Recently Viewed Topics
Queries
The Queries page displays a list of queries available for use. The information provided includes Name, Type, Group, Owner, and the Last Modified time. You can use a filter to narrow the list by any of the columns (except Last Modified). For more information, see Filters.
To add a query, see Add a Query.
Clicking on the Query Name will display an edit page, if sufficient permissions exist, and allow for modifying the selected query.
Query Options
Queries provide the ability to save custom views of vulnerability, event, ticket, user, and alert data for repeated access.
The following options are shared across all query types.
| Option | Description |
|---|---|
|
Name |
The name used to describe the query. |
|
Description |
Descriptive text for the query. |
| Tag | A logical grouping for created asset objects. This reduces lengthy lists of assets with no logical grouping. Tags can be reused as desired and previously created tags will display in the tag option when subsequent assets are added. Objects shared with new users will retain the tag specified by the creator. |
|
Type |
The type of data you want the query to use. For more information about the filter components for Vulnerability, Event, and Mobile data types, see Vulnerability Analysis, Event Analysis, and Mobile Analysis. For more information about the filter components for Ticket, User, and Alert data types, see Ticket Query Options, User Query Options, and Alert Query Options |
| Tool | Chooses the analysis tool used by the query. |
Ticket queries are a useful way of determining what tickets to alert against. For example, if you want to be alerted when a user named Joe is assigned a ticket, you could create a query with a ticket filter based on the Assignee value of Joe. You could then create an alert to email you when Joe was assigned a ticket. The table below contains a list of the ticket query options.
| Option | Description |
|---|---|
|
Name |
Ticket name to filter against |
|
Status |
Ticket status to filter against. |
|
Classification |
The ticket classification to filter against. |
|
Owner |
The manager (owner) of the ticket assignee. |
|
Assignee |
The ticket assignee to filter against. |
|
Created Timeframe |
Ticket creation date/time to filter against. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.) |
|
Assigned Timeframe |
Ticket assigned date/time to filter against. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.) |
|
Modified Timeframe |
Ticket modified date/time to filter against. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.) |
|
Resolved Timeframe |
Ticket resolution date/time to filter against. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.) |
|
Closed Timeframe |
Ticket closed date/time to filter against. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.) |
User queries are useful for reporting, dashboards and alerts based on user actions. For example, it can be used for tracking user logins and locked accounts. It could also be used to track user logins from accounts not authorized on the monitored systems.
| Option | Description |
|---|---|
|
First Name |
User first name to filter against. |
|
Last Name |
User last name to filter against. |
|
Username |
Actual username to filter against. |
|
Group |
Filter against the group the user(s) belong to. |
|
Role |
Filters against users who have the specified role. |
|
|
Filters against users based on their email address. |
|
Last Login Timeframe |
Filters against users whose last login was that the timeframe specified. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.). |
|
Account State |
Filters against the user account state (locked vs. unlocked). |
The Alert query is useful for reporting, dashboards and alerting when an alert has triggered. This is useful for situations where a report, dashboard element or conditional alert is required after the specified alert filter conditions have been met. For example, a daily report could be scheduled containing a query of all active alerts and their details.
| Option | Description |
|---|---|
|
Name |
Filter against alerts with the specified name. |
|
Description |
Filter against alerts with the specified description. |
|
State |
Choose from All, Triggered, or Not Triggered. |
|
Created Timeframe |
Filters against the alert creation timeframe specified. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.). |
|
Modified Timeframe |
Filters against the most recent alert modification timeframe specified. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.). |
|
Last Triggered Timeframe |
Filters against the most recent alert trigger timeframe specified. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.). |
|
Last Evaluated Timeframe |
Filters against the most recent alert evaluation timeframe specified. Either specify an explicit timeframe, including the start and end time or choose one of the predefined periods (e.g., last 15 minutes, last hour, etc.). |