NQL data model

Data model concepts

Consult the Understanding key data platform concepts page for more information about the various data model concepts.

This page does not include the dynamic data model, such as custom trends, custom fields or custom organizational classification, which is individual for each organization based on specific content and product configurations.

Data model tables

TableDescription

devices

Table of devices. A device is a physical or virtual machine monitored by Nexthink Collector.

device.antiviruses

The list of antivirus registered on the device and reported through WMI.

device.cpus

The list of CPU model names and their nominal clock speeds.

device.disks

The list of storage devices.

device.firewalls

The list of firewalls registered on the device and exposed through the Windows Security Center.

device.gpus

The graphics processing unit.

device.local_admins

The list of users and groups that are members of the local Administrators group on the device.

device.monitors

The list of monitors connected to the device.

device.volumes

The list of logical storage volumes.

binaries

Table of binaries. A binary is an executable binary file identified by its hash code.

users

Table of users. A user is an object that represents an individual user account on a device (local user) or multiple devices (domain user). The user account may identify a physical user or a system user.

alert.monitors

The table of defined alert monitors in the system.

alerts

The table collecting information about instances where metric values go outside normal parameters as defined in monitors.

alert.impacts

The table collecting information about instances of an alert impact.

applications

Table of defined applications.

application.network_applications

Table of defined network applications.

application.pages

Table of defined key pages.

application.transactions

Table of defined transactions.

campaigns

The table collecting all active and retired campaigns.

campaign.responses

The table collecting responses (expected or given) of a campaign by an employee.

collaboration.sessions

Table collecting meetings performed with collaboration tools such as Teams or Zoom.

connection.events

The connections.events table contains events for outgoing TCP connections and UPD packages. Some metrics are only available for TCP connections. These metrics are 'NULL' for UDP events. Connection events are associated to binaries, users, devices, and applications (optional).

connection.tcp_events

The connections.tcp_events table has been deprecated. Please use 'connection.events' table instead.

connection.udp_events

The connections.udp_events table has been deprecated. Please use 'connection.events' table instead.

connectivity.events

Table collecting performance metrics and attributes specific to a device's connectivity.

device_performance.boots

The table collecting boots of devices.

device_performance.events

The table collecting performance metrics and attributes specific to a device.

device_performance.hard_resets

The table contains hard resets, which occur when a device reboots without first completing the shutdown procedure. This could apply to situations where a device totally freezes up and can only be restarted by turning it off first, as well as situations involving power outages.

device_performance.system_crashes

The table collecting the system crashes of the devices.

dex.application_scores

application_score

dex.scores

A table of the DEX score.

execution.crashes

The table collecting crashes of a running process.

execution.events

The table collecting performance metrics and attributes specific to a process execution.

packages

A table of packages. A package is a group of files and executables that together constitute a software application.

package.installations

A table of package installation events.

package.uninstallations

A table of package uninstallation events.

package.installed_packages

A table of all installed packages on all devices.

platform.audit_logs

The list of all the events audited on the Infinity platform. Requires permission 'View audit logs in NQL'

platform.custom_trends_logs

The list of all logs associated to custom trends computations. Requires permission 'View platform logs in NQL'.

platform.data_export_logs

data_export_log

remote_actions

The table of defined remote actions.

remote_action.executions

The table collecting the executed remote actions.

remote_action.executions_summary

The table collecting the trend of executed remote actions.

services

A table of services. A service performs automated tasks, respond to hardware events, or listen for data requests from other software. These services are often loaded automatically at startup, and run in the background, without user interaction

service.changes

Timeline of events when an attribute of an existing service has changed on a device. The attributes tracked by these events are the same as in the installed_services table. Eg. logon_as & startup_type.

service.installations

Punctual event, indicating when an service was added or removed to a particular device.

service.installed_services

A table of all installed services on all devices.

session.connects

The table collecting connections linked to user sessions.

session.disconnects

The table collecting disconnections linked to user sessions.

session.events

The table collecting performance metrics and attributes specific to both local and remote sessions.

session.lifecycle_events

The table collecting all events linked to user sessions.

session.locks

The table collecting locks linked to the user sessions.

session.logins

The table collecting all session logins.

session.logouts

The table collecting all session logouts.

session.unlocks

The table collecting unlocks linked to user sessions.

software_metering.meter_configurations

meter_configuration

software_metering.events

event

web.errors

The table collecting errors of defined business-critical services.

web.errors_summary

The table collecting errors of defined business-critical services up to 90d

web.events

The table collecting events of defined business-critical services.

web.events_summary

The table collecting events of defined business-critical services up to 90d

web.page_views

Table collecting page views of defined business-critical services.

web.page_views_summary

Table collecting page views of defined business-critical services up to 90d

web.transactions

The table collecting transactions of defined business-critical services.

web.transactions_summary

The table collecting transactions of defined business-critical services up to 90d

workflows

workflow

workflow.executions

execution

workflow.executions_summary

execution_summary

Namespace device

The device namespace includes one large devices table, which has multiple fields referring to device properties such as hardware, operating system and also Nexthink Collector.

devices

Table of devices. A device is a physical or virtual machine monitored by Nexthink Collector.

