Every field the agent sends to SuperIT, how often, and what it does not collect.
This page is the complete list of data the SuperIT RMM agent sends to SuperIT from a Windows device, how often it sends it, and what it does not collect. The macOS and Linux agents are in Beta and are not covered here.
Collected every 60 seconds
The SuperIT RMM agent collects the following every 60 seconds by default. The interval is the metrics_interval setting in the agent's configuration.
Device and operating system
| Category | Fields |
|---|---|
| Device | Computer name (hostname) |
| Public IP address | The device's public IP address, as seen by api.ipify.org |
| Operating system | Platform, edition, version and kernel (build) version |
| Processor | Model name, vendor, cores, clock speed, cache size and feature flags |
| Memory | Total physical memory and total page file (swap) |
| Network interfaces | For each interface: name, MAC address, IP addresses, MTU and flags (for example, up or loopback) |
| Hardware identifiers | SMBIOS UUID, BIOS serial number, motherboard serial number and the Windows machine GUID. SuperIT uses these to tell devices apart, including cloned devices. |
| Agent | Whether the agent is running as a service, the account it runs as, and whether it can run commands as other users |
Performance
| Category | Fields |
|---|---|
| CPU | Usage percentage, overall and per core |
| Memory | Total, used, free and cached memory, and page file (swap) total, used and free |
| Disks | For each local volume: drive, file system, total, used and free space. For each disk: bytes and operations read and written, and time spent reading and writing |
| Network traffic | For each interface: bytes and packets sent and received, and send and receive errors |
Wi-Fi
| Category | Fields |
|---|---|
| Wireless adapters | For each Wi-Fi adapter: its name and whether it is connected |
| Connected network | Network name (SSID), access point address (BSSID), signal strength, channel, frequency and security type |
| Nearby networks | The same fields for every Wi-Fi network the adapter can see, including networks the device isn't connected to |
Wi-Fi details, especially access point addresses (BSSIDs) and the list of nearby networks, can show roughly where the device is.
Printers
| Category | Fields |
|---|---|
| Printers | For each printer installed on the device: name, port or address, host, queue name, IP address, status, number of jobs in the queue, whether it's the default printer, and driver name |
Signed-in users
| Category | Fields |
|---|---|
| Sessions | For each Windows session: session ID, user name, domain, Windows security identifier (SID), Microsoft Entra ID object ID when the account is Entra-joined, session state (for example active or disconnected), whether it is the console or a remote (RDP) session, the remote client's computer name for RDP sessions, sign-in time, connect time, time of the last keyboard or mouse input, and idle time |
| Windows Update | When Windows Update last installed an update |
Collected every 30 seconds
Once the SuperIT RMM agent is registered, it sends a short status message every 30 seconds by default (the status_interval setting). It contains the agent version, its state (for example running), its registration state, how it is connected (port 4222 or the port 443 fallback), its update channel, and an ID that changes each time the agent starts. SuperIT uses this to show each device as Online, Unstable or Offline in Devices.
Collected on demand
Command output
When SuperIT or an engineer runs a command on a device, SuperIT receives what the command returns. What a command can read depends on the command and the account it runs as, and is governed by your command policies and approvals. The agent keeps a local record of recent commands in C:\ProgramData\SuperIT\runs.jsonl.
Read only when a command needs it
The SuperIT RMM agent doesn't collect the following on a schedule. SuperIT can read some of them by running a command when it needs them, within your command policies and approvals:
- Installed software or application inventory
- Running processes
- Windows event logs or security events
- Crash reports or error reports
- CPU or hardware temperatures, fan speeds or battery status
- Disk health (SMART) data
Not collected
The SuperIT RMM agent does not collect:
- File contents, documents, photos or downloads
- Browsing history, cookies or visited websites
- Email, chat or call content
- Passwords or other saved credentials
- Keystrokes
Commands that SuperIT runs on a device, as the signed-in user or as SYSTEM, can read anything that account can read. What runs, and whether someone must approve it first, is controlled by your command policies and approvals.
When the device is offline
The SuperIT RMM agent doesn't keep a history of readings while it can't reach SuperIT. It keeps only its most recent reading on disk and doesn't send it later. Readings taken during a brief connection drop may still be sent when the connection comes back. When the device reconnects, it carries on with fresh readings, so SuperIT shows a gap for the time the device was offline.
Where the data goes
The SuperIT RMM agent sends all data over an encrypted (TLS) connection to SuperIT's messaging service at connect.ngs.global, which delivers it to SuperIT. Data is stored by SuperIT against your team, in Australia, on Google Cloud in Sydney. Your team, your service provider (if you have one) and authorised SuperIT staff can see it. Other SuperIT customers can't. For how SuperIT protects your data, see the FAQ.