For moderate workloads, 500MB-1GB paged pool memory size can be considered acceptable. A consistently increasing value can indicate a kernel or driver-level memory leak.
Windows
vm.memory.paged_pool
bytes
Paged pool: The amount of memory used by the VM's OS kernel and drivers that can potentially be written to storage if needed. Details: For moderate workloads, 500MB-1GB paged pool memory size can be considered acceptable. A consistently increasing value can indicate a kernel or driver-level memory leak.
Windows
vm.memory.pages_output_throughput
integer
Pages output: The amount of pages being written to the paging file per second. Values exceeding zero indicates periods when the VM's OS relies on the paging file to accomodate memory needs. Details: Continued frequent spikes can indicate that the memory is a bottleneck for running the given tasks. It can indicate periods of lower performance.
Windows
vm.memory.paging_file_size
bytes
Paging file size: The size of the paging file in bytes that the VM's OS can use to offload memory when freeing space from lower priority applications. It impacts the amount of available storage for other applications. Details: Although the value depends on the workload, using more than 5 GB of swap space for an extended period is generally considered excessive. As a best practice, storage should be able to temporarily accommodate swap space equal to the allocated VM memory to support heavier than usual workloads.
Windows
vm.memory.usage
percentage
Memory usage: The ratio of VM memory directly used by the OS and applications, shown in percentage. It does not include the memory used for caching. Details: It is recommended that the memory usage ratio does not exceed 80-85%. If it consistently reaches 90% or higher, immediate action may be required, such as optimizing the workload or allocating more memory to the environment.
Windows
vm.memory.used
bytes
Memory used: The amount of VM memory directly used by the OS and applications, shown in bytes.
Windows
vm.network.incoming_throughput
throughput_Bps
Incoming throughput: The total incoming throughput of all "physical" adapters of the VM, shown in bytes/second.
Windows
vm.network.outgoing_throughput
throughput_Bps
Outgoing throughput: The total outgoing throughput of all "physical" adapters of the VM, shown in bytes/second.
Windows
vm.system_disk.duration_with_average_queue_length
duration
Duration with average queue length: The time during which the average disk queue length of the VM system disk was between 1 and 2 in the selected time period.
Windows
vm.system_disk.duration_with_average_read_latency
duration
Duration with average read latency: The time during which the read latency of the VM system disk was between 1-5ms.
Windows
vm.system_disk.duration_with_average_write_latency
duration
Duration with average write latency: The time during which the write latency of the VM system disk was between 1-5ms.
Windows
vm.system_disk.duration_with_bad_queue_length
duration
Duration with bad queue length: The time during which the average disk queue length of the VM system disk was 2 or higher in the selected time period.
Windows
vm.system_disk.duration_with_bad_read_latency
duration
Duration with bad read latency: The time during which the read latency of the VM system disk was 5ms or higher.
Windows
vm.system_disk.duration_with_bad_write_latency
duration
Duration with bad write latency: The time during which the write latency of the VM system disk was 5ms or higher.
Windows
vm.system_disk.duration_with_good_queue_length
duration
Duration with good queue length: The time during which average disk queue length of the VM system disk was below 1 in the selected time period.
Windows
vm.system_disk.duration_with_good_read_latency
duration
Duration with good read latency: The time during which the read latency of the VM system disk was below 1ms.
Windows
vm.system_disk.duration_with_good_write_latency
duration
Duration with good write latency: The time during which the write latency of the VM system disk was below 1ms.
Windows
vm.system_disk.name
string
System disk name: The name of the storage device that contains the OS. Details: System disk name
Windows
vm.system_disk.queue_length
float
Disk queue length: The system disk queue length. It indicates the number of read/write requests waiting to access the system disk. A long queue length suggests that storage is overloaded, leading to slower response times, especially under peak load conditions, such as boot storms or login events. Details: If the queue length consistently exceeds 2 per disk, it can indicate that disk I/O is not meeting demand, potentially resulting in noticeable performance degradation for users.
Windows
vm.system_disk.read_iops
integer
Read operations: The number of system disk read operations per second. High values may indicate demanding workloads, but can also signal inefficient data access patterns or contention for disk resources. For similar workloads, low IOPS may indicate a storage performance bottleneck. Details: Task workers typically require lower IOPS, around 10-20 IOPS per user. Knowledge workers and more intensive workloads, such as graphics or multimedia users, may require around 50-100 IOPS per user. Boot and login storms can generate high read IOPS and may cause brief peaks well above these baseline values.
Windows
vm.system_disk.read_latency
duration
Read latency: The system disk read latency. A high latency can directly impact user experience, causing delays when opening applications, accessing files, or switching tasks. Details: While latency is heavily dependent on the type of used storage device, it is recommended to keep the average disk latency under 5 milliseconds, and below 10 milliseconds during peak time.
Windows
vm.system_disk.read_throughput
throughput_Bps
Read throughput: The system disk read throughput in bytes per second. It shows how quickly data is transferred from storage. High throughput indicates efficient data handling, beneficial for applications with large data loads, while low or fluctuating throughput can indicate bottlenecks, potentially due to insufficient storage resources or network issues. Details: As a reference:
20–50 MB/sec usually accommodates Task Workers with lighter application loads and file access.
50–100 MB/sec is suitable for Knowledge Workers who require faster access to more complex applications and data.
100+ MB/sec might be needed for Power Users and multimedia applications with large datasets or graphics processing.
Windows
vm.system_disk.write_iops
integer
Write operations: The number of system disk write operations per second. High values may indicate demanding workloads, but can also signal inefficient data access patterns or contention for disk resources. For similar workloads, low IOPS may indicate a storage performance bottleneck. Details: Task workers typically require lower IOPS, around 10-20 IOPS per user. Knowledge workers and more intensive workloads, such as graphics or multimedia users, may require around 50-100 IOPS per user. Boot and login storms can generate high read IOPS and may cause brief peaks well above these baseline values.
