Working with blocks
DataExplorer Builder blocks are graphical representations of code that can be joined together to create JSON logic. The JSON logic can be used to extract data from your endpoints and report on the data in the Secure Endpoint Console. Every block outputs a single value - the value can be one of the supported data types but it can also be an unsupported data type like an array or an object. Aside from the Data item block, the output value from all blocks can be used as an input for another block by connecting its tab to the appropriate slot on the connected block.
Blocks can require a single input (the get length of block), multiple inputs (the get value block), or no inputs at all (the array element block). Some blocks contain , which can be used to increase or decrease the number of inputs required on the block (the merge arrays block). Any input slots you leave empty pass a null value.
In addition to adding and removing blocks, you can edit, duplicate, comment on, and change the format of blocks. You can increase or decrease the number of inputs used for some blocks.

You can use the following functions on blocks in the workspace.
To edit blocks:
Do one or more of the following:
- To remove selected blocks from the workspace and save them in the clipboard for pasting, go to Edit, and then select Cut.
- To copy selected blocks from the workspace and save them in the clipboard for pasting, go to Edit, and then select Copy.
- To paste previously cut or copied blocks from the clipboard to the current workspace, go to Edit, and then select Paste.
To revert the last action performed on the workspace, go to Edit, and then select Undo.
You can select Undo multiple times to undo multiple actions.
To replay a previously reverted action back to the workspace, go to Edit, and then select Redo.
You can select Redo multiple times to replay multiple reverted actions.

You can duplicate blocks that are in the workspace. Rather than adding the same block from the toolbox multiple times, you can add the input block once, then use duplicate to make copies. If you have set up a complicated set of blocks and need to used them again, you can duplicate the entire set of blocks rather than building another copy one block at a time. If you are planning to use the set of blocks frequently or in more than one workspace, you may want to create a custom block instead.
To duplicate a block:
Right-click the first block in the set of blocks you want to duplicate, and then select Duplicate.
The block and all of its inputs are duplicated.

If you want to make a note on a specific block in the workspace, you can add a comment to it. You can edit the comment later, or delete the comment if it is no longer needed.
To add a comment:
- Right-click the block, and then select Add Comment.
- Click
and enter the comment.
- Click
to close the comment field.
The comment is added to the block and is saved when you save the workspace. To review the comment, click .
To edit a comment:
- Click
on the block and edit the comment.
- Click
to close the comment field.
The comment is updated and is saved when you save the workspaceTo review the comment, click .
To delete a comment:
Right-click the block, and then select Remove Comment.
The comment is deleted.

You can change the way the blocks look in the workspace. You may find blocks easier to work with in an inline format. Or you may have finished working with a large chunk of blocks and you want to make the workspace less cluttered by collapsing the blocks to use less space. You can change back to the default external output format or expand the blocks that you've collapsed.
To change the format:
- Right-click the block, and then select one of the following options:
- Inline Inputs: Changes the block to a single line
- External Inputs: Changes the block back to the default format
- Collapse Block: Minimizes the size of the block so it takes up less room in the workspace
- Expand Block: Maximizes the block back to it's default format
- Right-click an empty area in the workspace, and then select one of the following options:
- Clean up Blocks: Lines up the disconnected blocks in the workspace
- Collapse Blocks: Minimizes all of the blocks in the workspace
- Expand Blocks: Maximizes all of the collapsed block in the workspace

There may be a time when you want to add more input slots to a block to create a rule. If a block has a icon, you can add additional inputs. There are two blocks which use a C-shaped opening rather than
to add input blocks.
To add inputs using :
-
Click
.
An Input window opens.
- Drag the Input block from the right side of the window into the C-shape in the Inputs block.
- Click
to close the window.
The block has an extra slot for every Input you added.
To add inputs to C-shaped openings:
There are two blocks that have a C-shaped opening for adding inputs instead of the standard slots and tabs: the object block and the Simple WMI query block. The object block only accepts the key/value pair block as an input. The Simple WMI query block only accepts the Typed property block as an input in its C-Shaped opening.
-
Add the object block or the Simple WMI query block to the workspace.
The block already has one input in the C-shaped opening.
- Do one of the following:
- Add the Typed property block or the key/value pair block from the toolbox.
- Right-click the Typed property block or the key/value pair block, and then select Duplicate.
- Drag the new input block into the C-shaped opening. You can add the new input block in any order in the C-shaped opening.
The block has the new input block added.

When you add the Run powershell script block or the encoded file block, the block prompts for a file. If you didn't select a file when you initially added the block, or if you want to select a different file, you can change the encoded file.
To update the encoded file:
- Right-click the Run powershell script block or the encoded file block, and then select one of the following:
- Encode Script
- Encode File
- Use File Explorer to locate the PowerShell script (.ps1) file or the zip file you want to use.
- Select the file, and then click Open.
The block encodes the file into the rule in base64.

You can delete unused blocks from the workspace or delete all of the blocks except for the Data item block.
The Data item block cannot be deleted.
To delete a single block:
Do one of the following:
- Right-click a block, and then select Delete Block.
- Drag the block onto the trashcan.
To delete a group of blocks:
Do one of the following:
- Right-click the first block in the group you want to delete. Select Delete n Blocks, where n is the number of blocks selected.
- Drag the group of blocks onto the trashcan.
To delete all blocks:
Right-click an empty area in the workspace and select Delete n Blocks, where n is the number of blocks that will be deleted.