FieldTypeDescriptionSupported platforms

ad_site

string

AD site: Indicates the site to which the device is assigned to in Active Directory (AD). Details: In case the device is not part of a domain, the value shows as "-".

Windows macOS

boot.days_since_last_full_boot

integer

Days since last full boot: The number of days since the device last boot following a restart or a complete shutdown.

Windows macOS

boot.last_full_boot_duration

duration

Last full boot duration: The duration of the device last boot following a restart or a complete shutdown.

Windows

boot.last_full_boot_time

datetime

Last full boot time: The date and time of the device last boot following a restart or a complete shutdown.

Windows macOS

collector.last_update_status

string

Collector last update status: The last update status received from a specific Collector instance.

Windows macOS

collector.last_update_status_date

datetime

Collector last update status date: The reception date of the last update status for a specific Collector instance.

Windows macOS

collector.local_ip

ipAddress

Collector local IP: The local IP used for the traffic between the endpoint and the Nexthink Instance.

Windows macOS

collector.tag_id

integer

Collector tag: The configurable number that identifies a group of Collector instances. The tag is useful for defining the entities to build hierarchies. Details: An optional field that must be an integer number between 0 and 2147483647. Could complement the Collector string tag.

collector.tag_string

string

Collector string tag: The configurable label that identifies a group of Collector instances. The string tag is useful for defining the entities to build hierarchies. Details: An optional field, with a maximum length of 2048 characters. Could complement the Collector tag.

Windows macOS

collector.target_update_date

datetime

Collector target update date: The date when the devices install the target version.

Windows macOS

collector.target_version

version

Collector target version: The version to which all Collector instances update next.

Windows macOS

collector.uid

uuid

UID: The Collector unique identifier, provided using the UUID format.

collector.update_group

string

Collector update group: For scheduling separate waves of Collector updates, the devices are assigned to one of the available update groups.Possible values:

  • Pilot

  • Main

  • Unsupported OS

Details: By default, 10% of all the Collector instances are assigned to the Pilot update group. The Pilot group starts updating two days after a new Collector version is available. The Main group starts updates 14 days after the Pilot group.

Windows macOS

collector.version

version

Collector version: Indicates the version of the Collector instance installed on the device.

Windows macOS

connectivity.last_connectivity_type

enumeration

Connectivity type: Last type of network adapter used. Possible values are:

  • WiFi

  • Ethernet

  • Bluetooth

Windows macOS

connectivity.last_local_ip

ipAddress

Local IP: The last local IP address for the primary physical network adapter of the device.

Windows macOS

days_since_first_seen

integer

Days since first seen: The number of days since the first time the device was seen by the Nexthink instance.

Windows macOS

days_since_last_seen

integer

Days since last seen: The number of days since the last time the device was seen active by the Nexthink instance.

Windows macOS

distinguished_name

string

Distinguished name: The unique identifier of a device when joined to a domain or workgroup. Details: Shows as "-" when the device is not part of a domain or workgroup.

Windows macOS

entity

string

Entity: A customizable field used for organizing a group of devices into logical groups.

Windows macOS

first_seen

datetime

First seen: The date and time the device was first seen by the Nexthink instance.

Windows macOS

group_name

string

Group name: The name of the security group containing the device when joined to a domain or workgroup.

Windows

hardware.bios_serial_number

string

BIOS serial number: The serial number of the motherboard. Details: On macOS, this is the same as the chassis serial number.

Windows macOS

hardware.chassis_serial_number

string

Chassis serial number: The chassis serial number. Details: On macOS, this is the same as the BIOS serial number.

Windows macOS

hardware.machine_serial_number

string

Machine serial number: The unique serial number of the device in a UUID format.

Windows macOS

hardware.manufacturer

string

Manufacturer: The short name of the device manufacturer. Details: While devices might natively report slight variations of it, for example, sometimes dependent on the model or year of introduction, the information is simplified to ensure consistency across different devices of the same manufacturer.

Windows macOS

hardware.memory

bytes

Installed memory: The total amount of random-access memory (RAM) installed on the device.

Windows macOS

hardware.model

string

Device model: The model of the device. Details: On Windows, it is provided by the device manufacturer using the WMI interface as the product name. On macOS it is the "model id" provided by System Profiler.

Windows macOS

hardware.product_id

string

Product ID: A variant of a specific device model, sometimes also referred to as the SKU number. Details: Provided by the device manufacturer through the WMI interface as the SKUNumber.

Windows

hardware.product_line

string

Product line: The product line or hardware version information. Details: Provided by the device manufacturer through the WMI interface as the product version.

