Managing Remote Actions

Accessing the Manage remote actions page

To access the Remote Actions administration page:

Select Remote Actions > Manage remote actions.

Customizing built-in remote actions

Nexthink offers a set of preconfigured remote actions that you can manually install from Nexthink Library. Go to the Nexthink Library module within your Nexthink instance to install, manage, and update predefined remote actions.

Refer to Nexthink Library documentation for more information.

Creating custom remote actions

To create a new remote action:

Select Remote Actions from the main menu.
Click on the New button at the top of the navigation menu.

Alternatively, create a new remote action through the Administration page:

Select Remote Actions > Manage remote actions.
Click on the New remote action button in the top-right corner of the page.
Fill in all necessary information and click on the Save Remote Action button.

The New remote action page includes 2 configuration tabs to define the remote action.

General

Enter the name, NQL ID, description, triggering options, and purpose of the remote action.

Triggering

Select the triggering mechanisms for the remote action:

Manual: Trigger the remote action manually from the web interface.
API: Trigger the execution on selected devices via API.
Schedule: Trigger the execution using an NQL query at the scheduled time.

Purpose

Select the purpose for the remote action:

Data collection: The intent of the remote action is to collect data from the targeted device.
Remediation: The intent of the remote action is to perform an action on the targeted device.

Script

Import a remote action script for Windows and macOS platforms. Once imported, fill in the Parameters field, and the Outputs information appears. Use the Advanced Configuration option to select the context for executing the script, and the options available include local system, interactive user or service. To save the remote action, you must add a Windows PowerShell or macOS Bash script.

Windows and macOS

Import, export, or delete the scripts for Windows and/or macOS operating systems.

Note that library pack updates overwrite the existing script and all configurations of the remote action, requiring you to re-sign it after the update. For remote actions installed from the library and system remote actions, Nexthink recommends against making any modifications other than re-signing the script.

Parameters

You can specify up to 50 inputs required for the script's execution. You have the option to define a list of permitted parameter values and enable users to provide a custom value during execution.

Name: The name that appears to the user when the system asks for a parameter value.
Description: A meaningful description of the parameter.
Value: List of possible values for the parameter, one value per line. At least one value is required. The value on the first line is the default value option.
Allow the user to enter a custom value: Allow users to specify a custom parameter value other than those included in the list.

Outputs

Define up to 50 outputs of the remote action.

Name: The name that appears when the system displays remote action outputs in investigations and dashboards.
Description: A meaningful description of the output parameter.
Type: The data type of the parameter.

Advanced Configuration

Choose to run the script as a local system user (default), as an interactive user or as a service:

Local system user: Use this for tasks that require system rights, for example to uninstall software, or get the value of system information like drivers or registry keys.
Interactive user: Use this for actions executed for a specific user, like getting the size of their recycle bin, or closing an application using a campaign. If these were to be run as Local system user they would return the size of the system user recycle bin, or would try to close applications used by the system instead of the user logged into the device.
Service: Use this to configure the remote action to run within a dedicated service. For example, remote action can run on a Windows server (proxy) using a service account that has the necessary permissions to update Active Directory. Running as a service is only supported on Windows devices and requires the use of a Windows script (PowerShell). To use this feature, follow specific steps on the target device to create the service. In the service name field, you need to specify the value of the --service-name parameter used during service setup.

Set the time-out for the script (in seconds). If the remote action cannot complete its action within the allotted time the system will terminate the script.

Refer to the in-product documentation for more information. You can find it in the side panel menu.

:question_mark:

Remote actions table

The remote actions table lists all available remote actions.

The table is organized by:

Name: The name of the remote action.
Origin: An indication of where the remote action originates from:
- Custom: A remote action created within the Remote Actions module.
- Installed from Library: A remote action installed from the Nexthink Library module. You can configure the following fields:
  - Description
  - Triggering
  - Input Parameter Description
  - Input Parameter Value
  - Output Parameter Description
  - Custom Value
  - All fields in the Schedule tab Refer to the Nexthink Library documentation for more information on how to install a remote action.
- Copied from library: A remote action copied from the Nexthink Library module. You can fully edit copied remote actions to fit your needs. Refer to the Nexthink Library documentation for more information on how to create a copy of a remote action.
Tags: Displays the list of tags assigned to each remote action.
Platforms: The platform for which a remote action was designed.
Triggers: The trigger method used to configure a remote action with the following options:
- Manual: Trigger the remote action manually from the web interface, e.g., through Investigations or Device View.
- API: Trigger the execution on selected devices via API.
- Schedule: Trigger the execution using an NQL query on a recurring basis at a scheduled time.
Search field: A field that filters the table by searching for the name of a remote action.