Windows
vm.system_disk.write_latency
duration
Write latency: The system disk write latency. A high latency can directly impact user experience, causing delays when opening applications, accessing files, or switching tasks. Details: While latency is heavily dependent on the type of used storage device, it is recommended to keep the average disk latency under 5 milliseconds, and below 10 milliseconds during peak time.
Windows
vm.system_disk.write_throughput
throughput_Bps
Write throughput: The system disk write throughput in bytes per second. It shows how quickly data is transferred to storage. High throughput indicates efficient data handling, beneficial for applications with large data loads, while low or fluctuating throughput can indicate bottlenecks, potentially due to insufficient storage resources or network issues. Details: As a reference:
20–50 MB/sec usually accommodates Task Workers with lighter application loads and file access.
50–100 MB/sec is suitable for Knowledge Workers who require faster access to more complex applications and data.
100+ MB/sec might be needed for Power Users and multimedia applications with large datasets or graphics processing.
Windows
vm.system_volume.capacity
bytes
Volume capacity: The allocated capacity of the system volume in bytes. The system volume is the logical partition of the VM storage device containing the bootable files necessary for the OS to initialize and start up.
Windows
vm.system_volume.free
bytes
Volume free: The amount of free bytes on the VM system volume. The system volume is the logical partition of the VM storage device containing the bootable files necessary for the OS to initialize and start up.
Windows
vm.system_volume.usage
percentage
Volume usage: The usage ratio of VM system volume in percentage. The system volume is the logical partition of the VM storage device containing the bootable files necessary for the OS to initialize and start up. Details: It is recommended to keep 15-20% free space on VDI system volumes to prevent performance bottlenecks, and therefore to keep usage under 80-85%.
Windows
Namespace software_metering
The software metering namespace contains a table that stores software usage to optimize licenses across an organization. This data is collected for the software meters configured in the system.
meter_configurations
meter_configuration
description
string
Description: The description of a software meter configuration. Details: Defined in the Software Metering configuration interface. You can change the description after creation.
license_type
enumeration
License type: The licensing model assigned to the software meter: user-based or device-based. Details: User-defined through Software metering configuration interface.
The license type of the software meter can be changed after creation.
name
string
Name: The name of a software meter configuration. Details: Defined in the Software Metering configuration interface. Software meter configurations are based on Application Objects. You can modify the software meter name after creation, and you should not use it as a unique identifier.
nql_id
string
NQL ID: The unique identifier of a software meter configuration. Details: NQL ID cannot be changed after initial creation.
events
event
events are punctual events.
events are associated to device, user, application, meter_configuration
context.location_geo_ip.country
string
Location geo IP -> Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location_geo_ip.site
string
Location geo IP -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location_geo_ip.state
string
Location geo IP -> Country subdivision location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location_geo_ip.type
string
Location geo IP -> Type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
desktop_execution_duration
duration
Execution duration - Desktop: The execution duration of the Desktop component. Requirements: The configured software meter should have a desktop part to be populated.
desktop_focus_time
duration
Focus time - Desktop: The time during which a window of the desktop application is in focus. Requirements:
Focus time needs to be enabled. The system disables it by default.
It applies only to software meters that include a desktop application.
end_time
datetime
Bucket end: The end time of the bucket. Details: Software metering uses weekly buckets starting at the beginning of the week (UTC).
start_time
datetime
Bucket start: The start time of the bucket. Details: Software metering uses weekly buckets starting at the beginning of the week (UTC).
web_focus_time
duration
Focus time - Web: The time during which a browser tab running the software is in focus. Requirements:
Web usage time needs to be enabled. The system enables it by default.
The configured software meter should have a web part to be populated.
How to enable web usage time metric Details: It is collected via the Nexthink browser plugin.
web_is_used
bool
Webpart usage indicator: Indicates whether the user accessed the software URL. Use this field when web usage time is disabled for web applications. Details: It is collected via the Nexthink Browser plugin.
Namespace usage
The list of all Usage. Requires permission 'View usage logs in NQL'
account_actions
The list of all logs associated to account actions.
account_actions are punctual events.
account_actions are associated to account
action
string
Action: Name of the action taken by the user
action_target
string
Action Target: Optional. Name of the Nexthink content that the action relates to
action_target_id
string
Action Target ID: Optional. Identifier of the Nexthink content that the action relates to
feature
string
Feature: Name of the feature in which the action was taken:
Search interface or name of the tab or secondary tab
module
enumeration
Module: Name of the Nexthink module being accessed. Supported values:
admin
ai_tools
alerts_and_diagnostics
amplify
applications
campaigns
collaboration_tools
desktop_virtualization
device_view
diagnostics
digital_experience
investigations
live_dashboards
my_account
nexthink_library
remote_actions
search
software_metering
spark
workflows
workspace
selection
string
Selection: Name of the selected item in the secondary menu or the name of dashboards, applications, investigations, campaigns, remote actions, etc.
subselection
string
Subselection: Name of the secondary selected item (optional).
time
datetime
Time: Time at which the action was initiated by the user
Namespace web
The web namespace contains tables that store events, errors, page views and transactions that occur in the business-critical services defined in the tables of the application namespace.
context_help_executions
End user interactions with the context help (opened or closed)
context_help_executions are punctual events.
context_help_executions are associated to binary, device, user, application, page
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Execution duration: Duration from when context help was opened until it was closed. Null for cases where context help was not closed
execution_id
string
Context help execution unique identifier: Unique identifier of the context help execution
language
string
Language: Either the value of the user’s browser language or the value of the underlying application’s language.
number_of_executions
integer
Number of executions: Used for calculating aggregated metrics (like count, etc) in NQL. The value for every event is always 1
status
enumeration
Type of execution: One of the two interaction options: open or close
time
datetime
Execution time: Time of the execution.