Windows macOS

hardware.type

enumeration

Device type: The device form factor:

  • desktop

  • laptop

  • virtual

Details: The Windows devices are considered to be a laptop if they have a "lid closed" sensor. For macOS this information comes from the device model.

Windows macOS

last_seen

datetime

Last seen: The date and time of the last device activity received by the Nexthink instance.

Windows macOS

license_type

enumeration

License type: The type of license used for this device. Possible values:

  • endpoint

  • server

  • thin_client

Windows macOS

location.country

string

Country: The country where the device is located.

Windows macOS

location.site

string

Site: Custom-defined identifier (office, city, ...) where the device is located.

Windows macOS

location.state

string

State: The subdivision (for example, state) where the device is located.

Windows macOS

location.type

string

Location type: The type of location indicates whether the device is onsite or remote.

Windows macOS

login.last_login_user_name

string

Last logged in user: The name of the user associated to the last login on the device.

Windows macOS

membership_type

enumeration

Membership type: The type of computer group membership. Possible values:

  • standalone

  • workgroup

  • domain

  • open directory

Details: Possible values:

  • domain

  • workgroup

  • standalone

  • open directoryWhen not available, shows as "-".

Windows

name

string

Name: The name of the device as used by the operating system for identification purposes on the local network. Details: Source:

  • For Windows: NetBios Name

  • For macOS: LocalHostName

Windows macOS

operating_system.architecture

enumeration

Architecture: The architecture of the device operating system. The instruction set it can natively execute. Details: Possible values:

  • x86

  • x64

  • ARM64

Windows macOS

operating_system.build

version

Build: The build number of the operating system. Details: The build number is set to "0.0.0.0" if the Collector version is incompatible or the data is not yet available.

Windows

operating_system.days_since_last_update

integer

Days since last system update: The number of days since the last system update.

Windows

operating_system.is_activated

bool

Is activated: The Windows license activation status. Details: macOS does not require a license since OSX 10.9 Mavericks (released in 2013), and shows as "-".

Windows

operating_system.last_update

datetime

Last system update: The date and time of the last system update.

Windows

operating_system.name

string

Name: The combination of the name, version and architecture (when applicable) of the operating system. Details: The operating system name is set to "Unknown" if the name or version cannot be retrieved or mapped to a valid value.

Windows macOS

operating_system.platform

enumeration

Platform: The software platform composed of a collection of operating system families providing access to the same objects, activities, events and properties. Details: Possible values are:

  • Windows

  • macOS

  • Linux

Windows macOS

operating_system.wmi_status

enumeration

WMI status (deprecated): This field is deprecated and will be replaced in the future. Details: The status of the WMI extension Collector relies on for device identification. Used internally to mitigate potential transient issues with this particular WMI source.

Windows

organization.entity

string

Entity: The organizational entity to which the device belongs.

public_ip.city

string

City: The city where the device is located.

Windows macOS

public_ip.country

string

Country: The country where the device is located.

Windows macOS

public_ip.ip_address

ipAddress

Public IP address: The public IP address of the device.

Windows macOS

public_ip.isp

string

ISP: The internet service provider of the device.

Windows macOS

public_ip.state

string

State: The subdivision (for example, state) where the device is located.

Windows macOS

sid

string

SID: The Security Identifier (SID) of the device, often used for identification and permission control purposes.

Windows

uid

uuid

Device UID: Unique identifier of the device.

Windows macOS

user_account_control_status

enumeration

User account control status: Indicates if the User Account Control (UAC) is configured, forcing applications to request explicit approval from the user to make changes to the computer or to run with elevated permissions. Details: Possible values:

  • ok (apps ask for approval)

  • at risk

  • unknown

virtualization.desktop_broker

enumeration

Desktop broker: Name of the desktop virtualization product used to broker the remote desktop connections.

Windows

virtualization.desktop_pool

string

Desktop pool name: The hardware characteristics of the associated virtual machines.

Windows

virtualization.disk_image

string

Disk image: Name of the disk image used to deploy the virtual machine.

Windows

virtualization.environment_name

string

Environment name: Name of the connector used to retrieve the virtualization details.

Windows

virtualization.hostname

string

Virtualization hostname: The physical device on which the virtual machine is hosted.

Windows

virtualization.hypervisor_name

string

Hypervisor name: The hardware virtualization system running the virtual machine.

Windows

virtualization.instance_size

string

Instance size: A predefined configuration that determines the CPU, memory and storage which is allocated to a virtual machine.

Windows

virtualization.last_update

datetime

Last update: Date and time when the desktop virtualization information was last updated.

Windows

virtualization.region

string

Region: Geographical areas where one or more Microsoft Azure data centers are located.

Windows

virtualization.type

enumeration

Desktop pool type: The type of the desktop pool. Possible values are:

  • shared, several users work on the same virtual machine at the same time

  • personal, the virtual machine is used by one user at a time and all changes to the system persist

  • pooled, the device is used by one user at a time and during the logoff all changes including documents and data are erased.

