Overview

Nexthink is a cloud-based Digital Employee Experience (DEX) management platform. Its lightweight Collector agent runs on employee endpoints and continuously reports hardware, operating system, connectivity, and logged-in user telemetry back to the Nexthink cloud, where it can be queried with Nexthink Query Language (NQL).

Available Integrations

Why You Should Integrate

Integrating with Nexthink will provide insight into the endpoints running the Nexthink Collector, including their hardware identity, operating system, network addresses, and last logged-in user. Because the Collector is deployed to employee workstations, Nexthink is a useful source for confirming endpoint coverage and for finding devices that other management tools have missed.

How Does the Integration Work

This integration pulls Device objects from Nexthink using the NQL API. Rather than querying a fixed endpoint, the integration executes an NQL API query that you create and own in your own Nexthink instance, which means you control exactly which device attributes are shared with Aurora ASM.

The integration uses the NQL Export API so that large device populations can be retrieved in a single collection.

This data is only used internally; we do not share it with any parties outside of Arctic Wolf Networks. Refer to our privacy policy for details.

⚠️

This integration will not collect any data until you create the NQL API query described in the Creating the NQL API Query section below. Create the query before you configure the integration, because you will be asked for its Query ID during configuration.

Configuration

1. Configure the Access Schema

2. Add an Integration: Select the integration(s) you'd like to add.

• Collect devices

Device Settings

3. Configure General Information: OPTIONAL: You can use the following fields to provide additional information about your configuration.

4. Activate Config: Select "Activate" to enable this configuration and begin pulling data.

External Documentation

Creating credentials

Aurora ASM authenticates to Nexthink with an OAuth2 client ID and client secret issued by an API credential in your Nexthink instance. This link will step you through creating one.

When you select the permission scopes for the credential, grant it NQL access — Aurora ASM reads your devices through the NQL API.

Required Permissions

The API credential must be granted NQL access, which corresponds to the service:integration scope Aurora ASM requests when it authenticates.

The credential also needs visibility of the devices you want collected. If your Nexthink instance restricts credentials to specific hierarchies or entities, make sure the credential's scope covers every entity whose devices should appear in Aurora ASM — devices outside that scope will silently be absent from the results.

Creating the NQL API Query

This integration reads devices through an NQL API query that lives in your Nexthink instance. You must create it before configuring the integration — until the query exists, the integration collects nothing.

Nexthink's NQL API documentation will step you through creating an NQL API query. Two points are specific to Aurora ASM:

• Choose a Query ID you will recognize later, for example aurora_asm_devices. Nexthink does not allow the Query ID to be changed once the query is saved.
• Enter that Query ID in Aurora ASM with a leading # — for example, #aurora_asm_devices. The Nexthink interface displays the ID without the prefix, but the API requires it.

Use the following query:

devices
| list
    device.uid,
    device.name,
    device.distinguished_name,
    device.sid,
    device.operating_system.name,
    device.operating_system.platform,
    device.operating_system.architecture,
    device.operating_system.build,
    device.hardware.manufacturer,
    device.hardware.model,
    device.hardware.type,
    device.hardware.bios_serial_number,
    device.hardware.chassis_serial_number,
    device.hardware.machine_serial_number,
    device.hardware.memory,
    device.collector.version,
    device.collector.uid,
    device.collector.last_ip_address,
    device.public_ip.ip_address,
    device.connectivity.last_local_ip,
    device.first_seen,
    device.last_seen,
    device.entity,
    device.group_name,
    device.ad_site,
    device.login.last_login_user_name,
    device.location.country,
    device.location.site

You may narrow the query — for example, by filtering to a subset of entities — but do not remove device.uid, which Aurora ASM uses as the unique identifier for each device.

Collecting MAC Addresses (optional)

Nexthink's device model has no built-in MAC address attribute, so the query above does not return MAC addresses and Aurora ASM will not report any for Nexthink devices.

If your organization already tracks device MAC addresses in Nexthink through a custom field, Aurora ASM can pick them up. Add that custom field to the list clause of your NQL API query — for example, device.#mac_address — and Aurora ASM will read it, provided the following are true:

• The custom field's NQL ID contains mac_address. Aurora ASM maps any column in the query results whose name contains mac_address to the device's MAC addresses. A field with an NQL ID such as #mac_address or #primary_mac_address will be picked up; one named #hardware_address will not.
• The value holds one or more MAC addresses, separated by commas or semicolons. Values that are not valid MAC addresses are discarded.

How you populate the custom field is up to you — Nexthink supports CSV import, the Enrichment API, and workflows, among other methods. Refer to Nexthink's custom fields documentation for the options available in your instance.

API Documentation

• Nexthink NQL API Reference
• NQL API queries
• NQL data model

Contact Us

If you're having problems configuring an Integration, or if you've found something wrong in this document, please email us at [email protected].