| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nos.win.check-app-cpu-usage\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the amount of CPU resources being used by the primary process and secondary process of the application.\n\n |
| \n\nos.win.check-app-memory-usage\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the amount of memory being used by the primary process and secondary process of the application.\n\n |
| \n\nos.win.check-app-last-access-time\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the most recent time when the application was executed or run.**Note:**\n\n- This check definition doesn't require the application to be in a running state.\n- If the application hasn't been run within the last 7 days, the last access time is empty.\n- If the application's process path changes within 7 days \\(which can occur during app updates\\), the last access time is empty until you run the app again.\n- To modify the 7-day retention policy, you can change the registry path in the following way:\n - Registry Key: \"HKEY\\_LOCAL\\_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\BAM\"\n - Registry Name: \"UserSettingsLifetimeMs\"\n - Registry Type: REG\\_DWORD \\(32-bit value\\)\n - Registry Value: Duration in milliseconds\n\n |
| \n\nos.win.check-app-last-updated\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the time and date of the latest application update installation.\n\n |
| \n\nos.win.check-app-crashes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves crash rate of the application.\n\n This check definition supports applications that emit a Window Error Reporting \\(WER\\) events \\(event id = 1000\\) on crashing.\n\n**Note:** This check definition doesn't require the application to be running.\n\n |
| \n\nos.win.check.app.freezes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves freeze rate of the application in the last 5 minutes.\n\n This check definition supports applications that emit a Window Error Reporting \\(WER\\) events \\(event id = 1001 or 1002\\) on freezing.\n\n**Note:** This check definition doesn't require the application to be running.\n\n |
| \n\nos.win.check-app-uptime\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nChecks the uptime of the given application.\n\n |
| \n\nos.win.check-app-incoming-network-bytes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n- sleep\\_time =<Duration of time from now for which you must calculate the average incoming network byte/sec>\n\n | \n\nRetrieves the incoming network bytes of an application for IPv4 and IPv6 networks.\n\n |
| \n\nos.win.check-app-outgoing-network-bytes\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n- sleep\\_time =<Duration of time from now for which you must calculate the average incoming network byte/sec>\n\n | \n\nRetrieves the outgoing network bytes of an application for IPv4 and IPv6 networks.\n\n |
| \n\nos.win.check-app-domain-network-details\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n- domain=<Domain of the application>\n\n | \n\nRetrieves the network latency, packet loss, and jitter for installed application domain.**Note:** The system uses the Internet Control Message Protocol \\(ICMP\\) to collect network performance metrics, such as latency, jitter, and packet loss.\n\n |
| \n\nos.win.check-app-domain-network-route-details\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n- domain=<Domain of the application>\n\n | \n\nRetrieves the complete network route details for application domain.\n\n |
| \n\nos.win.check-app-sccm\n\n | \n\nNone\n\n | \n\nFetches application-specific metrics for the App - Microsoft System Center Configuration Manager.\n\n |
| \n\nos.win.check-app-zscaler-service-status\n\n | \n\n- --appName=<application name>\n- --primaryProcess=<primary process name>\n- --secondaryProcesses=<list of secondary processes separated by a pipe symbol>\n- --appSysId=<sys id of the application>\n\n | \n\nRetrieves the Zscaler service status information.\n\n |
| \n\nCheck definition name\n\n | \n\nDescription\n\n |
|---|---|
| \n\nos.win.check-system-cpu-usage\n\n | \n\nChecks the current CPU utilization.\n\n |
| \n\nos.win.check-system-cpu-details\n\n | \n\nRetrieves the CPU ID, CPU name, number of physical and logical cores, and architecture information.\n\n |
| \n\nos.win.check-system-memory-usage\n\n | \n\nChecks the current system memory utilization.\n\n |