Action menu

Select a relevant remote action and click over the action menu on the right side of the table to view:

Details: Open the execution details page.
Configure: Change the configuration of a library remote action.
Edit: Edit a selected remote action.
Edit tags: Create, assign, and edit remote action tags. Refer to the Tagging remote action section.
Share: Grant permissions to other users to view or edit a remote action. Refer to the Sharing a remote action section.
Copy NQL ID: Copy the NQL ID of a remote action for use by the API.
Export: Export a remote action to a JSON file.
Delete: Remove a remote action from the system.

Tagging remote actions

Create and associate tags with remote actions to quickly filter the results of the remote actions table.

A remote action can have a maximum of 10 tags associated with it.

Filtering with tags

Click the tags icon in the right-side menu to open the Tags panel.
Search for a specific tag at the top of the panel.
Select one or more tags to filter the remote actions table.

Creating and assigning tags

To add tags to a remote action:

Select Remote Actions > Manage remote actions.
Select a relevant remote action and hover over the action menu on the right side.
Click on the action menu icon and select Edit tags to open the Tags pop-up.
Enter a new name or search for the tag name in the Tags field.
Click on the tag action menu to change the color of the tag or delete it.

Click Save to add the tag to the remote action.

When you delete a tag, it is removed only from the remote action you have selected.

Sharing a remote action

Share a remote action with profiles and grant them appropriate permissions to view dashboards, make edits or execute remote actions. For example, you can share the Get Battery Status remote action with the Service desk profile that contains permissions to execute and view the remote action dashboard. Only users with the Manage All Remote Actions feature permission enabled can see the Share option. Refer to the Getting started with Remote Actions documentation for more information.

Hover over a remote action to reveal the action menu and select Share. The Share remote action modal opens.
In the Add profile text field, type in the user profiles you wish to share the remote action with.
From the Select permissions drop-down menu, select the appropriate permissions for the profile. The choices are:
- View dashboards: Access the remote action dashboards from the navigation panel and the remote actions table on the Overview page.
- Edit: Edit a remote action.
- Execute: Execute a remote action.
Click on Clear all to disable all permissions.
Click on the Grant permissions button to share the remote action.

Importing a remote action

To import a remote action from your hard drive:

Click on the Import button located at the top-right of the page to import a remote action. The valid file format is JSON.
Select the file from your hard drive and import it into the system. The file appears on the list of remote actions.

To import a remote action from Nexthink Library:

Click on the action menu located next to the Import button.
Select Nexthink library. The system redirects you to the library page with remote actions to download.
Import the downloaded file.

Executing remote actions on-demand

Run remote actions on-demand from the NQL query results on the Investigations page. This can be on a single target device, multiple devices, or all of them, depending on whether you have configured the remote action to allow multiple executions.

Select Investigations from the main menu.
Using the NQL editor, enter a query that returns a list of the devices you are interested in.
Click on the Run button to execute the query.
Select one or multiple devices on which you want to run the remote action, or select all of them using the checkbox at the top of the first column.

Selecting all devices

Example 1

An NQL query that returns all devices

devices

Example 2

An NQL query that returns a specific device

devices 
| where name == "Device-Name"
| list name

From the action bar, select Execute remote action. A modal appears with a list of available remote actions to choose from.
Select the remote action and click on the Execute button.

When running remote actions on a large number of devices, Nexthink recommends exporting the execution results, as the user interface limits the number of records displayed to 10,000.

Tracking remote action executions

Track all remote actions triggered from Amplify and filter the fields in the remote_action.executions table. To access the triggered remote action data, include these fields in the NQL query.

trigger_method: The trigger mode used to start the remote action execution.
internal_source: The Nexthink module used to trigger the remote action.
external_reference: The reference ID used to track the ticket.
external_source: The identifier of the external web application record in relation to the remote action was executed.

The table is organized based on the results of the NQL query executed in remote_action.executions.

Example 1

An NQL query that returns all triggered remote actions based on the internal_source

remote_action.executions during past 7d
| where internal_source == "Amplify"
| list remote_action.name , device.name , time , trigger_method , status

Example 2

An NQL query that returns all triggered remote actions based on the trigger_method.

remote_action.executions during past 7d
| where trigger_method == manual
| list remote_action.name , device.name , time , trigger_method , status

Querying remote actions with NQL

Refer to Remote Actions NQL examples for more information.