Query Intersection Chart

The Query Intersection chart is a multiple queries metric, consisting of a base query and up to two intersecting queries. You can use this chart to display the number of assets represented by the intersecting queries compared to the base query and highlight the overlap between the intersecting queries, showing the result as a percentage of the total base query entities.

Query Intersection is displayed as a pie chart.

To configure a Query Intersection chart:

Give a title to your chart.
(Optional) Add a description if you want.
From the Widget dropdown, select Query Intersection Chart.
From the Module dropdown, select an asset module.
From the Base query dropdown, select or create a base query or leave empty for all entities. Learn more about creating a query.
Select one or two intersecting queries, or create new intersecting queries. As you configure the chart, a preview is created in the left pane. You can assign chart colors to asset count thresholds to easily evaluate the current environment. See Setting Threshold Colors.
(Optional) To calculate by asset entity instead of aggregated asset fields, select the Calculate by asset entity toggle. You can also select an adapter to calculate by assets fetched from that specific adapter.

Click Save. A pie chart is generated, with the following data:

Single Query Intersection

Slice Type	Slice Data	Slice Color	Slice Label
Intersection #1	The intersection between base queryANDthe intersecting query	The color of each slice depends on its size: Red - 0%-25% Amber - 26%-50% Blue - 51%-75% Green - 76%-100%	Name of the intersecting query name
Remainder	Assets returned by the base query that do not match the intersecting query.	Grey	Depends on the selected base query: Remainder of [intersecting query name] Remainder of all devices Remainder of all users

Slice Type

Slice Data

Slice Color

Slice Label

Intersection #1

The intersection between base queryANDthe intersecting query

The color of each slice depends on its size:

Red - 0%-25%
Amber - 26%-50%
Blue - 51%-75%
Green - 76%-100%

Name of the intersecting query name

Remainder

Assets returned by the base query that do not match the intersecting query.

Grey

Depends on the selected base query:

Remainder of [intersecting query name]
Remainder of all devices
Remainder of all users

Two Query Intersections

Slice Type	Slice Data	Slice Color	Slice Label
Intersection #1	The intersection between:[base query]AND[intersecting query #1]ANDNOT[intersecting query #2]	based on Axonius color palette	Intersecting query #1 name
Intersection #2	The intersection between:[base query]AND[intersecting query #2]ANDNOT[intersecting query #1]	based on Axonius color palette	Intersecting query #2 name
Intersection #1+#2	The intersection between:[base query]AND[intersecting query #1]AND[intersecting query #2]	based on Axonius color palette	Intersecting query #1 + Intersecting query #2 names
Remainder	Remainder of the data - The base query data that does not intersect with the selected queries:[base query]AND NOT([intersecting query #1] OR [intersecting query #2])	Grey	Depend on the selected base query: Remainder of [intersecting query name] Remainder of all devices Remainder of all users

For example, creating a Query Intersection chart with a base query of all devices, and devices seen in the last 7 days and with devices seen in the last 30 days as 2 intersecting queries will be resulted in (last 30 days contains all last 7 days devices):

Click the link on each of the slices of the pie chart to see the Devices page displaying the corresponding list of devices.

Updated about 17 hours ago