url
string
Context help execution URL: The URL where the interaction happened
errors
The table collecting errors of defined business-critical services.
errors are sampled events.
errors are associated to binary, device, user, application, page
adapter_type
enumeration
Adapter type: The type of adapter used when the error occurred. Possible values are:
WiFi
Ethernet
Bluetooth
Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
bucket_duration
duration
Bucket duration: The duration of the bucket.
code
integer
Error code: The extended HTTP response status. This is a numerical field denoting the code associated with the error, for example, 404, 401, 601. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
end_time
datetime
Bucket end: The end time of the bucket.
label
string
Error label: The error message as reported by the browser. The web browser reports a wide range of error types that the Nexthink browser extension catches and reports to the Nexthink instance, for example, HTTP 404, net::ERR_TIMED_OUT. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
number_of_errors
integer
Number of errors: The number of web errors recorded within the time bucket. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
start_time
datetime
Bucket start: The start time of the bucket.
url
string
URL: The navigation URL recorded when the error event happened. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
errors_summary
The table collecting errors of defined business-critical services up to 90d
errors_summary are sampled events.
errors_summary are associated to application, page
adapter_type
enumeration
Adapter type: The type of adapter used when the error occurred. Possible values are:
WiFi
Ethernet
Bluetooth
Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
bucket_duration
duration
Bucket duration: The duration of the bucket.
code
integer
Error code: The extended HTTP response status. This is a numerical field denoting the code associated with the error, for example, 404, 401, 601. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
end_time
datetime
Bucket end: The end time of the bucket.
label
string
Error label: The error message as reported by the browser. The web browser reports a wide range of error types that the Nexthink browser extension catches and reports to the Nexthink instance, for example, HTTP 404, net::ERR_TIMED_OUT. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
number_of_errors
integer
Number of errors: The number of web errors recorded within the time bucket. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
start_time
datetime
Bucket start: The start time of the bucket.
events
web.events represent periodic signals of active usage time while a user has a tab in focus, regardless of interaction type. They primarily measure engagement duration, with events generated every 30 seconds during continued usage, even in error states.
events are sampled events.
events are associated to binary, device, user, application, page
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Usage time: The time spent using the application or key page. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.. Details: The usage time includes both page load time and the time the employee is not interacting with the page at all, as long as the tab is focused. More info from the documentation
end_time
datetime
Bucket end: The end time of the bucket.
start_time
datetime
Bucket start: The start time of the bucket.
events_summary
The table collecting events of defined business-critical services up to 90d
events_summary are sampled events.
events_summary are associated to application, page
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Usage time: The time spent using the application or key page. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.. Details: The usage time includes both page load time and the time the employee is not interacting with the page at all, as long as the tab is focused. More info from the documentation
end_time
datetime
Bucket end: The end time of the bucket.
start_time
datetime
Bucket start: The start time of the bucket.
guide_executions
Represents a user interaction with a guide. It can be triggered when a guide is targeted (e.g. the guide is available for the user) or when a user interacts with the guide. In this case the status of the event is replaced with the latest status of targeted, started, completed or closed.
guide_executions are punctual events.
guide_executions are associated to binary, device, user, application, page, guide
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Guide duration: How long the guide was visible to the end user
engaged
enumeration
Guide engagement: Identifies whether the user engaged with the guide or not
execution_id
uuid
Guide execution unique identifier: Unique identifier of the guide execution.
language
string
Language: Either the value of the user’s browser language or the value of the underlying application’s language.
number_of_executions
integer
Number of executions: Used for calculating aggregated metrics (like count, etc) in NQL. The value for every event is always 1
status
enumeration
Guide execution status: Status of the guide execution. Can be targeted, started, completed or closed
targeting_count
integer
Guide targeting count: Used only for targeting purposes where we can see how many time the guide was targeted to the same users on that day on specific key page
time
datetime
Execution time: Time of the execution
trigger_method
enumeration
Guide trigger method: Represents the way the guide was triggered. Can be one of the following options: context-help - started manually from context help, auto-start - started automatically based on the rules, manual - used for tooltips when a user clicks on the hint icon, NA - when no information is available
trigger_source
string
Guide trigger source: A unique identifier that displays a human-readable string for specific interaction types, such as Action Button or Journey Name
url
string
Guide execution URL: The URL where the guide execution happened.
guide_step_executions
Represents user interactions with the guide steps. It can be triggered when a user closes or completes a step
guide_step_executions are punctual events.
guide_step_executions are associated to binary, device, user, application, page, guide, guide_step
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Guide step duration: How long the guide step was visible to the end user until it was closed or completed
engaged
enumeration
Guide step engagement: Identifies whether user engaged with the guide step or not
execution_id
uuid
Guide step execution unique identifier: Unique identifier of the guide step execution
language
string
Language: Either the value of the user’s browser language or the value of the underlying application’s language.
number_of_executions
integer
Number of executions: Used for calculating aggregated metrics (like count, etc) in NQL. The value for every event is always 1
status
enumeration
Guide step execution status: Status of a step execution. Can be completed when step is finished, or closed when a step is closed
time
datetime
Execution time: Time of the execution
url
string
Guide step execution URL: The URL on which the guide step was completed or closed
guide_step_interactions
Represents any type of user interaction with the step, for example which button was clicked.
guide_step_interactions are punctual events.
guide_step_interactions are associated to binary, device, user, application, page, guide, guide_step
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
execution_id
uuid
Guide execution unique identifier: Unique identifier of the guide execution
interaction_identifier
string
Guide step interaction identifier: Represents name of the interaction element, either label for action button or 'review' for the writing assistant. Value can be empty for some of the interactions such as close, completion triggers, etc
interaction_target
string
Guide step interaction target: Interaction target to identify the destination of a user interaction with a button within a Guide step, such as the workflow ID that is configured to be launched when a user clicks an Action Button. This can be empty for some interaction types.
