Remote Actions NQL examples

This list of NQL examples is designed to help you execute remote actions on demand. Go through the queries below and pick the one most similar to your use case, copy it, and adjust it accordingly.

Return all devices.

devices

Return a specific device.

devices 
| where name == "Device-Name"
| list name

Return all remote action executions in the system and sort them from the newest to the oldest.

remote_action.executions
|list remote_action.name, device.name, trigger_method ,time, status, status_details, outputs
|sort time desc

Return executions of a specific remote action in the last hour sorted from newest to oldest.

Replace Remote-Action-Name with the name of the remote action you are looking for.

remote_action.executions during past 60min
|where remote_action.name == "Remote-Action-Name"
|list remote_action.name, device.name, trigger_method, time, status, status_details, outputs
|sort time desc

Return remote action executions for a specific device in the last hour sorted from newest to oldest.

Replace Device-Name with the name of the device you are looking for.

remote_action.executions during past 60min
|where device.name == "Device-Name" 
|list remote_action.name, device.name, trigger_method, time, status, status_details, outputs
|sort time desc

Get the values from the last successful execution of a remote action, for example: #Get_Battery_Status.

devices during past 7d
| list remote_action.get_battery_status.execution.outputs.BatteryHealth

Return the battery health status of the windows device.

remote_action.get_battery_status.executions 
| list device.name, outputs.BatteryHealth

Return all triggered remote actions for a specific internal source.

remote_action.executions during past 7d
| where internal_source == "Amplify"
| list remote_action.name , device.name , time , trigger_method , status

Return all triggered remote actions for a specific trigger method.

remote_action.executions during past 7d
| where trigger_method == manual
| list remote_action.name , device.name , time , trigger_method , status