Windows

antiviruses

The list of antivirus registered on the device and reported through WMI.

FieldTypeDescriptionSupported platforms

is_up_to_date

enumeration

Up to date: The up-to-date status of the antivirus. Possible values are:

  • yes

  • no

  • not_reported

  • not_applicable

Windows

name

string

Name: The name of the main antivirus.

Windows

real_time_protection

enumeration

Real-time protection: The status of the antivirus real time protection (RTP). Possible values are:

  • not_reported: incompatible Collector version or the data is not yet available

  • enabled: : indicates that the RTP is active

  • disabled: indicates that either the RTP is inactive or the antivirus is not detected

  • partially_enabled

  • not_applicable

Windows

cpus

The list of CPU model names and their nominal clock speeds.

FieldTypeDescriptionSupported platforms

frequency

integer

CPU frequency: The CPU base frequency in MHz. The base frequency can be much smaller than the maximum turbo frequency. For example, the Intel Core i7-8565U CPU has a base frequency of 1.80 GHz and a maximum frequency of 4.6 GHz.

Windows macOS

name

string

CPU name: The CPU model.

Windows macOS

number_of_cores

integer

Number of cores: The number of CPU cores.

Windows macOS

number_of_logical_processors

integer

Number of logical processors: The number of CPU cores multiplied by the number of threads that can run on each core using hyperthreading.

Windows macOS

disks

The list of storage devices.

FieldTypeDescriptionSupported platforms

capacity

bytes

Capacity: The disk capacity. Details: The metric is displayed in units based on the binary system. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.

Windows macOS

is_bootable

bool

Is bootable: Returns the value "yes" when the device boots from that disk.

Windows macOS

name

string

Name: The name of the physical or virtual disk drive.

Windows macOS

type

enumeration

Type: The type of drive. Possible values are:

  • HDD

  • SSD

  • Other

Windows macOS

firewalls

The list of firewalls registered on the device and exposed through the Windows Security Center.

FieldTypeDescriptionSupported platforms

name

string

Name: The name of the main firewall.

Windows

real_time_protection

enumeration

Real-time protection: The status of the firewall real time protection (RTP). Possible values are:

  • not_reported: incompatible Collector version or the data is not yet available

  • enabled: indicates that RTP is active

  • disabled: indicates that either RTP isn’t active or no antivirus has been detected

  • partially_enabled

  • not_applicable

Windows

gpus

The graphics processing unit.

FieldTypeDescriptionSupported platforms

memory

bytes

Memory: The video memory in bytes.

Windows

name

string

Name: The graphics card name.

Windows

local_admins

The list of users and groups that are members of the local Administrators group on the device.

FieldTypeDescriptionSupported platforms

name

string

Name: The users who are members of the local Administrators group on the device.

Windows

type

enumeration

Type: The type of the user. Possible values are:

  • user

  • group

Windows

monitors

The list of monitors connected to the device.

FieldTypeDescriptionSupported platforms

diagonal_size

float

Diagonal size: The diagonal size in inches.

Windows

horizontal_resolution

integer

Horizontal resolution: The maximum horizontal resolution in pixels.

Windows

name

string

Name: The monitor name.

Windows

serial_number

string

Serial number: The monitor serial number.

Windows

vendor

string

Vendor: The monitor vendor.

Windows

vertical_resolution

integer

Vertical resolution: The maximum vertical resolution in pixels.

Windows

volumes

The list of logical storage volumes.

FieldTypeDescriptionSupported platforms

capacity

bytes

Capacity: The volume capacity in bytes. Details: The metric is displayed in units based on the binary system. For example, 1024 MB corresponds to 1 GB. Windows follows the same convention, while macOS displays data volume based on the decimal system. This might result in a difference of approximately 7.4% when comparing values reported by Nexthink and macOS.

Windows macOS

name

string

Name: The name of the volume.

Windows macOS

system

bool

Operating system volume: Returns the value "yes" when the volume contains the operating system.

Windows macOS

usage

float

Usage: The volume usage in percent.

Windows macOS

Namespace binary

Table of binaries. A binary is an executable binary file identified by its hash code.

binaries

Table of binaries. A binary is an executable binary file identified by its hash code.

FieldTypeDescriptionSupported platforms

architecture

enumeration

Architecture: The operating system architecture the binary is compiled for (32-bit or 64-bit).

Windows macOS

company

string

Company: The name of the company that produced the binary. Details: Information retrieved from the file properties.

Windows macOS

description

string

Description: Used for describing the purpose of the binary or to complement it with additional details. Details: Description is generated by AI.

Windows macOS

first_seen

datetime

First seen: The date and time the binary was first seen by the Nexthink instance.

Windows macOS

has_user_interface

bool

Has user interface: Indicates if the binary has an interactive window while running. Details: On Windows platform the reported value is 'true', or 'false' if the binary has no interactive window or if the information is not available. Any other platform is always NULL.