interaction_type
enumeration
Guide step interaction type: Represents the type of interaction on the step which was performed.
language
string
Language: Either the value of the user’s browser language or the value of the underlying application’s language.
number_of_interactions
integer
Number of interactions: Used for calculating aggregated metrics (like count, etc) in NQL. The value for every event is always 1
time
datetime
Interaction time: Time of the interaction
url
string
Guide step interaction URL: The URL on which the interaction with guide step was executed
page_views
web.page_views capture navigations—i.e., when a user loads or switches to a new page within the application. A user can generate a single page view upon arrival, regardless of how long they remain on the page afterward.
page_views are sampled events.
page_views are associated to binary, device, user, application, page
adapter_type
enumeration
Adapter type: The type of adapter used when the navigation occurred. Possible values are:
WiFi
Ethernet
Bluetooth
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
detailed_page_load_time.connect
duration
Connect time: The time spent establishing TCP connection, including secure socket connection, if performed. The connect time metric provides insights into the latency and performance of the connection establishment process. That metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Note that this metric is not measured for every page view event or subsequent requests within a single browsing session. Once the TCP connection is established, subsequent requests can reuse the existing connection, which eliminates the need for the TCP handshake and reduces the overall latency. More info from the documentation
detailed_page_load_time.dom_content_loading
duration
DOM loaded time: The time it took for a webpage to finish creating its visual structure, known as the render tree. It starts when the necessary styles for the page, known as the CSS Object Model, are ready. The 'DOMContentLoaded' event is triggered before the complete loading of external resources such as images, stylesheets, and scripts. This means that once this event is completed, critical functionality and interactivity become available to users, even if additional resources are still loading in the background. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The timing metric associated with the 'DOMContentLoaded' event includes two properties: 'domContentLoadedEventStart' and 'domContentLoadedEventEnd.' These properties represent the start and end times of the render tree creation process. Optimizing the 'DOMContentLoaded' event can significantly improve the perceived performance of a webpage. Techniques to enhance this metric include minimizing render-blocking resources, lazy loading non-critical resources, optimizing JavaScript execution, and implementing resource caching. More info from the documentation
detailed_page_load_time.dom_processing
duration
DOM processing time: The time it takes for a webpage to finish building its structure and become fully interactive. This process is called constructing the Document Object Model (DOM).This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The complete state, represented by the 'domComplete' property, marks the point when the browser has fully constructed the DOM tree, including any dynamically generated or modified elements. It signifies the completion of the DOM processing phase. Optimizing DOM processing involves techniques like optimizing HTML structure, reducing DOM complexity, optimizing external resources, and improving JavaScript execution. Faster DOM processing leads to quicker rendering and interactivity, enhancing the overall user experience. More info from the documentation
detailed_page_load_time.domain_lookup
duration
DNS lookup time: The time spent on DNS resolution, for example, the time between the browser starting to resolve the domain name and when the resolution is complete. This metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Note that the this metric is not measured for every request. It is typically measured once per browsing session or connection. More info from the documentation
detailed_page_load_time.load_event
duration
Load event time: The time spent on the page load event. The load event is fired when all resources, including images, scripts, stylesheets, and subframes, have finished loading, and the webpage is fully rendered and ready for user interaction. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: When you visit a webpage, the browser needs to download and process various resources like images, scripts, stylesheets, and other elements. The 'loadEventStart' property indicates the point when the browser begins loading these resources.The 'loadEventEnd' property, on the other hand, represents the moment when the webpage has finished loading all the necessary resources and is fully displayed on the screen, ready for you to use. If the load event takes a long time to complete, it could indicate issues such as slow server response, large resource sizes, excessive JavaScript execution, or inefficient resource loading strategies. More info from the documentation
detailed_page_load_time.redirect
duration
Redirect time: The time spent on page redirections. If there are any redirects involved in the navigation, these properties indicate the start and end times of the redirect process. They measure the time taken to complete any HTTP redirects, which occur when a server responds to a request with a redirection status code. This metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Redirects could happen, for example, when a website has changed its URL or when certain content has been moved. More info from the documentation
detailed_page_load_time.request
duration
Request time: The time it takes to wait for the first byte of the document response. This is the time between when the browser starts requesting the document from the server, and when the browser receives the first by of the response from the server. This metric is the only contributor to the 'backend time' metric. Backend time is affected by various factors such as database queries, API calls, and processing time. A long backend time can indicate poor application design, inefficient database queries, or server overload. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.response
duration
Response time: The elapsed time between the first and last bytes of the response. It measures the efficiency of network communication and contributes to the 'network time' metric. Optimizing response time involves minimizing network latency, using data compression, implementing caching mechanisms, and reducing round trips. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.secure_connection
duration
TLS time: The time it takes to establish a secure socket connection (TLS handshake) between the browser and the webserver. This metric represents a part of the connection metric. Note that the this metric is not measured for every page view event or subsequent requests within a single browsing session. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.unload_event
duration
Unload event time: The time spent on the page unload event. An unload event is triggered when the user navigates away from the page or when the page is reloaded. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
domains_contacted
integer
Number of domains contacted: It indicates the number of unique domain names from which various resources (such as images, scripts, stylesheets, fonts, etc.) are being fetched. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: This metric indicates the level of domain diversity in terms of resource retrieval during the loading process of a web page. These domains can include the application's own domain, as well as domains for third-party resources like analytics scripts, ads, content delivery networks (CDNs), and more. Each unique domain contacted represents a separate server from which the browser needs to fetch resources, and this can impact overall page load times.
end_time
datetime
Bucket end: The date and time of the bucket end.
