Managing Custom Data data points

The data point file contains a field name for the data point, the data type being returned, and the query expression that is executed on the device. The values returned can be one of the following data types:

• boolean
• datetime (ISO 8601 string), for example: 2020-08-05T14:23:01.000Z
• double
• long
• string

Regardless of the data type, the maximum size of the returned value is 8 KB, or approximately 8000 characters.

There are two types of data points in Custom Data policies: Default data points and Custom data points.

Default data points are part of the DataExplorer Library and are automatically included in the Custom Data policy. Default data points have a green border and are disabled by default. You can enable and disable Default data points but you can't edit the display name or delete them. For a list of available Default data points, see DataExplorer Library.

Custom data points are provided to you by Absolute, and you add them to the Custom Data policy. You can add, edit, enable, disable, and delete Custom data points. For more information, contact Absolute Sales.

Additionally, with the Absolute Resilience license, you can download the DataExplorer Builder tool to create and configure your own Custom data points.

You can add Custom data points to the Custom Data policy and configure which policy groups collect the data points.

To add Custom data points:

1. Log in to the Secure Endpoint Console as a user with Manage permissions for Custom Data Collection and Policies.
2. On the navigation bar, click Policies > Custom Data.
3. Click Create data points.

4. To select the data points to add, do one of the following:

   Browse for files

   1. In the work area, click browse and navigate to and select one or more data point files that you want to add. Files must be valid JSON files that return one of the supported data types.
   2. Repeat the previous step for all of the data points you want to add.
   Drag files

   1. Navigate and select one or more data point files that you want to add.
   2. Drag the file or files to Drop files here in the work area of the Secure Endpoint Console. Files must be valid JSON files that return one of the supported data types.
   3. Repeat the previous steps for all of the data points you want to add.

   If you select a data point in error, click Remove.

   The selected data points appear with the field name from the data point file.

   Two data points can't have the same field name. For information on matching data points, see What happens when matching data points are detected?

5. [Optional] Enter the name you want to use for each data point. This is the name that appears in reports. If you don't enter a name, the data point uses the field name.

   If you enter a duplicate display name, you see a warning in the console. Enter a new, unique display name for the data point.
   The validation for matching display names is case insensitive, BatteryHealth and batteryHealth are considered the same.

6. Click Save. The data points are added to the policy.

   If adding the new data points causes your account to exceed the 100 data point limit, a notification shows and no new data points are saved. To see how many data points are in your account, click View All. The number of data points is displayed beside Data Points, for example, "Data Points (98)".

7. If this is the first time you've added data points, the Policy Groups area opens. The policy is deactivated for all policy groups. Do one of the following:

   • To leave the policy deactivated for now, click Save. You can edit which policy groups use the Custom Data policy in the future.

   • To activate the policy for one or more policy groups:

     1. Click the policy group's activation slider to set it to Enabled.
     2. Click Save.

The Custom Data policy is configured to collect the data points from devices in the configured policy groups on the next agent connection, which is typically within the next 15 minutes, and then once every 24 hours.

Once the Custom Data policy is enabled for at least one policy group and has had a chance to run on your devices, you can use the Edit columns option to add the Custom Data > Display name column to most pages or reports. You can also filter and sort the page or report using Custom Data.

You can also view custom data point information on a device's Details page.

You can enable and disable both Custom data points, and Default data points from the DataExplorer Library in the Custom Data policy. You can also change the display name of Custom data points.

To edit data points:

1. Log in to the Secure Endpoint Console as a user with Manage permissions for Custom Data Collection and Policies.

2. On the navigation bar, click Policies > Custom Data.

   Enabled data points have a white background. Disabled data points have a gray background.

3. Find the data point you want to change and click Edit. To search for a data point, enter all or part of the display name or the field name in the Search box. The search results update dynamically as you type. Click Custom or Default to limit the search results.

4. Do one or more of the following:

   • To enable a data point for all configured policy groups, click the activation slider to set it to Enabled.

   • To disable a data point for all configured policy groups, click the activation slider to set it to Disabled.

