Frequency of device data collection

After you activate a policy, data begins to be collected from your devices. Availability of this data in the Absolute console depends on how frequently it is collected on each device and when that data is uploaded. Each policy is configured with its own data collection and upload frequencies, which depend to some degree on the type of information being collected. For example, data that may indicate a security issue, such as a network change, is uploaded more frequently than other data.

Depending on the policy, devices may be scanned for new and updated data in the following ways:

• Scheduled scan: occurs at a regular interval, such as hourly
• Triggered scan: triggered when an event occurs on a device, such as the device is restarted. Triggered scans occur in addition to scheduled scans.
• On-demand scan (applies to EDD policies only): requested by a user in the console. On-demand scans occur in addition to scheduled scans.

If a scan reveals that device data has changed, the new data is collected and uploaded to the Absolute console within the next 15 minutes, if the device is online. If it has not changed, a full scan is uploaded on a daily or weekly basis (see details below) to ensure that the data in the console remains up-to-date.

Policy/Service	Scheduled scan frequency	Triggered scans?	Upload frequency
Anti-Malware	Hourly	No	Daily, at a minimum, and when data changes
Application Resilience	Every 15 minutes	No	Every 6 hours, at a minimum, and when an application's health status changes
Custom Data	Daily	No	Daily
Device Usage	Scan is continuous Usage minutes are batched hourly	No	Daily at 00:00 (local device time)
Endpoint Data Discovery (EDD)	Configurable in the policy Options are Quarterly, Monthly, Weekly, and Daily Optional on-demand scans are also available	No	Aligned with configured scheduled scans
Full-Disk Encryption Status	Hourly	No	Daily, at a minimum, and when data changes
Geolocation	Windows/Mac: every 2 hours Chromebook: hourly	Yes The device's location is collected when any of the following events occur: The device is restarted. The detected public IP address, BSSID, or SSID changes. A user logs in to the device. Note that a scan is not triggered when a device is unlocked, or when it wakes from sleep mode or hibernation.	Daily, at a minimum, and when the device's location changes
Hardware	Daily	Yes A hardware scan is triggered when any of the following events occur: The device is restarted. The detected public IP address or SSID changes.	Daily, at a minimum, and when data changes
Installed Applications	Every 5 minutes, and weekly full scans	No	Weekly, at a minimum, and when data changes
Web Usage	Scan is continuous Usage minutes are batched hourly	No	Hourly, if usage occurred in the past hour

NOTE   If a data point changes in a device's latest scan, an event may be logged to Event History, depending on the type of data. For the list of data points that trigger events, see Logged events.