Windows

last_seen

datetime

Last seen: The date and time of the last binary activity received by the Nexthink instance.

Windows macOS

md5_hash

bytea

MD5 hash: The MD5 fingerprint calculated by the Collector instance, that can be used to uniquely identify a binary. Details: The MD5 hash represented in base64 format.

Windows macOS

md5_hash_hex

bytea

MD5 hash hex: The MD5 fingerprint calculated by the Collector instance, that can be used to uniquely identify a binary. Details: The MD5 hash represented in hex format.

Windows macOS

name

string

Name: The file name of the binary.

Windows macOS

platform

enumeration

Platform: The operating system family on which the binary natively runs. Details: Possible values are:

  • Windows

  • macOS

  • Linux

Windows macOS

product_category

string

Product category: Category is a broad, general classification of similar products. Details: Category is generated by AI.

Windows macOS

product_name

string

Product name: The name of the application associated with the file. Details: Information retrieved from the file properties.

Windows macOS

product_subcategory

string

Product subcategory: Subcategory is a more specific classification or subdivision within a larger category. Details: Subcategory is generated by AI.

Windows macOS

sha-1_hash

bytea

SHA-1 hash: The SHA-1 fingerprint calculated by the Collector instance that can be used to uniquely identify a binary. Details: The SHA-1 hash represented in base64 format.

Windows macOS

sha-1_hash_hex

bytea

SHA-1 hash hex: The SHA-1 fingerprint calculated by the Collector instance, that can be used to uniquely identify a binary. Details: The SHA-1 hash represented in hex format.

Windows macOS

sha-256_hash

bytea

SHA-256 hash: The SHA-256 fingerprint calculated by the Collector instance that can be used to uniquely identify a binary. Details: The SHA-256 hash represented in base64 format.

Windows macOS

sha-256_hash_hex

bytea

SHA-256 hash hex: The SHA-256 fingerprint calculated by the Collector instance, that can be used to uniquely identify a binary. Details: The SHA-256 hash represented in hex format.

Windows macOS

size

bytes

Size: The size of the binary file, in bytes.

Windows macOS

uid

uuid

Binary UID: The unique identifier for the binary.

Windows macOS

version

version

Version: The version of the binary file, retrieved from the file properties.

Windows macOS

Namespace user

The users table within the user namespace, includes information about the individual accounts across the IT infrastructure. It contains all employees recognized by your Nexthink instance. Most of the table fields are derived from Entra ID and are included in the "ad" grouping. A user may have access to more than one device.

users

Table of users. A user is an object that represents an individual user account on a device (local user) or multiple devices (domain user). The user account may identify a physical user or a system user.

FieldTypeDescriptionSupported platforms

ad.city

string

City: The name of the city the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.country_code

string

Country code: The country or region the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: The country or region is represented as a two-character code based on the ISO-3166 standard. Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.department

string

Department: The name of the department the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.distinguished_name

string

Distinguished name: The unique identifier of a domain user for an on-premises Active Directory (AD). Requirements: Requires one or more connectors for Entra ID correctly configured, and Entra ID needs to be synchronized with an on-premises AD. Details: The distinguished name follows the LDAP syntax. Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.email_address

string

Email address: The email address of the user. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.full_name

string

Full name: The name displayed in the address book for the user. This is usually the combination of the user first name, middle initial and last name. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.job_title

string

Job title: The job title assigned to the user in Active Directory. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.last_update

datetime

Last update: The date and time of the last update received for the user information from Entra ID.

Windows macOS

ad.office

string

Office: The name of the physical location or office the user is associated with. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.organizational_unit

string

Organizational unit name: The name of the directory folder containing the user account. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

ad.username

string

AD Username: The name of the user account as it appears in Entra ID. Requirements: Requires one or more connectors for Entra ID correctly configured. Details: Please be aware this field may contain information unrelated to its original purpose, depending on how the connector for Entra ID is configured.

Windows macOS

days_since_first_seen

integer

Days since first seen: The number of days since the first time the user account was seen by the Nexthink instance.

Windows macOS

days_since_last_seen

integer

Days since last seen: The number of days since the last time the user account was seen active by the Nexthink instance.

Windows macOS

first_seen

datetime

First seen: The date and time the user account was first seen by the Nexthink instance.

Windows macOS

last_seen

datetime

Last seen: The date and time of the last user account activity received by the Nexthink instance.

Windows macOS

name

string

Username: The name of the user account on the local device. Requirements: The collector is configured to report the username: Configuring Collector level anonymization Details: Depending on the configuration, the Collector reports username in cleartext, as a hashed value or not at all.

Windows macOS

sid

string

SID: The unique security identifier (SID) of the user account on Windows. Details: On Windows, each user account has a unique security identifier (SID) used to provide access to system resources. On macOS, a unique SID is generated by Nexthink to facilitate user identification.

Windows macOS

type

enumeration

Type: The type of the user account. Details: Nexthink recognizes three types of user accounts:

  • A local user account is an account that only exists on a single device. It cannot be used to login to systems other than that specific device.

