Getting started with DataExplorer Builder

Absolute DataExplorer Builder is a Windows application that lets you graphically build queries to be run against your endpoints. DataExplorer Builder uses blocks as visual representations of code that abstract the underlying JSON format. It also uses some blocks as helpers, such as a block that encodes a file from the filesystem in base64. As you build a rule, you can evaluate the logic against your endpoint. Once you successfully build and test a rule, you can export it from DataExplorer Builder into a JSON file. You can then add the JSON file as a data point to the Custom Data policy using the Secure Endpoint Console. Enable the policy to start collecting and reporting on the data from your endpoints.

To use DataExplorer Builder, the following requirements must be met:

  • DataExplorer Builder must be installed on a Windows device running a supported version of the Windows operating system

    Due to restrictions placed on Windows 11 SE by Microsoft, data points that use PowerShell are not supported on devices running Windows SE 11.

  • DataExplorer Builder must be run using elevated (admin) access

You can use DataExplorer Builder to collect the following types of information from your endpoints:

  • hardware and software data accessible through Windows Management Instrumentation (WMI) queries
  • settings, options, or other data available in the Windows Registry
  • hash values of files on the device
  • existence of files on a device

The final data type returned must be one of the following:

  • Boolean
  • datetime (ISO 8601 string) e.g. 2020-08-05T14:23:01.000Z
  • double
  • long
  • string