| \n\nos.win.check-system-last-access-time\n\n | \n\nChecks the last time the current device was accessed. **Note:** This check definition works on locked and unlocked devices. The first time this check definition runs, the events are captured and an error message appears as there is no prior data available.\n\n |
| \n\nos.win.check-system-uptime\n\n | \n\nChecks the time elapsed since the last boot of the system.\n\n |
| \n\nos.win.check-system-disk-io-usage-read\n\n | \n\nRetrieves disk bytes read per second.\n\n |
| \n\nos.win.check-system-disk-io-usage-write\n\n | \n\nRetrieves disk bytes written according to second.\n\n |
| \n\nos.win.check-system-energy-consumption\n\n | \n\nRetrieves the energy consumption values for CPU, SoC, display, disk, network, MBB, EMI, other, total, and loss of a Windows device in milliwatt-hours.**Note:** This check definition isn't compatible with virtual machines that don't have energy sensors.\n\nUnlike other check definitions that retrieve latest data, this check definition retrieves the sum of last 5 minutes of data.\n\n |
| \n\nos.win.check-system-time\n\n | \n\nChecks the current time in Coordinated Universal Time \\(UTC\\) using UNIX timestamp.\n\n |
| \n\nos.win.check-system-power-plan\n\n | \n\nRetrieves the name of the active power plan.\n\n |
| \n\nos.win.check-system-os-details\n\n | \n\nRetrieves the name, version, platform, architecture, and installation date of the operating system.\n\n |
| \n\nos.win.check-system-device-crashes\n\n | \n\nRetrieves details of different crashes on your device.**Note:** This check definition supports BSOD that emits system events with event ids = 41,1001.\n\n |
| \n\nos.win.check-system-device-events\n\n | \n\nRetrieves the details of events that occurred on the device during the specified time interval. Events for Windows include: last boot and logged-in users.\n\n |
| \n\nos.win.check-system-disk-usage\n\n | \n\nRetrieves the disk used space as a percentage of the total space.\n\n |
| \n\nos.win.check-system-battery-details\n\n | \n\nRetrieves battery-related data, including the remaining battery percentage, the designed voltage, the estimated run time, and the battery's maximum capacity.**Note:**\n\n- This check definition doesn't apply to virtual machines \\(VMs\\) or desktops because they don't have batteries.\n- If current capacity is greater than designed capacity, the battery is rounded off to 100%.\n\n |
| \n\nos.win.check-system-network-details\n\n | \n\nRetrieves the network details, including Ethernet, Wi-Fi, and other relevant information.\n\n |
| \n\nos.win.check-system-logged-in-users\n\n | \n\nChecks the login user ID of the users who are currently logged in to the device.\n\n |
| \n\nos.win.check-system-power-consumption\n\n | \n\nRetrieves the power consumption of the device in milliwatt.**Note:** This check definition is exclusively compatible with physical machines and doesn't support virtual machines \\(VMs\\).\n\n |
| \n\nos.win.check-system-admin-users\n\n | \n\nRetrieves all user accounts with local administrative privileges.\n\n |
| \n\nos.win.check-system-bsod\n\n | \n\nRetrieves the count, message, ID, level, and time of Blue Screen of Death \\(BSOD\\) occurrences.**Note:** This check definition supports BSOD that emits system events with event ids = 1001.\n\n |
| \n\nos.win.check-system-firewall-enabled\n\n | \n\nChecks if the operating system firewall is active and enabled.\n\n |
| \n\nos.win.check-system-antimalware-details\n\n | \n\nRetrieves the details of the anti-malware software on the device.\n\n |
| \n\nos.win.check-system-reboot-details\n\n | \n\nRetrieves the reboot duration in seconds and the last reboot timestamp \\(in UNIX epoch time\\).**Note:** The displayed values might not accurately reflect cases where system reboots were interrupted, such as during system updates, power loss, or manual intervention.\n\n |
| \n\nos.win.check-system-os-setup-details\n\n | \n\nRetrieves the approximate OS age for the device.\n\n |
| \n\nos.win.check-system-network-adapter-details\n\n | \n\nRetrieves the network adapter details for the device.\n\n |
| \n\nos.win.check-system-network-connection-profiles\n\n | \n\nRetrieves the network connection profile details for the device.**Note:** This check definition retrieves the network type, which can be used to check the vpn status.\n\n |