experience_level
enumeration
Experience level: The user experience level of a navigation evaluated by the extension, based on the defined thresholds. Possible values are:
good
average
frustrating
Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The thresholds are configured for each application through the application configuration menu. More info from the documentation
is_soft_navigation
bool
Soft navigation: It indicates whether a navigation is a hard navigation or soft navigation. Soft navigations refer to navigations within a single-page application, where the browser does not load a new page, as opposed to hard navigations where a webpage is initially loaded. Note that soft navigations are not collected by default and should be enabled on a per-application basis. Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
largest_resource_load_time
duration
Largest resource duration: It indicates the duration of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event, in seconds. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: When a user's browser needs to download and render large resources, it can lead to increased latency and slower page load times. By analyzing the number of large resources, you can identify files that may be optimized or compressed to reduce their size. This metric is collected through 'Performance Resource Timing' API.
largest_resource_size
bytes
Size of the largest resource: The size of the largest resource. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. This metric is collected through 'Performance Resource Timing' API.
largest_resource_type
string
Type of the largest resource: The type of the largest resource, e.g: 'stylesheet', 'script', 'image'. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. This metric is collected through 'Performance Resource Timing' API.
largest_resource_url
string
URL of the largest resource: It indicates the URL of the largest resource (such as images, scripts, stylesheets, or other files) during a navigation event. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. Note that resource URLs are sanitised using the sanitisation rules described in the online documentation . This metric is collected through 'Performance Resource Timing' API.
longest_resource_load_time
duration
Longest resource duration: It indicates the duration of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event, in seconds. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. If a specific resource takes a significantly longer time to load compared to others, it may affect the overall loading speed of your web application. Note that a page can be perceived as loaded even though some of the resources are being loaded in the background. For hard navigation measurements, we use "Navigation Timings API", which reports page load times for the main document. This is why, for some hard navigations, you can see an overall page load time reported to be shorter than the "longest resource load time". This metric is collected through the "Performance Resource Timing" API.
longest_resource_size
bytes
Size of the longest resource: The size of the longest resource. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. This metric is collected through 'Performance Resource Timing' API.
longest_resource_type
string
Type of the longest resource: The type of the longest resource, e.g: 'stylesheet', 'script', 'image'. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. This metric is collected through 'Performance Resource Timing' API.
longest_resource_url
string
URL of the longest resource: It indicates the URL of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: Note that resource URLs are sanitised using the sanitisation rules described in the online documentation . This metric is collected through 'Performance Resource Timing' API.
number_of_active_tabs
long
Number of active tabs: It indicates the number of open and active tabs of a browser. Users may experience web application slowness if this value is too large. This measurement is collected for every navigation and transaction event. Note that browsers offload or deactivate certain tabs over time to save memory. This metric presents the active tabs on a browser that are not offloaded or deactivated. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
number_of_large_resources
integer
Number of large resources: It indicates the number of resources (such as images, scripts, stylesheets, or other files) that are larger than 100KB, during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: When a browser needs to download and render large resources, it can lead to increased latency and slower page load times. By analyzing the number of large resources, you can identify files that may be optimized or compressed to reduce their size. This metric is collected through "Performance Resource Timing" API.
number_of_page_views
integer
Number of page views: The number of page views that took place within the time bucket. Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser.
number_of_resource_errors
integer
Number of resource errors: It indicates the number of resources (such as images, scripts, stylesheets, or other files) that failed to load or encountered errors during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Resource errors can indicate that some files or assets are missing from the web application. This may result in broken links, missing images, or non-functional scripts. This metric is collected through the "Performance Resource Timing" API.
number_of_resources
integer
Number of resources: It indicates the total number of resources (such as images, scripts, stylesheets, or other files) loaded during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The more resources a web page has, the longer it may take to load and render in the browser. By analyzing the number of resources, you can identify opportunities to optimize the performance of your web application. For example, you might consider minimizing or combining CSS and JavaScript files, compressing images, or using caching techniques to reduce the number of requests made to the server. This metric is collected through the "Performance Resource Timing" API.
page_load_time.backend
duration
Backend time: The estimated time spent on the backend side during a navigation. The backend time is affected by various factors such as database queries, API calls, and processing time. A long backend time can indicate poor application design, inefficient database queries or server overload. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
page_load_time.client
duration
Client time: The time taken by the client-side application, running on the device, to respond. It represents the portion of the total page load time that is not spent on network and backend, for example 'Client time' is 'Total page load time' minus 'Backend time' and 'Network time'. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: A long client time can indicate issues such as slow rendering of page elements, excessive JavaScript processing, inefficient CSS styling or device/OS processing other tasks. More info from the documentation
page_load_time.network
duration
Network time: The time it takes for a web request to travel over the network from client device to the server and for the server response to travel back. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: A long network time can indicate issues such as network congestion, poor server performance, or geographical distance between the server and the client. It is important to note that the network time can also be impacted by the size and complexity of the web page being loaded, as well as the geographical location of the server and the client device. More info from the documentation
page_load_time.overall
duration
Page load time: It indicates the time taken by a page to load. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
response_size
bytes
Response size: The size of the HTTP response.
start_time
datetime
Bucket start: The date and time of the bucket start.
url
string
URL: The navigation URL recorded when the page view event took place.
page_views_summary
Table collecting page views of defined business-critical services up to 90d
page_views_summary are sampled events.
