Predefined NQL

remote_action.executions during past 30d
| summarize Total_RA_Executions = count() by 1d
| sort start_time desc

remote_action.executions_summary during past 30d
| where status == success
| summarize Successful_Exections_Remote_Actions = count() by 1d
| sort start_time desc

remote_action.executions_summary during past 30d
| where status == failure
| summarize Failing_Exections_Remote_Actions = count() by 1d
| sort start_time desc

remote_action.executions
| where status == success
| summarize Remote_Action_Executions = count() by purpose

remote_action.executions_summary
| summarize Executed_RAs = remote_action.nql_id.count() by trigger_method
| sort Executed_RAs desc

remote_action.executions
| summarize Remote_Action_Executions = nql_id.count() by source

remote_action.executions_summary
| summarize Executions = count() by remote_action.name
| sort Executions desc

devices | include remote_action.executions during past 30d
| compute Executed_RAs = number_of_executions.sum() , total_devices = device.name.count()
| summarize Percentage_of_RAs_Per_Device = total_devices.sum() / executed_ras.sum() *100

users | include web.page_views during past 30d
| where application.name == "Nexthink Infinity Transition" and url == "*sup/device*"
| compute Count_Users_device_view = user.name.count()
| include web.events during past 30d
| where application.name == "Nexthink Infinity Transition"
| compute Count_Users_Web_Interface = user.name.count()
| summarize Percentage_of_Users_Accessing_Device_View = (Count_Users_device_view.sum() / Count_Users_Web_Interface.sum()) * 100

users | include web.page_views during past 30d
| where application.name == "Nexthink Infinity Transition" and url == "*/diagnostic/*"
| compute Count_Users_diag = user.name.count()
| include web.events during past 30d
| where application.name == "Nexthink Infinity Transition"
| compute Count_Users_Web_Interface = user.name.count()
| summarize Percentage_of_Users_Accessing_Diagnostics = (Count_Users_diag.sum() / Count_Users_Web_Interface.sum()) * 100

users
| include web.page_views during past 30d
| where application.name == "Nexthink Infinity Transition" and url == "*/dash/dashboards/*"
| compute Count_Users_live_dash = user.name.count()
| include web.events during past 30d
| where application.name == "Nexthink Infinity Transition"
| compute Count_Users_Web_Interface = user.name.count()
| summarize Percentage_of_Users_Accessing_Live_Dashboards = (Count_Users_live_dash.sum() / Count_Users_Web_Interface.sum()) * 100

users
| include web.page_views during past 30d
| where (application.name == "Nexthink Infinity Transition" and url == "*inv/run*")
| compute Count_Users_Inv_ = user.name.count()
| include web.events during past 30d
| where application.name == "Nexthink Infinity Transition"
| compute Count_Users_Web_Interface = user.name.count()
| summarize Percentage_of_Users_Running_Investigatons = (Count_Users_Inv_.sum() / Count_Users_Web_Interface.sum()) * 100

users | include web.page_views during past 30d
| where application.name == "Nexthink Infinity Transition" and url == "*checklists*"
| compute Count_Users_checklists = user.name.count()
| include web.events during past 30d
| where application.name == "Nexthink Infinity Transition"
| compute Count_Users_Web_Interface = user.name.count()
| summarize Percentage_of_Users_Working_with_Checklists = (Count_Users_checklists.sum() / Count_Users_Web_Interface.sum()) * 100

device_performance.events
| where system_drive_free_space.avg <= 10GB
| summarize Number_Of_Devices_With_Less_Than_10GB = device.name.count()

disks
| summarize Number_Of_Disks_By_Type = count() by type

device_performance.events
| summarize AVG_System_Driver_Free_Space = system_drive_free_space.avg()

devices
| with dex.scores
| where endpoint.boot_speed_value <= 30
| summarize Number_Of_Devices_With_Poor_DEX_Boot_Value = device.name.count()

execution.crashes during past 7d
| where binary.name == "outlook.exe"
| where number_of_crashes >= 1
| summarize no_of_devices = device.count() by binary.version

