Metrics monitored by DEX on Windows
Review the endpoint performance and compliance metrics that DEX collects from managed Windows devices, including collection intervals, and associated check definitions and policies.
Application metrics
| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required privileges |
|---|---|---|---|---|---|---|---|
| Application version | version | Version string of the installed application. Format is vendor-defined (for example, 5.14.2.6). |
Single metric — version (string) |
N/A | 1,440 | os.win.check-app-version | No elevated privileges required |
| CPU usage | cpu_usage | Percentage of CPU consumed by all processes belonging to the target application. Point-in-time gauge sampled every 5 minutes. | Single metric — cpu_usage (percentage, gauge) |
% | 5 | os.win.check-app-cpu-usage | Local System Account |
| Crashes | crashes | Count of application crashes detected in the last 5 minutes via the Windows Event Log. | Single metric — crashes (count per 5-min window, gauge) |
count | 5 | os.win.check-app-crashes | No elevated privileges required |
| Domain network details (installed apps) | domain_network_details | Network quality metrics for the target application's domain or domains: round-trip latency, packet loss, and jitter. | latency (ms); packet_loss (%); jitter (ms) |
N/A | 10 | os.win.check-app-domain-network-details | No elevated privileges required |
| Domain network details (Web apps) | domain_network_details | Network latency, packet loss, and jitter for a web application domain. Same measurement as the installed-app variant. | latency (ms); packet_loss (%); jitter (ms) |
milliseconds | 10 | os.win.check-web-app-domain-network-details | No elevated privileges required |
| Domain network route details (installed apps) | source_details, domain_network_route_details | Complete hop-by-hop network route from the device to the application's domain(s), including per-hop latency, IP addresses, and packet loss. | source_details (device source IP/network info); domain_network_route_details (array of hops): hop_number, ip_address, latency (ms),
packet_loss (%) |
N/A | 30 | os.win.check-app-domain-network-route-details | No elevated privileges required |
| Domain network route details (Web apps) | source_details, domain_network_route_details | Complete hop-by-hop network route from Windows device to the web application domain. | source_details; domain_network_route_details array |
milliseconds | 30 | os.win.check-web-app-domain-network-route-details | No elevated privileges required |
| Freezes | freezes | Count of application freeze (hang) events in the last 5 minutes per application process. Sources events from Windows Application Event Log: WER Event ID 1001 (AppHangTransient) and Application Hang Event ID 1002. Note: The metric collects data only from apps that report freeze events to the Windows Event Log. Apps that don't use Windows Error Reporting can't surface freeze data. |
Single metric — freezes (count per 5-min window) per app+version |
count | 5 | os.win.check-app-freezes | No elevated privileges required |
| Incoming network bytes | incoming_network_bytes | Incoming network bytes per second for a specific application, aggregated across IPv4 and IPv6 network connections. | Single metric — incoming_network_bytes (bytes/second, gauge) per application |
Bps | N/A | os.win.check-app-incoming-network-bytes | Local System Account |
| Installed Apps Version | version | Fetches all the latest version of the applications. | Per installed application: application name and version; delivered as change sets (entries_to_add, entries_to_remove). |
N/A | 1,440 | os.all.check-installed-apps-version | No elevated privileges required |
| IO usage (read) | io_usage_read | Bytes read per second from disk by all processes of the target application. Two-sample delta calculation. | Single metric — io_usage_read (bytes/second, gauge) |
Bps | 5 | os.win.check-app-io-usage-read | Local System Account |
| IO usage (write) | io_usage_write | Bytes written per second to disk by all processes of the target application. | Single metric — io_usage_write (bytes/second, gauge) |
Bps | 5 | os.win.check-app-io-usage-write | Local System Account |
| Is installed | is_installed | Boolean indicating whether the target application is installed on the device. | Single metric — is_installed (boolean, gauge) |
Boolean | N/A | os.win.check-app-is-installed | No elevated privileges required |
| Is running | is_running | Boolean indicating whether at least one process of the target application is currently running. | Single metric — is_running (boolean, gauge) |