  • A domain user account is a user account managed by Microsoft Active Directory, enabling users to log in across various devices and access multiple services.

  • A system account is a form of a local account that has special privileges on a device.

Windows macOS

uid

uuid

User UID: The value that uniquely identifies a user on the Nexthink platform.

Windows macOS

upn

string

UPN: The User Principal Name (UPN), a unique identifier for a user account Requirements: The Collector reports the UPN for Active Directory and Microsoft Entra ID user accounts on Windows, and for mobile and Jamf Connect-linked local user accounts on macOS. Nexthink does not report UPNs for system accounts or local accounts (without Jamf Connect for macOS). The collector must be configured to report the UPN: Configuring Collector level anonymization Details: The User Principal Names (UPN) is a standardized identifier for users (RFC822). Normally, it takes the form of an email address. The UPN allows to uniquely identify a user across systems, for example, devices with different OS platforms. Nexthink uses the UPN to enrich user objects with data from third-party services. If the Collector cannot retrieve the UPN for a user, the UPN is NULL (displayed as “-”) and the upn_privacy_level is set to no_import (independent from the Collector configuration).

Windows macOS

upn_privacy_level

enumeration

UPN privacy level: Indicates how securely the User Principal Name (UPN) is stored by the Nexthink instance. Requirements: The collector is configured to report the UPN: Configuring Collector level anonymization Details: The User Principal Name (UPN) privacy level is a Collector configuration parameter on the user device. Depending on the configuration, the Collector reports UPN in cleartext, as a hashed value or not at all. The options are represented by the following values:

  • cleartext

  • hashed

  • no_import

Windows macOS

Namespace alert

The alert namespace consists of two tables: alerts and monitors. Monitors store sets of rules configured by Nexthink users (monitor name, threshold, priority, etc.), describing acceptable limits for metrics. Alerts store information about instances where metric values go outside normal parameters as defined in monitors. You may want to query the alerts table if you have permission to run investigations but are not allowed to access alerts dashboards or when creating dashboards for reporting.

monitors

The table of defined alert monitors in the system.

FieldTypeDescriptionSupported platforms

comparison_operator

enumeration

Comparison operator: Determines when a monitor should trigger an alert. Details: It is one of the key elements used to define the conditions within a monitor in order to trigger an alert. It is specifically utilized when setting up the breaching criteria for the primary metric. A comparison operator allows for the comparison of values to determine if the specified condition is met. Possible values are:

  • at_least

  • less_or_equal

multiple_contexts

bool

Multiple-context: Indicates if the monitor triggers alerts with different contexts. Details: The value is set to "Yes" when NQL has a "group by" clause.

name

string

Monitor name: The assigned name of a configured monitor. Details: A monitor is a defined set of metrics and conditions used to continuously observe a system or process and trigger an alert when certain criteria are met. The name of the custom monitor can be changed after creation. Do not consider it as a unique identifier.

nql_id

string

NQL ID: The unique NQL identifier of the monitor. Details: NQL ID cannot be changed after initial creation.

origin

enumeration

Monitor origin: Indicates where the monitor originates from. Monitors can be built-in to the Nexthink platform (system), installed using a library pack (library) or created manually (custom)

priority

enumeration

Priority: The importance of alerts that are triggered by the monitor. Details: Possible values are:

  • critical

  • high

  • medium

  • low

defined by the user in the monitor configuration.

status

enumeration

Status: The status of the monitor as set in the "Manage monitors". Details: Possible values are:

  • active

  • deleted

tags

jsonArrayString

Alert tags: List of user-defined labels that are assigned to a monitor and subsequently utilized for filtering alerts that are generated by the monitor. Details: Tags are created and specified within the monitor configuration. By assigning tags to monitors, users can categorize and organize monitors based on specific criteria, making it easier to filter and manage alerts based on these tags. Up to 10 custom tags are allowed per monitor.

threshold

float

Threshold: It defines the value of the primary metric that must be exceeded for the monitor to trigger an alert. Details: The threshold value serves as a reference point against which the metric actual value is compared to determine if it breaches the defined condition and triggers an alert.

thresholds

jsonArrayString

Thresholds: It contains the values of all metrics that need to be breached to trigger an alert.

type

enumeration

Monitor type: The chosen method used for monitoring. It identifies the specific approach employed to observe and evaluate the system or process being monitored. Details: Possible values are:

  • metric_threshold

  • metric_change

alerts

The table collecting information about instances where metric values go outside normal parameters as defined in monitors.

alerts are punctual events.

alerts are associated to user, device, monitor

FieldTypeDescriptionSupported platforms

context

jsonArrayString

Context: The relevant information needed to understand alert. Details: Depending on the alert, the context information may contain the name of the binary, device or user associated with the alert. It is the JSON-formatted payload of the alert.

context.location.country

string

Country: The country in which the device is located at the time of the event.