page_views_summary are associated to application, page
adapter_type
enumeration
Adapter type: The type of adapter used when the navigation occurred. Possible values are:
WiFi
Ethernet
Bluetooth
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
detailed_page_load_time.connect
duration
Connect time: The time spent establishing TCP connection, including secure socket connection, if performed. The connect time metric provides insights into the latency and performance of the connection establishment process. That metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Note that this metric is not measured for every page view event or subsequent requests within a single browsing session. Once the TCP connection is established, subsequent requests can reuse the existing connection, which eliminates the need for the TCP handshake and reduces the overall latency. More info from the documentation
detailed_page_load_time.dom_content_loading
duration
DOM loaded time: The time it took for a webpage to finish creating its visual structure, known as the render tree. It starts when the necessary styles for the page, known as the CSS Object Model, are ready. The 'DOMContentLoaded' event is triggered before the complete loading of external resources such as images, stylesheets, and scripts. This means that once this event is completed, critical functionality and interactivity become available to users, even if additional resources are still loading in the background. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The timing metric associated with the 'DOMContentLoaded' event includes two properties: 'domContentLoadedEventStart' and 'domContentLoadedEventEnd.' These properties represent the start and end times of the render tree creation process. Optimizing the 'DOMContentLoaded' event can significantly improve the perceived performance of a webpage. Techniques to enhance this metric include minimizing render-blocking resources, lazy loading non-critical resources, optimizing JavaScript execution, and implementing resource caching. More info from the documentation
detailed_page_load_time.dom_processing
duration
DOM processing time: The time it takes for a webpage to finish building its structure and become fully interactive. This process is called constructing the Document Object Model (DOM).This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The complete state, represented by the 'domComplete' property, marks the point when the browser has fully constructed the DOM tree, including any dynamically generated or modified elements. It signifies the completion of the DOM processing phase. Optimizing DOM processing involves techniques like optimizing HTML structure, reducing DOM complexity, optimizing external resources, and improving JavaScript execution. Faster DOM processing leads to quicker rendering and interactivity, enhancing the overall user experience. More info from the documentation
detailed_page_load_time.domain_lookup
duration
DNS lookup time: The time spent on DNS resolution, for example, the time between the browser starting to resolve the domain name and when the resolution is complete. This metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Note that the this metric is not measured for every request. It is typically measured once per browsing session or connection. More info from the documentation
detailed_page_load_time.load_event
duration
Load event time: The time spent on the page load event. The load event is fired when all resources, including images, scripts, stylesheets, and subframes, have finished loading, and the webpage is fully rendered and ready for user interaction. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: When you visit a webpage, the browser needs to download and process various resources like images, scripts, stylesheets, and other elements. The 'loadEventStart' property indicates the point when the browser begins loading these resources.The 'loadEventEnd' property, on the other hand, represents the moment when the webpage has finished loading all the necessary resources and is fully displayed on the screen, ready for you to use. If the load event takes a long time to complete, it could indicate issues such as slow server response, large resource sizes, excessive JavaScript execution, or inefficient resource loading strategies. More info from the documentation
detailed_page_load_time.redirect
duration
Redirect time: The time spent on page redirections. If there are any redirects involved in the navigation, these properties indicate the start and end times of the redirect process. They measure the time taken to complete any HTTP redirects, which occur when a server responds to a request with a redirection status code. This metric contributes to the 'network time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Redirects could happen, for example, when a website has changed its URL or when certain content has been moved. More info from the documentation
detailed_page_load_time.request
duration
Request time: The time it takes to wait for the first byte of the document response. This is the time between when the browser starts requesting the document from the server, and when the browser receives the first by of the response from the server. This metric is the only contributor to the 'backend time' metric. Backend time is affected by various factors such as database queries, API calls, and processing time. A long backend time can indicate poor application design, inefficient database queries, or server overload. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.response
duration
Response time: The elapsed time between the first and last bytes of the response. It measures the efficiency of network communication and contributes to the 'network time' metric. Optimizing response time involves minimizing network latency, using data compression, implementing caching mechanisms, and reducing round trips. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.secure_connection
duration
TLS time: The time it takes to establish a secure socket connection (TLS handshake) between the browser and the webserver. This metric represents a part of the connection metric. Note that the this metric is not measured for every page view event or subsequent requests within a single browsing session. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
detailed_page_load_time.unload_event
duration
Unload event time: The time spent on the page unload event. An unload event is triggered when the user navigates away from the page or when the page is reloaded. This metric contributes to the 'client time' metric. Requirements: The metric is collected exclusively for hard navigations using the Navigation Timing API. The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
domains_contacted
integer
Number of domains contacted: It indicates the number of unique domain names from which various resources (such as images, scripts, stylesheets, fonts, etc.) are being fetched. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: This metric indicates the level of domain diversity in terms of resource retrieval during the loading process of a web page. These domains can include the application's own domain, as well as domains for third-party resources like analytics scripts, ads, content delivery networks (CDNs), and more. Each unique domain contacted represents a separate server from which the browser needs to fetch resources, and this can impact overall page load times.
end_time
datetime
Bucket end: The date and time of the bucket end.
experience_level
enumeration
Experience level: The user experience level of a navigation evaluated by the extension, based on the defined thresholds. Possible values are:
good
average
frustrating
Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The thresholds are configured for each application through the application configuration menu. More info from the documentation
is_soft_navigation
bool
Soft navigation: It indicates whether a navigation is a hard navigation or soft navigation. Soft navigations refer to navigations within a single-page application, where the browser does not load a new page, as opposed to hard navigations where a webpage is initially loaded. Note that soft navigations are not collected by default and should be enabled on a per-application basis. Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
largest_resource_load_time
duration
Largest resource duration: It indicates the duration of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event, in seconds. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: When a user's browser needs to download and render large resources, it can lead to increased latency and slower page load times. By analyzing the number of large resources, you can identify files that may be optimized or compressed to reduce their size. This metric is collected through 'Performance Resource Timing' API.
largest_resource_size
bytes
Size of the largest resource: The size of the largest resource. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. This metric is collected through 'Performance Resource Timing' API.
largest_resource_type
string
Type of the largest resource: The type of the largest resource, e.g: 'stylesheet', 'script', 'image'. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. This metric is collected through 'Performance Resource Timing' API.