Boolean | 5 | os.win.check-app-is-running | Local System Account |
| Last access time | last_access_time | Unix timestamp (milliseconds) of the last time the application process was observed running. | Single metric — last_access_time (milliseconds since epoch) |
milliseconds | 5 | os.win.check-app-last-access-time | Local System Account |
| Last updated | last_updated | Unix timestamp (seconds) of the most recent application update installation. | Single metric — last_updated (Unix timestamp in seconds) |
seconds | N/A | os.win.check-app-last-updated | No elevated privileges required |
| Listening ports | listening_ports | List of TCP and UDP port numbers on which the application is actively listening. | Single metric — listening_ports (array of integers) |
N/A | N/A | os.win.check-app-listening-ports | No elevated privileges required |
| Outgoing network bytes | outgoing_network_bytes | Outgoing network bytes per second for a specific application across IPv4 and IPv6 networks. | Single metric — outgoing_network_bytes (bytes/second, gauge) per application |
Bps | N/A | os.win.check-app-outgoing-network-bytes | Local System Account |
| RAM usage | memory_usage | Percentage of physical RAM consumed by all processes of the target application relative to total system RAM. | Single metric — memory_usage (percentage, gauge) |
% | 5 | os.win.check-app-memory-usage | Local System Account |
| SCCM | sccm_metrics | Application-specific metrics for Microsoft Configuration Manager (MCM), including SCCM agent status, last policy refresh, deployment status, and other SCCM-specific data. | agent_status; last_policy_request; last_scan_time; deployment_status |
N/A | 1,440 | os.win.check-app-sccm | Local system account |
| Uptime | uptime | Continuous running time of each application process in milliseconds since it was last started. | Single metric — uptime (milliseconds, gauge) |
milliseconds | 5 | os.win.check-app-uptime | Local System Account |
| Zscaler service status | zscaler_service_status | Fetches the Zscaler service status information for the following services: ZPA, ZIA, and ZDX, with the type parameter set to "latest". Additionally, returns whether the ZPA service status is "connected" for the type set to "historical". | Per-service status for ZPA, ZIA, ZDX (latest); ZPA connected status (historical). | N/A | 5 | os.win.check-app-zscaler-service-status | No elevated privileges required |
Device metrics
| Metric Name | Key | Description | Sub-metrics / Output fields | Unit | Policy: Interval (min) | Check Definition Name | Required privileges |
|---|---|---|---|---|---|---|---|
| Admin users | admin_users | List of local user accounts with administrator-level privileges on the device. Snapshot only. | admin_users (array): username (string), uid (integer) |
N/A | N/A | os.win.check-system-admin-users | No elevated privileges required |
| Antimalware details | antimalware_details | Antimalware software details including product name, version, enabled status, and definition update date. | product_name; version; enabled; definition_date; am_running_mode |
N/A | 1,440 | os.win.check-system-antimalware-details | No elevated privileges required |
| Antivirus enabled | antivirus_enabled | Boolean status indicating whether an antivirus product is registered and active in Windows Security Center. | name (AV product); enabled (boolean); up_to_date (boolean) |
N/A | 1,440 | os.win.check-system-antivirus-enabled | No elevated privileges required |
| Battery charge percentage | battery_charge_percentage | Current battery charge percentage on the Windows device as an integer. | Single metric — battery_charge_percentage (integer %, gauge) with battery_id attribute |
% | 5 | os.win.check-system-battery-charge-percentage | No elevated privileges required |
| Battery details | battery_details | Comprehensive battery health snapshot including charge percentage, estimated runtime, battery status, health condition, chemistry, cycle count, design and full-charge capacity, serial number, design voltage, and installed batteries count. | charge_percentage; estimated_runtime; battery_status; condition; health; design_voltage;
chemistry; cycle_count; serial_number; designed_capacity (mWh); full_charge_capacity (mWh); maximum_capacity (%);
installed_batteries (count) |
N/A | 1,440 | os.win.check-system-battery-details | Local System Account |
| BIOS details | bios_details | BIOS firmware details for the Windows device including BIOS version, manufacturer, release date, and BIOS mode. | bios_version; manufacturer; release_date; serial_number; bios_mode (UEFI/Legacy) |
N/A | 1,440 | os.win.check-system-bios-details | No elevated privileges required |