     Disabling a data point produces the following results:

     • The data point is no longer collected from devices.
     • Information that has already been collected is maintained but is no longer available in reports.
     • Reports that were saved with a disabled data point as a filter are no longer filtered by that field.

     • If the data point was used by an Action rule:

       • Your user role needs to be granted the Manage permission for Rules.
       • The rule is deactivated, and a Rule updated event is logged to Event History. Note that if you re-enable the data point later, the rule is not automatically re-enabled. You will need to enable it.
       • In the Policies > Rules area, the rule shows a icon to indicate that an item used by the rule has been deleted or disabled. Edit the rule and remove or replace the item.

   • [Custom data points only] To change the display name for the data point, enter the new name.

     If you enter a duplicate display name, you see a warning in the console. Enter a new, unique display name for the data point.
     The validation for matching display names is case insensitive: BatteryHealth and batteryHealth are considered the same.

5. Click Save.

The data point is updated.

You can delete Custom data points if you added them in error, or if you no longer want to collect the information. You can't delete Default data points that are part of the DataExplorer Library.

Note that if you delete a Custom data point that is used by an Action rule:

• Your user role needs to be granted the Manage permission for Rules.
• The rule is deactivated, and a Rule updated event is logged to Event History.
• In the Policies > Rules area, the rule shows a icon to indicate that an item used by the rule has been deleted or disabled. Edit the rule and remove or replace the item.

To delete a Custom data point:

1. Log in to the Secure Endpoint Console as a user with Manage permissions for Custom Data Collection and Policies.
2. On the navigation bar, click Policies > Custom Data.
3. Find the data point you want to delete and click Edit. To search for a data point, enter all or part of the display name or the field name in the Search box. The search results update dynamically as you type. Click Custom to limit the results to Custom data points.
4. Click Delete Data Point.

5. On the Delete dialog, review the warning message that all previously collected data will be deleted and removed from reports. Click Continue if you want to proceed.

   When you delete a data point, all previously collected data is also deleted. The column is removed from any user-defined reports A report created using the Save As report option to save your report customizations to a new report. User-defined reports show in My Reports view of the Reports page. Also see "predefined report". you have created. If it was being used to filter a report or smart group, the filter is removed.

The data point is deleted.

Deleting a data point produces the following results:

• the data point is no longer collected from devices
• information that has already been collected is deleted
• the data point is removed from user-defined reports
• reports that were saved with the deleted data point as a filter are no longer filtered by that field
• the field name and display name can be reused

Matching data points are data points that have the same field name in the JSON file. Matching is detected while you are adding data points and prevents you from adding two different data points with the same field name.

Matching validation of field names is case insensitive; BatteryHealth and batteryHealth are considered the same.

If the match is detected between two data points you are in the process of adding, the last file selected is the data point that is added when you click Save.

If the match is detected between an existing data point and a new data point you are adding, a warning message appears indicating that the existing data point is going to be overwritten. Do one of the following:

• To continue using the existing data point, click either Remove or Cancel.
• To use the new data point, click Save. The data is refreshed within 24 hours for all devices that are online.

If the duplicate data point has a different data type, or if you are unsure whether the duplicate data point has the same data type, create a new data point. You can create a new data point by opening the JSON file in a text editor and editing the field name. For example, rename BatteryHealth to BatteryHealth1.
Optionally, if you no longer want to collect the information from the old data point and want to replace it with the new data point, you can delete the old data point before adding the new data point. However, any information that was collected using the old data point will be deleted and will no longer be available in reports.

After you activate the Custom Data policy, the CDC component A lightweight software component of the Secure Endpoint Agent that detects configured data points on a Windows device. The CDC component is deployed on a device only when the device is associated with a policy group in which the Custom Data policy is activated. begins to collect the Custom Data information from the devices associated with the applicable policy groups. To view the collected information, all users can use Edit Columns to add the Custom Data > Display name column to most pages or reports that show devices in the results grid. For example, open the All Devices page in the Devices area or open the Makes and Models report. You can also filter pages and reports by Custom Data. Filters are not supported on data points with a double data type.

All users can also view custom data point information, including collection errors, on a device's Details page.