context.location.state

string

State: The state in which the device is located at the time of the event.

context.location.type

string

Type: The type of location indicates whether the device is onsite or remote at the time of the event.

context.organization.entity

string

Entity: The organizational entity of the event.

context_hash

string

Context hash: The unique fingerprint of the alert context. Details: The fingerprint is created by calculating an MD5 hash context.

duration

duration

Alert duration: The duration when the alert is active. Details: It is calculated as the time between the trigger and the recovery if the alert is closed, or between the trigger and now if the alert is open.

is_auto_recovery

bool

Auto-recovery: Indicates if the alert was auto-recovered. Details: Auto-recovery takes place when there are no events recorded for the metric(s) specified in the monitor configuration within the selected timeframe. Yes, if the alert is auto-recovered

is_grouped

bool

Group alert: It represents a situation where too many alerts have been generated by a single monitor at the same time. The monitor will not generate any more alerts until the situation has been resolved.

number_of_alerts

long

Number of alerts: The number of alerts triggered.

recovery_reference_value

float

Recovery reference value: It contains the reference value of the main (first) monitored metric that is checked to recover an alert.

recovery_time

datetime

Recovery time: Contains the date and time at which the alert was recovered.

recovery_value

float

Recovery value: The value of the metric that caused the alert to be recovered. Equal to the first metric value if more than one trigger condition is defined.

recovery_values

jsonArrayString

Recovery values: The lists of values of all the monitored metrics reported when the alert has recovered.

status

enumeration

Status: The status of the alert event. The status can be open or closed. Details:

  • Open: the alert is currently active.

  • Closed: the alert has been recovered.

time

datetime

Alert time: Alert bucket time.

trigger_reference_value

float

Trigger reference value: The reference value of the metric against which the current value was compared to trigger the alert.

trigger_time

datetime

Trigger time: The date and time when the alert was raised.

trigger_value

float

Trigger value: The value of the metric that bypassed the threshold defined in the monitor configuration and caused the alert to be raised. Details: Equal to the first metric value if more than one trigger condition is defined

trigger_values

jsonArrayString

Trigger values: The values of the metrics that bypassed the thresholds defined in the monitor configuration and caused the alert to be raised.

uid

uuid

Alert event UUID: The unique identifier of the alert event.

impacts

The table collecting information about instances of an alert impact.

impacts are punctual events.

impacts are associated to user, device, monitor

FieldTypeDescriptionSupported platforms

alert_uid

uuid

Associated alert event UUID: The unique identifier of the associated alert event.

context.location.country

string

Country: The country in which the device is located at the time of the event.

context.location.state

string

State: The state in which the device is located at the time of the event.

context.location.type

string

Type: The type of location indicates whether the device is onsite or remote at the time of the event.

context.organization.entity

string

Entity: The organizational entity of the event.

duration

duration

Impact duration: The duration of the impact. Details: It is calculated as the time between the "from_time" and the "to_time" if there is more than one trigger, or between the "from_time" and now if there is only one trigger.

from_time

datetime

Impact from: Impact from

to_time

datetime

Impact to: Impact to

Namespace application

The application namespace contains a set of tables that store information about business-critical services configured by Nexthink users in the Application module. The tables include configuration data such as the name and ID of each application, as well as defined key pages and transactions. These tables can be queried alongside associated tables to help identify issues with business-critical services.

applications

Table of defined applications.

FieldTypeDescriptionSupported platforms

category

enumeration

Category: The category of the application. We have three categories, collaboration, connectivity and standard. Requirements: The applications need to be defined through the application configuration menu. Details: Connectivity applications (for example VPN, ZTNA, XDR) will be highlighted in the device view, to correlate their activity with any employee connectivity issues. Collaboration applications (for example Teams, Zoom) will be displayed in device view timeline under Collaboration section. Any other application falls under the Standard category. Applications are assigned the 'Standard' category by default, users can select the 'Connectivity' or 'Collaboration' category when applicable. More info from the documentation

name

string

Name: The name of the web, desktop or hybrid application. Requirements: The applications need to be defined through the Applications configuration menu. Details: More info from the documentation

network_applications

Table of defined network applications.

FieldTypeDescriptionSupported platforms

category

enumeration

Category: The category of the network application. We have three categories, collaboration, connectivity and standard. Requirements: The network applications need to be defined through the application configuration menu. Details: Connectivity applications (for example VPN, ZTNA, XDR) will be highlighted in the device view, to correlate their activity with any employee connectivity issues. Collaboration applications (for example Teams, Zoom) will be displayed in device view timeline under Collaboration section. Any other application falls under the Standard category. Applications are assigned the 'Standard' category by default, users can select the 'Connectivity' or 'Collaboration' category when applicable. More info from the documentation

name

string

Name: The name of the network application. Requirements: The network applications need to be defined through the Applications configuration menu. Details: More info from the documentation

pages

Table of defined key pages.