| Bitlocker details | bitlocker_details | BitLocker encryption status per volume including protection status, encryption method, and key protector type. | Per volume: volume_type; mount_point; encryption_percentage; protection_status; lock_status; encryption_method;
key_protector |
N/A | 1,440 | os.win.check-system-bitlocker-details | Local System Account |
| BSOD (count) & cause | bsod_details | Count of Windows BSOD (Blue Screen of Death) events in the last 30 days from the Windows Event Log, plus per-event details: cause/error code, event ID, severity level, and timestamp. | bsod_count (count in last 30 days); per event: cause, event_id, level, time_created |
N/A | 1,440 | os.win.check-system-bsod | No elevated privileges required |
| CPU details | cpu_details | Static CPU hardware details: processor name/model, architecture, physical core count, logical processor count, device ID, and processor ID. | name; architecture; number_of_cores; number_of_logical_processors; device_id; processor_id;
manufacturer; current_clock_speed (MHz); max_clock_speed (MHz) |
N/A | 1,440 | os.win.check-system-cpu-details | No elevated privileges required |
| CPU performance details | cpu_performance_details | CPU performance counter data including CPU user time percentage. | cpu_user_time (% User Time, gauge) |
% | 5 | os.win.check-system-cpu-performance-details | Local System Account |
| CPU usage | cpu_usage | Overall device CPU utilization percentage across all cores. Collected via typeperf performance counter. |
Single metric — cpu_usage (percentage, gauge) |
% | 5 | os.win.check-system-cpu-usage | Local System Account |
| Device crashes | device_crashes | Count of device-level crashes (BSODs, kernel events) on Windows within the 5-minute collection window. | Single metric — device_crashes (count per 5-min window, gauge) |
count | 5 | os.win.check-system-crashes | No elevated privileges required |
| Device details | device_details | Hardware device inventory snapshot: chassis type, description, model, serial number, and processor ID. | chassis_type; description; model; serial_number; processor_id |
N/A | 1,440 | os.win.check-system-device-details | No elevated privileges required |
| Device events | device_events | Device-level events during a specified time interval on Windows. Captures last_boot (Unix timestamp if reboot occurred in interval) and logged_in_users (list of user logins in interval). |
last_boot (Unix timestamp or empty); logged_in_users (array of user login objects) |
N/A | 1,440 | os.win.check-system-device-events | Local System Account |
| Disk available | disk_available | Gets the available disk space in GB. | Single metric — disk_available (available disk space in GB, number). |
GB | 5 | os.win.check-system-disk-available | Local System Account |
| Disk details | disk_details | Per-disk snapshot of total, free, and used space plus disk performance counters: disk_reads_per_sec, disk_writes_per_sec, and avg_disk_queue_length. |
total_space (bytes); free_space (bytes); used_space (bytes); disk_reads_per_sec; disk_writes_per_sec;
avg_disk_queue_length; avg_disk_sec_per_read; avg_disk_sec_per_write; avg_disk_sec_per_transfer |
N/A | 5 | os.win.check-system-disk-details | Local System Account |
| Disk IO usage (read) | io_usage_read | Device-wide disk read throughput in bytes per second across all disks. | Single metric — io_usage_read (bytes/second, gauge) |
Bps | 5 | os.win.check-system-disk-io-usage-read | Local System Account |
| Disk IO usage (write) | io_usage_write | Device-wide disk write throughput in bytes per second. | Single metric — io_usage_write (bytes/second, gauge) |
Bps | 5 | os.win.check-system-disk-io-usage-write | Local System Account |
| Disk usage* | disk_usage | Percentage of primary disk space used. | Single metric — disk_usage (percentage, gauge) |
% | 5 | os.win.check-system-disk-usage | Local System Account |
| Energy consumption | energy_consumption | Energy consumed by the device over a measurement period in milliwatt-hours. Cumulative energy metric. | Single metric — energy_consumption (mWh, gauge) with battery_id attribute |
mWh | 5 | os.win.check-system-energy-consumption | Local system account |
| Firewall enabled | firewall_enabled | Boolean status of the Windows OS firewall. Returns a single state value indicating whether the firewall is enabled. | firewall_enabled (boolean) |
N/A | 1,440 | os.win.check-system-firewall-enabled | No elevated privileges required |
| GPU Usage Details | gpu_usage,gpu_vram_usage | Checks GPU Usage percentage and GPU VRAM Usage in bytes. | gpu_usage (3D engine utilization %, 0–100); gpu_vram_usage (local adapter memory usage, bytes) |