| \n\nos.win.check-system-compliance-details\n\n | \n\nRetrieves the system’s compliance details. This includes the list of all configured apps and metric values that are non-compliant, and calculates a compliance rating based on that.**Note:**\n\n- This check definition provides the following details:\n - **Condition for app to be said as compliant**: Every process mentioned in primary process should be running.\n - **Condition for metric value to be said as compliant**: Value should be matching with the configured expected value.\n- The score is then calculated using this formula: Score = \\( Complaint Application + Compliant metric value\\) / \\(Total Applications and metric value - Failed Ones\\) \\*100\n\n |
| \n\nos.win.check-system-battery-charge-percentage\n\n | \n\nRetrieves the battery charge percentage on Windows device.**Note:** If current capacity is greater than designed capacity, the battery is rounded off to 100%.\n\n |
| \n\nos.win.check-system-windows-registry\n\n | \n\nRetrieves the Windows registry data.\n\n |
| \n\nos.win.check-system-memory-details\n\n | \n\nRetrieves the system memory details like and virtual memory details.\n\n |
| \n\nos.win.check-system-bios-details\n\n | \n\nRetrieves the System Bios details.\n\n |
| \n\nos.win.check-system-executables\n\n | \n\nFetches all the executables \\(\\*.exe\\) present on Windows machine.\n\n |
| \n\nos.win.check-system-custom-query-on-change\n\n | \n\nExecute the custom query provided in the parameters. Runs only if value changes.\n\n |
| \n\nos.all.check.internal.get-device-configuration-on-change\n\n | \n\nGets the configurations of a device. Example: sudo configured, debug on, agent user, and so on. Runs only if value changes.\n\n |
| \n\nos.win.check-system-boot-details\n\n | \n\nGets latest boot details of a device from Windows event log.**Note:** Boot time is captured only during a full device boot. Windows generates Event ID 100 during a full boot to measure performance. Boot time is not recorded when the device is resumed, restored, or started through remote or virtual machine operations because Event ID 100 is not generated\n\n |
| \n\nos.win.check-system-gpu-usage-details\n\n | \n\nMonitor GPU \\(Graphics Processing Unit\\) and VRAM \\(Video Random Access Memory\\) usage on the **Device** page to assess graphics performance and identify bottlenecks.\n\n |
| \n\nos.win.action-kill-zombie-orphan-process\n\n | \n\nTakes an app name as input, identifies orphan processes for that app using the app\\_process\\_data.ps1 script, and kills them. Returns output in the format \\{isSuccess: true/false, message: \"success/failure message\", output: \\{\"killedProcessPids\": \\[array of pids\\]\\}\\}\n\n |
| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nDiagnostic action\n\n | ||
| \n\nos.win.check-app-process-ids\n\n | \n\n--process\\_name=<process name>\n\n | \n\nRetrieves the Process IDs \\(PIDs\\) of both the parent and all the child processes associated with the application.\n\n |
| \n\nos.win.check-process-cpu\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their CPU usage percentage, CPU time, Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.win.check-process-memory\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their memory usage in kilobytes \\(KB\\), Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.win.check-process-disk\n\n | \n\nNone\n\n | \n\nRetrieves a list of all running processes along with their disk usage in Bytes, Process ID \\(PID\\), Parent Process ID \\(PPID\\), and name.\n\n |
| \n\nos.win.check-rssi-value\n\n | \n\nNone\n\n | \n\nRetrieves the Received Signal Strength Indicator \\(RSSI\\) value for the currently connected WiFi interface.RSSI indicates the signal strength between the wireless access point \\(AP\\) and the device, with higher RSSI values indicating stronger signal strength.\n\n**Note:** This check definition can't be applied to a virtual machine.\n\n |
| \n\nos.win.check-services-data\n\n | \n\nservice\\_type =<Type of service\\(one of user, system or all\\)\n\n | \n\nRetrieves the list of all services with PID, Service Name, Service Display Name, Status, Service Type.\n\n |
| \n\nCheck definition name\n\n | \n\nCheck definition parameters\n\n | \n\nDescription\n\n |
|---|---|---|
| \n\nos.win.action-kill-process\n\n | \n\n--pid=<process id>OR\n\n--process\\_name=<list of comma separated executable file names>\n\n**Note:** The process ID takes priority over the application name.\n\n | \n\nTerminates a running process or multiple processes specified by their Process ID \\(PID\\) or a list of executable \\(.exe\\) file names.\n\n |
| \n\nos.win.action-restart-service\n\n | \n\n--service\\_name=<service name>\n\n | \n\nRestarts logged user services that take a service name as input to the system.\n\n |