FieldTypeDescriptionSupported platforms

name

string

Name: The name of the key page defined for a web application. Key pages divide a web application into functionally relevant parts based on URL patterns. Requirements: The key pages need to be defined through the application configuration menu. Details: More info from the documentation

transactions

Table of defined transactions.

FieldTypeDescriptionSupported platforms

name

string

Name: The name of the transaction defined for a web application. A transaction is an employee action or event in a web application that creates business value for the company. Requirements: The transactions need to be defined through the application configuration menu. Details: More info from the documentation

Namespace campaign

The campaign namespace consists of two tables. The campaign table stores information about campaigns configured by Nexthink users (such as campaign id, name, trigger method, etc.). The responses table collects all responses to campaigns. It indicates whether the employee declined or postponed the campaign or how many questions they answered.

campaigns

The table collecting all active and retired campaigns.

FieldTypeDescriptionSupported platforms

name

string

Name: The name of a campaign. Details: User defined through the Campaigns user interface or Finder For Infinity campaigns, only configured campaigns in the state published and retired are available in the data model. The name of the campaign can be changed after its creation and should not be considered as a unique identifier.

nql_id

string

NQL ID: The unique identifier of a campaign. Details: The NQL ID cannot be changed after its initial creation.

priority

enumeration

Priority: The configured priority of the campaign. Details: The campaign priority influences which employee protection rules are applied: urgent campaign bypass the do-not-disturb rules unlike normal campaigns. Possible values:

  • urgent

  • normal

status

enumeration

Status: The current status of the campaign. Details: Possible values:

  • draft - a campaign in creation that has not been finalized yet

  • published - an active campaign that can currently collect responses from employees

  • retired - a campaign that was active but has now been retire and cannot collect new responses

  • Only published campaign can be triggered, and only published and retired campaigns can have responses. Refer to the campaign.responses table for details.

trigger_method

enumeration

Trigger: The possible ways of triggering the campaign. Details: Possible values:

  • manual - triggered from an investigation results for one or more employees

  • investigation (Classic campaigns only) - triggered automatically based on an investigation that is evaluated regularly

  • schedule - triggered automatically based on an investigation that is evaluated regularly

  • remediation - triggered within a remote action script

  • api - triggered via a call to the Campaign API

  • workflow - triggered from a Nexthink Workflow

  • Campaigns with trigger type remediation do not have their responses available.

responses

The table collecting responses (expected or given) of a campaign by an employee.

responses are punctual events.

responses are associated to user, device, campaign

FieldTypeDescriptionSupported platforms

answers

string

Answers: The campaign answers (details and values) given by the employee. Details: The answers are structured as a JSON object that includes, for each answered question. Inspecting answers of a given campaign is best performed using the dynamic data model: for each campaign, you can use fields of campaign.nql_id.responses.answers.nql_id to inspect the answer type, the answer labels and the free-text comment.

context.location.country

string

Country: The country in which the device is located at the time of the event.

context.location.state

string

State: The state in which the device is located at the time of the event.

context.location.type

string

Type: The type of location indicates whether the device is onsite or remote at the time of the event.

displayed_language

enumeration

Displayed language: The language in which the content of a multilingual campaign was shown to the employee. Details: Applicable only to multilingual campaigns. Possible values:

  • not_applicable, for campaigns without multiple languages activated or not answered yet

  • language name (english, french, etc.), once the campaign has been answered

expiry_date

datetime

Expiry Date: Show the expiry date and time of an employee campaign request.

first_displayed

datetime

First displayed time [Local]: The date and time at which the employee saw the campaign for the first time, adjusted to your local time.

first_planned

datetime

First planned time [Local]: The date and time at which the campaign is set to the planned state first, adjusted to your local time.

first_targeted

datetime

First targeted time [Local]: The date and time at which the campaign is set to the targeted state first, adjusted to your local time.

historical_state

jsonArrayString

Historical states: It describes the historical state updates for an employee campaign response. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.

historical_state_details

jsonArrayString

Historical state details: The historical state details updates for an employee campaign response, as an array sorted chronologically. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.

historical_time

jsonArrayString

Historical times: The historical update times for an employee campaign response, as an array sorted chronologically. Details: The times are sorted chronologically. Used in conjunction, historical states, historical state details and historical times allow to understand the lifecycle of a campaign response.

number_of_answered_questions

integer

Number of answered questions: The number of questions answered by the employee.

parameters

string

Parameters: It indicates the value of all campaign parameters as defined when triggering this campaign response.

request_id

string

Request ID: The unique identifier generated at the time the user was targeted for that campaign. Details: The request ID is the unique identifier for a campaign response. The same user may have different requests with different request ID if the user was targeted several times for the same campaign. When triggering an API campaign, the request ID is returned in the API response and can be stored for later inspection of the campaign answers.

state

enumeration

State: It describes the current state of the campaign response by a user (expected or actual). Details: Possible values:

  • planned - the campaign sent to a user who was online and pending display