gpu_usage: percentage; gpu_vram_usage: bytes | 5 | os.win.check-system-gpu-usage-details | Local System Account |
| Hard drive status | hard_drive_status | Physical disk drive inventory and health status including disk number, name, status, description, interface type, manufacturer, media loaded, media type, model, size, serial number, partition count, and partition details. | drive_details (array): disk_number; name; status; description; interface_type; manufacturer;
media_loaded; media_type; model; size; serial_number; partitions
|
N/A | 1,440 | os.win.check-system-hard-drive-status | Local System Account |
| Incoming network bytes | incoming_bytes | Total incoming network bytes per second aggregated across all active network interfaces on the device. | Single metric — incoming_bytes (bytes/second, gauge) |
Bps | N/A | os.win.check-system-net-bytes-incoming | Local System Account |
| Last access time | last_access_time | Timestamp of the last time the Windows device was accessed by a user, based on lock/unlock state. Note: The check enables event capturing on first run, so initial collection may return an error. |
Single metric — last_access_time (timestamp of last lock/unlock) |
N/A | 1,440 | os.win.check-system-last-access-time | Local System Account |
| List executables | list_executables | Inventory of all .exe executable files present on the Windows device. | Per executable: name; path; version; size; last_modified |
N/A | 1,440 | os.win.check-system-executables | Local System Account |
| Logged-in users | logged_in | List of users currently logged into the device including username and uid. | logged_in (array): user; uid |
N/A | 1,440 | os.win.check-system-logged-in-users | Local System Account |
| Memory details | memory_details | Comprehensive memory snapshot including physical and virtual memory totals, available, and used (bytes); memory usage percentage; virtual memory usage percentage; page file size and usage percentage; and pages/sec performance counter. | physical_memory_total; physical_memory_available; physical_memory_usage; memory_usage (%); virtual_memory_total;
virtual_memory_available; virtual_memory_usage; memory_pages_per_sec; page_file_usage (%); total_page_file_size |
% | 5 | os.win.check-system-memory-details | Local System Account |
| Memory modules | memory_modules | Physical RAM module details including capacity, speed, manufacturer, part number, and slot location. | Per module: capacity; speed (MHz); manufacturer; part_number; slot; form_factor |
N/A | N/A | os.win.check-system-memory-modules | No elevated privileges required |
| Network adapter details | network_adapter_details | Details of all network adapters on the Windows device. On-demand collection only. | name; interface_description; status; mac_address; link_speed |
N/A | 1,440 | os.win.check-system-network-adapter-details | No elevated privileges required |
| Network connection profiles | network_connection_profiles | Network connection profile details for the Windows device, including network type (public/private/domain), which can be used to infer VPN status. | network_type (Public/Private/Domain); interface_name; connected (boolean) |
Boolean | 30 | os.win.check-system-network-connection-profiles | No elevated privileges required |
| Network connectivity details | network_details | Complete network adapter snapshot for both Wi-Fi and Ethernet interfaces. | Ethernet: name; interface_description; driver_version; status; link_speed; mac_address;
media_typeWi-Fi: |
N/A | 1,440 | os.win.check-system-network-details | No elevated privileges required |
| OS details | os_details | Operating system inventory snapshot including name, version, platform, architecture, install date, locale, build number, build type, service pack versions, serial number, and system directory. | name; version; platform; architecture; install_date; locale; status;
build_number; build_type; service_pack_major_version; service_pack_minor_version; serial_number;
system_directory |
N/A | 1,440 | os.win.check-system-os-details | No elevated privileges required |
| OS setup details | os_setup_details | Approximate age of the Windows OS installation. Derived from OS install date compared to the current date. | os_install_date (timestamp); os_age_days (integer) |
N/A | 1,440 | os.win.check-system-os-setup-details | No elevated privileges required |
| Outgoing network bytes | outgoing_bytes | Total outgoing network bytes per second aggregated across all active network interfaces on the device. | Single metric — outgoing_bytes (bytes/second, gauge) |