execution.events during past 7d
| where binary.name == "outlook.exe"
| where number_of_freezes >= 1
| summarize no_of_devices = device.count() by binary.version

execution.crashes during past 7d
| where binary.name == "teams.exe"
| where number_of_crashes >= 1
| summarize no_of_devices = device.count() by binary.version

execution.crashes during past 7d
| where binary.name == "teams.exe"
| where number_of_crashes >= 1
| summarize no_of_devices = device.count() by binary.version

execution.events
| where binary.product_name != "*Operating System*"
| summarize Executions_ = count(), Devices_ = device.count(),
incoming_traffic_ = incoming_traffic.sum() by binary.name, binary.product_name, binary.platform
| sort incoming_traffic_ desc

execution.events
| where binary.product_name != "*Operating System*"
| summarize Executions_ = count(), Devices_ = device.count(), outgoing_traffic_ = outgoing_traffic.sum() by binary.name, binary.product_name, binary.platform
| sort outgoing_traffic_ desc

execution.events during past 24h
| where operating_system.name != "*server*" and product_name !in ["*windows*"]
| where number_of_freezes >= 5
| summarize no_of_devices = device.name.count()

execution.events during past 24h
| where operating_system.name != "*server*" and product_name !in ["*windows*"]
| where number_of_freezes >= 5
| summarize no_of_devices = device.name.count()

execution.crashes during past 7d
| summarize device_Count_ = device.name.count() by 1d
| list start_time, end_time, device_Count_
| sort start_time asc

execution.events during past 7d
| where number_of_freezes >= 1
| summarize device_Count_ = device.name.count() by 1d
| list start_time, end_time, device_Count_
| sort start_time asc

execution.crashes during past 7d
| summarize device_Count_ = device.name.count() by 1d
| list start_time, end_time, device_Count_
| sort start_time asc

session.logins
| where operating_system.platform == Windows and operating_system.name != "*server*"
| summarize desktop_ready = time_until_desktop_is_ready.avg() by device.hardware.model

session.logins
| where operating_system.platform == Windows and operating_system.name != "*server*" and time_until_desktop_is_ready > 180s
| summarize desktop_ready = time_until_desktop_is_ready.avg() by device.hardware.model

device_performance.boots
| where operating_system.platform == Windows and operating_system.name != "*server*"
| summarize boot_duration = duration.avg() by device.hardware.model
| sort boot_duration desc

devices
| where remote_action.get_battery_status.execution.outputs.BatteryHealth.rating == poor
| summarize battery_health_ = device.name.count() by hardware.model
| sort battery_health_ desc

dex.scores during past 30d
| summarize endpoint_score = endpoint.value.avg() by device.hardware.model
| list device.hardware.model, endpoint_score
| sort endpoint_score desc

session.logins
| where operating_system.platform == Windows and operating_system.name != "*server*"
| summarize desktop_visible = time_until_desktop_is_visible.avg() by device.hardware.model
| sort desktop_visible desc

devices
| with device_performance.events during past 7d
| where context.os_name != "*server*"
| compute cpu_percentage_usage = normalized_cpu_usage.avg()
| where cpu_percentage_usage >= 50
| summarize Device_Count_ = device.name.count() by hardware.model
| sort Device_Count_ desc

devices during past 7d
| summarize Device_Count = count() by hardware.manufacturer
| sort Device_Count desc

devices during past 7d
| summarize Device_Count = count() by hardware.model
| sort Device_Count desc

devices during past 7d
| summarize Device_Count = count() by operating_system.name, operating_system.build
| sort Device_Count desc

devices during past 7d
| summarize Device_Count = count() by public_ip.country, public_ip.state, public_ip.city, public_ip.isp
| sort public_ip.country desc

device_performance.boots
| where operating_system.platform == Windows and operating_system.name != "*server*"
| summarize boot_duration = duration.avg() by device.hardware.model
| sort boot_duration desc