| \n\nos.win.action-flush-dns-cache\n\n | \n\nNone\n\n | \n\nFlushes DNS cache on a Windows device.\n\n |
| \n\nos.win.action-clear-browser-cache\n\n | \n\n--auto\\_close = <true/false>**Note:** When auto-close is enabled, while clearing the browser cache, the browser is closed and vice versa.\n\n--browsers = <List of comma separated browsers>\n\n | \n\nClears cache of the supported browsers such as Google Chrome,Mozilla Firefox, and Microsoft Edge.**Note:** Before executing this check definition, save your browser work.\n\n |
| \n\nos.win.action-clear-app-cache\n\n | \n\nauto\\_close = <True/False whether you want the process to be closed before clearing the cache>process\\_name = <Process name>\n\napp\\_name = <Application name>\n\ncache\\_path = <Path to the cache folder>\n\n**Note:** The cache path is supported for Zoom, Microsoft Outlook, and Microsoft Teams. Cache path should be entered without the path to the user. For example, if the cache is at path C:\\\\User\\\\<UserName>\\\\AppData\\\\Roaming\\\\Zoom\\\\data enter AppData\\\\Roaming\\\\Zoom\\\\data.\n\n | \n\nClears the application cache.\n\n |
| \n\nos.win.action-network-drive\n\n | \n\naction: <MAP/DELETE>drive\\_letter\n\nnetwork\\_path\n\n | \n\nMaps or deletes a network drive depending on the action input parameter, which supports the following values: - MAP – to map a network drive\n- DELETE – to remove a mapped network drive\n\n |
| \n\nos.win.action-restart-application\n\n | \n\nprocess\\_name = <Process name>\n\n app\\_name = <Application name>\n\n | \n\nRestarts the application if it is running.\n\n |
| \n\nos.win.action-removable-usb-storage-access\n\n | \n\naccess - <deny\\_read/deny\\_write/deny\\_execute>value - <true/false>\n\n | \n\nControls access to removable USB storage disks for read, write, and execute access.**Note:**\n\n- This action is effective only if removable USB storage access is not already controlled by other mechanisms, such as Group Policies, third-party endpoint protection tools, or device control software.\n- After you run the check, restart the device for the access changes to take effect.\n\n |
| \n\nos.win.action-uninstall-application\n\n | \n\napp\\_name = <application name>\n\n | \n\nUninstall an application.\n\n |
| \n\nos.win.action-zscaler-zpa-reconnect\n\n | \n\nNone\n\n | \n\nResolves Zscaler connectivity issues.\n\n |
| \n\nos.win.action-restart-one-drive\n\n | \n\nNone\n\n | \n\nRestarts OneDrive on the end-user's machine.\n\n |
| \n\nos.win.action-disk-cleanup\n\n | \n\nNone\n\n | \n\nClears unwanted files or cache using Windows disk cleanup:- Internet cache files\n- System error memory dump files\n- System error mini-dump files\n- Temporary files\n- Windows error reporting\n\n |
| \n\nos.win.action-windows-registry-action\n\n | \n\nregistry\\_path = <Absolute Windows registry key path> \\(Complete path of the registry key to be added\\)\n\n registry\\_data = <Data to be added or modified in a given registry key>\n\n Registry\\_type = <Type of the registry key data> \\(One of the default provided options\\)\n\n | \n\nAllows the user to create a new Windows registry key or modify an existing one. Users can add new keys, or update the data and value type of existing registry entries as needed.\n\n |
| \n\nos.win.action-delete-file\n\n | \n\nfile\\_name\\_or\\_path = <File name or path>\n\n | \n\nPermanently delete the entered file. Entered file should have a valid type extension.\n\n |
| \n\nos.win.action-clear-google-chrome-browsing-data\n\n | \n\nremove\\_web\\_data = <True/False whether you want to remove the web data>\n\n | \n\nRemoves all the browsing data on Google chrome from all the Google chrome profiles.\n\n |
| \n\nos.win.action-purge-recycle-bin\n\n | \n\nNone\n\n | \n\nPurging Recycle Bin will clear all the files in the recycle bin.\n\n |
| \n\nos.win.action-reset-google-chrome-settings\n\n | \n\nNone\n\n | \n\nClears the settings and removes all the installed Google chrome extensions on all the google chrome profiles.\n\n |
| \n\nos.win.action-toggle-power-plan\n\n | \n\npower\\_mode - Balanced, High performance, Power saver\n\n | \n\nToggle between different power plans.\n\n |
| \n\nos.win.action-elevate-temporary-admin\n\n | \n\nduration\n\n user\\_id = ID of the user\n\n | \n\nElevates temporary admin access to users for a period of time to perform specific tasks without compromising on security.\n\n |
| \n\nos.win.action-fix-classic-outlook-data-files\n\n | \n\nNone\n\n | \n\nFixes OST / PST data files using SCANPST.EXE in Classic outlook\n\n |