Bps | 1,440 | os.win.check-system-net-bytes-outgoing | Local System Account |
| Pending system updates | pending_updates | List of pending Windows software updates not yet installed. Includes per-update details such as KB number, title, description, support URL, mandatory flag, uninstallable flag, download size, and reboot requirement. | Per update: kb; title; description; support_url; is_mandatory; is_uninstallable;
max_download_size; min_download_size; reboot_required |
N/A | 1,440 | os.win.check-system-pending-updates | Local System Account |
| Peripheral device details | peripheral_devices_details | Inventory of connected peripheral devices (USB, HID, etc.) including device name, type, manufacturer, and connection status. | Per device: name; device_id; type; status; manufacturer |
N/A | 1,440 | os.win.check-peripheral-devices-details | No elevated privileges required |
| Power consumption | power_consumption | Current device power consumption in milliwatts. Note: Not collected for VMs (the check skips devices where no data is available). |
Single metric — power_consumption (milliwatts, gauge) |
mW | 5 | os.win.check-system-power-consumption | Local System Account |
| Reboot details | reboot_details | List of system startup (Event ID 6005) and shutdown (Event ID 6006) events with Unix timestamps from the Windows System Event Log. | Array of events: id (6005=startup or 6006=shutdown); time_created (Unix timestamp). last_reboot_timestamp is calculated from this data. |
seconds | 1,440 | os.win.check-system-reboot-details | No elevated privileges required |
| System compliance | system_compliance_details | Compliance rating (percentage) for the device based on configured compliance rules across apps and device metrics. Lists non-compliant metrics and apps. | compliance_rating; non_compliant_apps (array); non_compliant_metrics (array) |
% | 1,440 | os.win.check-system-compliance-details | No elevated privileges required |
| System time | time | Current system time as a Unix epoch timestamp in seconds (UTC). Used for time-drift detection and telemetry alignment. | Single metric — time (Unix epoch seconds, gauge) |
seconds | N/A | os.win.check-system-time | No elevated privileges required |
| Uptime | uptime | Continuous time in milliseconds since the last device boot. | Single metric — uptime (milliseconds, gauge) |
milliseconds | 5 | os.win.check-system-uptime | No elevated privileges required |
| User profiles | user_profiles | List of Windows user profiles present on the device including profile path, SID, and profile type. | Per profile: sid; localpath; lastusetime; loaded (boolean) |
N/A | 1,440 | os.win.check-system-user-profiles | No elevated privileges required |
| Wi-Fi receive rate | wifi_receive_rate | Wi-Fi receive rate (downlink speed) in Mbps on Windows. Sourced from netsh wlan show interfaces. |
Single metric — wifi_receive_rate (Mbps, gauge) |
Mbps | 5 | os.win.check-system-wifi-receive-rate | No elevated privileges required |
| Wi-Fi signal strength | wifi_signal_strength | Wi-Fi signal strength as a percentage (0-100%) on Windows. Parsed from netsh wlan show interfaces Signal field. |
Single metric — wifi_signal_strength (percentage 0-100, gauge) |
% | 5 | os.win.check-system-wifi-signal-strength | No elevated privileges required |
| Wi-Fi transmit rate | wifi_transmit_rate | Wi-Fi transmit rate (uplink speed) in Mbps from the Windows device. | Single metric — wifi_transmit_rate (Mbps, gauge) |
Mbps | 5 | os.win.check-system-wifi-transmit-rate | No elevated privileges required |
| Windows power plan | power_plan | Active Windows power plan (for example, Balanced, High Performance, Power Saver) and its GUID. | power_plan_name; power_plan_guid |
N/A | 1,440 | os.win.check-system-power-plan | No elevated privileges required |
| Windows registry keys | windows_registry | Windows registry key values for specified paths. Registry keys are parameterized — the specific keys queried depend on the check definition configuration. | Configurable per key: key; name; data; type (REG_SZ, REG_DWORD, etc.) |
N/A | 1,440 | os.win.check-system-windows-registry | No elevated privileges required |
| Windows stability index | stability_index | Windows Reliability Index score (1-10 scale) representing overall system stability. Higher is more stable. | Single metric — stability_index (number 1–10, gauge, asDouble) |
index (0-10) | 1,440 | os.win.check-system-compliance-details | No elevated privileges required |
Note:
* The Disk Usage metric reports storage consumption. For disk I/O throughput by process, see the Disk Usage action in Digital End-User Experience remedial actions.