largest_resource_url
string
URL of the largest resource: It indicates the URL of the largest resource (such as images, scripts, stylesheets, or other files) during a navigation event. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Largest resource' refers to the resource that had the biggest file size to be fully loaded while loading a web page. Note that resource URLs are sanitised using the sanitisation rules described in the online documentation . This metric is collected through 'Performance Resource Timing' API.
longest_resource_load_time
duration
Longest resource duration: It indicates the duration of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event, in seconds. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. If a specific resource takes a significantly longer time to load compared to others, it may affect the overall loading speed of your web application. Note that a page can be perceived as loaded even though some of the resources are being loaded in the background. For hard navigation measurements, we use "Navigation Timings API", which reports page load times for the main document. This is why, for some hard navigations, you can see an overall page load time reported to be shorter than the "longest resource load time". This metric is collected through the "Performance Resource Timing" API.
longest_resource_size
bytes
Size of the longest resource: The size of the longest resource. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. This metric is collected through 'Performance Resource Timing' API.
longest_resource_type
string
Type of the longest resource: The type of the longest resource, e.g: 'stylesheet', 'script', 'image'. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: 'Longest resource' refers to the resource that experienced the lengthiest loading time among all the necessary elements for rendering a web page. This metric is collected through 'Performance Resource Timing' API.
longest_resource_url
string
URL of the longest resource: It indicates the URL of the longest resource (such as images, scripts, stylesheets, or other files) during a navigation event. Requirements: Applications needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: Note that resource URLs are sanitised using the sanitisation rules described in the online documentation . This metric is collected through 'Performance Resource Timing' API.
number_of_active_tabs
long
Number of active tabs: It indicates the number of open and active tabs of a browser. Users may experience web application slowness if this value is too large. This measurement is collected for every navigation and transaction event. Note that browsers offload or deactivate certain tabs over time to save memory. This metric presents the active tabs on a browser that are not offloaded or deactivated. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
number_of_large_resources
integer
Number of large resources: It indicates the number of resources (such as images, scripts, stylesheets, or other files) that are larger than 100KB, during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: When a browser needs to download and render large resources, it can lead to increased latency and slower page load times. By analyzing the number of large resources, you can identify files that may be optimized or compressed to reduce their size. This metric is collected through "Performance Resource Timing" API.
number_of_page_views
integer
Number of page views: The number of page views that took place within the time bucket. Requirements: The applications need to be defined through the application configuration menu. The Nexthink browser extension needs to be installed on the browser.
number_of_resource_errors
integer
Number of resource errors: It indicates the number of resources (such as images, scripts, stylesheets, or other files) that failed to load or encountered errors during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: Resource errors can indicate that some files or assets are missing from the web application. This may result in broken links, missing images, or non-functional scripts. This metric is collected through the "Performance Resource Timing" API.
number_of_resources
integer
Number of resources: It indicates the total number of resources (such as images, scripts, stylesheets, or other files) loaded during a navigation event. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The more resources a web page has, the longer it may take to load and render in the browser. By analyzing the number of resources, you can identify opportunities to optimize the performance of your web application. For example, you might consider minimizing or combining CSS and JavaScript files, compressing images, or using caching techniques to reduce the number of requests made to the server. This metric is collected through the "Performance Resource Timing" API.
page_load_time.backend
duration
Backend time: The estimated time spent on the backend side during a navigation. The backend time is affected by various factors such as database queries, API calls, and processing time. A long backend time can indicate poor application design, inefficient database queries or server overload. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: More info from the documentation
page_load_time.client
duration
Client time: The time taken by the client-side application, running on the device, to respond. It represents the portion of the total page load time that is not spent on network and backend, for example 'Client time' is 'Total page load time' minus 'Backend time' and 'Network time'. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: A long client time can indicate issues such as slow rendering of page elements, excessive JavaScript processing, inefficient CSS styling or device/OS processing other tasks. More info from the documentation
page_load_time.network
duration
Network time: The time it takes for a web request to travel over the network from client device to the server and for the server response to travel back. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: A long network time can indicate issues such as network congestion, poor server performance, or geographical distance between the server and the client. It is important to note that the network time can also be impacted by the size and complexity of the web page being loaded, as well as the geographical location of the server and the client device. More info from the documentation
page_load_time.overall
duration
Page load time: It indicates the time taken by a page to load. Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser.
response_size
bytes
Response size: The size of the HTTP response.
start_time
datetime
Bucket start: The date and time of the bucket start.
transactions
The table collecting transactions of defined business-critical services.
transactions are sampled events.
transactions are associated to binary, device, user, application, transaction
adapter_type
enumeration
Adapter type: The type of adapter used when the transaction occurred. Possible values are:
WiFi
Ethernet
Bluetooth
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Transaction duration: The time it took for the transaction to complete.
end_time
datetime
Bucket end: The end time of the bucket.
experience_level
enumeration
Experience level: The user experience level of a transaction evaluated by the extension, based on the defined thresholds. Possible values are:
good
average
frustrating
Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The thresholds are configured for each application through the Applications configuration menu.
number_of_transactions
integer
Number of transactions: The number of transactions that took place within the time bucket.
start_time
datetime
Bucket start: The start time of the bucket.
status
enumeration
Status: The transaction status. Possible values are:
completed
time_out
aborted_unload
aborted_new
aborted_input
Requirements: Applications and transactions needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: The 'time_out' status is received when the end trigger was not received within 10 minutes. The 'aborted_unload' status is received when navigation to a new web application on the same tab takes place, or the tab was closed before the transaction was completed. The 'aborted_new' status is received when the transaction was aborted by the same, or another, transaction, i.e. when the detection restarts. The 'aborted_input' status is received when the detection was aborted by a user interaction.
transactions_summary
The table collecting transactions of defined business-critical services up to 90d
transactions_summary are sampled events.
transactions_summary are associated to application, transaction
adapter_type
enumeration
Adapter type: The type of adapter used when the transaction occurred. Possible values are:
WiFi
Ethernet
Bluetooth
bucket_duration
duration
Bucket duration: The duration of the bucket.
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration
duration
Transaction duration: The time it took for the transaction to complete.
end_time
datetime
Bucket end: The end time of the bucket.
experience_level
enumeration
Experience level: The user experience level of a transaction evaluated by the extension, based on the defined thresholds. Possible values are:
good
average
frustrating
Requirements: The applications need to be defined through the Applications configuration menu. The Nexthink browser extension needs to be installed on the browser. Details: The thresholds are configured for each application through the Applications configuration menu.
number_of_transactions
integer
Number of transactions: The number of transactions that took place within the time bucket.
start_time
datetime
Bucket start: The start time of the bucket.
status
enumeration
Status: The transaction status. Possible values are:
completed
time_out
aborted_unload
aborted_new
aborted_input
Requirements: Applications and transactions needs to be defined through the Applications configuration menu. Nexthink browser extension needs to be installed on the browser. Details: The 'time_out' status is received when the end trigger was not received within 10 minutes. The 'aborted_unload' status is received when navigation to a new web application on the same tab takes place, or the tab was closed before the transaction was completed. The 'aborted_new' status is received when the transaction was aborted by the same, or another, transaction, i.e. when the detection restarts. The 'aborted_input' status is received when the detection was aborted by a user interaction.
Namespace workflow
The workflows namespace consists of tables giving details about workflows, including configuration data and executions of workflows. Workflows are a dynamic and logical collection of Nexthink and 3rd party actions combined to deliver a multi-faceted solution.
workflows
workflow
name
string
Name: The name of the workflow. Details: The workflow name defined by the user in the workflow configuration page. The workflow name can be changed after the creation and should not be considered as a unique identifier.
nql_id
string
Workflow NQL ID: The unique identifier of a workflow. Details: The NQL ID cannot be changed after the initial creation.
executions
execution
executions are punctual events.
executions are associated to device, user, workflow
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
duration_seconds
duration
Execution Duration: The time taken to complete the workflow execution, measured in seconds. Details: Execution duration measures the time between the workflow execution start and end states.
execution_id
uuid
Execution ID: The unique identifier of the workflow execution. Details: The execution ID is a unique identifier generated at the start of each workflow execution.
external_reference
string
External reference: The identifier that references the external web application record targeted by the workflow execution Details: The external reference can contain values such as the ticket identifier of the ITSM ticket.
external_source
string
External source: Name of the external system, outside Nexthink, that triggered the workflow Details: The external source indicates the name of the external system that triggered the workflow, using either a Nexthink product or a direct API call.
inputs
string
Inputs: The list of workflow parameters provided at the time the workflow is triggered. Details: Workflow parameters are used by the workflow to influence the outcomes of actions and determine the logical path to follow.
internal_source
string
Internal source: The name of the Nexthink feature that triggered the workflow. Possible values: Amplify, Remote Action, Workflow, Investigation, Device view, or blank if not applicable.
number_of_executions
long
Number of executions: The number of times a specific workflow ran.
outcome
enumeration
Outcome: The functional outcome produced when the workflow reaches its end state. Details: Possible values:
unspecified
action_taken
no_action_taken
failed
other
outcome_details
string
Outcome details: The reason for reaching a specific workflow outcome. Details: The outcome details explain the result of a workflow execution
request_id
uuid
Request ID: The unique identifier of the request that created the workflow execution. Details: The request ID is generated and linked to individual workflow executions when a workflow is triggered against one or multiple targets. Use this field to group executions under the same trigger request.
request_time
datetime
Request time: The date and time when the workflow execution was triggered
status
enumeration
Completion status: Indicates how the workflow execution ended: Success means the run reached the End step. Details: Use the workflow status to monitor workflow execution failure. Possible values:
expired
in_progress
success
failure
cancelled
status_details
string
Status details: The last message returned by the workflow execution. Details: The status details field is typically populated only when the workflow execution encounters a problem. This field explains why the workflow execution was not completed successfully.
time
datetime
Last updated: The date and time the workflow execution was last updated.
trigger_method
enumeration
Trigger method: The trigger used to start the workflow execution Details: Possible values:
manual
null
scheduler
api
event
workflow_version
integer
Workflow version: The version of the workflow used for the execution. Details: The workflow version is always '1', it's a fixed value.
executions_summary
execution_summary
executions_summary are sampled events.
executions_summary are associated to workflow
context.location.country
string
Country location: Country where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.site
string
Location -> Site: Site where the device is located at the time of the event, determined by rule-based location.
context.location.state
string
State location: State where the device is located at the time of the event, determined by rule-based location or geolocation.
context.location.type
string
Location type: Type of device location (onsite or remote) at the time of the event, determined by rule-based location.
context.organization.entity
string
Organization -> Entity: Organizational entity of the device at the time of the event, determined by rule-based organization.
inputs
string
Inputs: The list of workflow parameters provided at the time the workflow is triggered Details: Workflow parameters are used by the workflow to influence the outcomes of actions and determine the logical path to follow.
number_of_executions
long
Number of executions: The number of times a specific workflow ran.
outcome
enumeration
Outcome: The functional outcome produced when the workflow reaches its end state. Details: Possible values:
unspecified
action_taken
no_action_taken
failed
other
outcome_details
string
Outcome details: The reason for reaching a specific workflow outcome. Details: The outcome details explain the result of a workflow execution.
status
enumeration
Completion status: Indicates how the workflow execution ended: Success means the run reached the End step. Details: Use the workflow status to monitor workflow execution failure. Possible values:
expired
in_progress
success
failure
cancelled
time
datetime
Time: The date and time when the workflow execution was last updated.
trigger_method
enumeration
Trigger method: The trigger that was used to start the workflow execution. Details: Possible values:
manual
null
scheduler
api
event
Last updated
Was this helpful?