Creating Queries with the Query Wizard

You can create and save queries in the following modes:

• Create queries on assets using the Query Wizard
• Create queries on Activity logs, Fetch History, and Asset Investigation using filters. For more information, refer to Creating Queries Using Filters.

This page explains how to create queries on assets using the Query Wizard.

Use the Axonius Query Wizard to create granular queries to understand how assets adhere to their policies. You can define a wide variety of filters, from which you can easily drill down to the assets that match the required search criteria. For example, you can use the Query Wizard to show only Windows device assets that were seen in the last 7 days using filters where the value of the common field OS: Type equals Windows and the value of the common field Last Seen is within the last 7 days.

Working with the Query Wizard

From the relevant assets page, click Query Wizard on the top right corner above the asset table. The Query Wizard definition box opens. The Query Wizard presents options appropriate to the selected asset type.

Each row in the Query Wizard is a filter expression. You need to define the following elements:

1. WHERE/WHERE NOT switch
2. AND / OR/ AND NOT/ OR NOT switch
3. NOT Flag
4. Source drop-down
5. Adapter drop-down
6. Field drop-down
7. Operator drop-down
8. Value field
9. Bracket controls

Once you create a query you can save it for future use. Learn more about Saved Queries .

For Devices queries you can use the AI Query Assistant if it is enabled on your system.

1. WHERE/WHERE NOT Switch

Each expression starts with the term WHERE.
You can choose WHERE NOT to negate the complete filter expression and only match assets that do NOT match the complete expression.

2. AND / OR / AND NOT/ OR NOT Switch

The AND/OR/AND NOT/OR NOT switch is only displayed on the second and subsequent filter rows. When you have more than one filter defined, use AND/OR to control whether all filters are required to match, or if just one filter can match. Use AND NOT/OR NOT to add an additional negation of the filter line, which can be either AND or OR, that is that all filters do not match, or just one filter will not match.

3. NOT Flag

Click the NOT flag to negate the filter line, and only match assets that do NOT match the adapter, field, operator, and value specified.


For example:

means that Axonius will return all devices EXCEPT the devices where the OS type is Windows (including devices where the OS type is unknown or this field doesn’t apply, and not just devices that their OS type is defined and NOT Windows).

4. Source Drop-Down

The source drop-down contains the following options:

• Aggregated Data (displayed as ALL) - Use Aggregated Data to query on all asset common fields fetched from any of the adapter connections. Aggregated Data is selected by default.
• Complex Field (displayed as OBJ) - Use Complex Field to query on assets with a specific complex field that meets the specified criteria.
• Asset Entity (displayed as ENT) - Use Asset Entity to make a query on a specific asset entity, that is, an asset entity fetched from a specific adapter connection.
• Field Comparison (displayed as CMP) - Use Field Comparison to compare between adapter field values, and only return assets which match the comparison.
• Relationship (displayed at RLT) - Use Relationship to query on assets that are connected to each other, i.e. that have a relationship between them, for instance Users that are connected to devices.

Learn more about Selecting Source Options in the Query Wizard.

5. Adapter Drop-Down

This Adapter drop-down contains a list of all adapters that have fetched data for assets. The adapter you select in this drop-down controls the list of fields displayed in the Field drop-down, when the Fields drop-down shows fields fetched by the adapter selected. You can quickly search for adapters using the search bar at the top of this drop-down.

The first entry and default selection in this drop-down is Aggregated represented with the icon. All of the fields for Aggregated are the collated values from all of the data that was fetched for all adapters, considered as 'common' fields.

By default, all adapters are selected. You can control the adapter data sources that are used when evaluating a filter for a common field. You can choose to only evaluate the operator and value query data in a common field from a subset.

You can select the adapter sources that will be searched for Aggregated Data / common field. When you only select specific adapters to be used for common fields, the icon is replaced by , to show that specific sources are selected. By default, all adapter sources are queried.

6. Field Drop-Down

The field drop-down contains a list of all the fields that were fetched for a specific adapter. When Aggregated is selected in the Adapter drop-down, this is a list of all fields whose data is collated from all adapters.

1. Select the common field option ( icon, default option) to search any generic field. Common fields are asset properties retrieved from multiple adapters.

2. Click the Adapter drop-down list to select the property on the asset to be queried. Use the search bar to search for a specific field name.

7. Operator Drop-Down

Once a field is selected, you need to select a comparison function from a drop-down list. For each field type there is a list of possible functions. Learn more about Query Wizard Operators.

8. Value Field

Specify the value to be compared by the field and function. Different relevant value options are enabled according to the field type and the operator/function chosen.

Autocomplete Suggestions for Equals Values

On certain fields, when the operator is set to equals the value drop down box displays all of the values that exist in the system, so that you will easily be able to formulate a valid query, without having to guess the exact name of the component on your system.
Once you type 3 letters, the system presents possible values for the field.
For instance, for “Installed Software: Software Name” if you are looking for Chrome start typing 'chr', and a drop down box will appear, showing all the installed software with these letters in it.

9. Parentheses Controls

When defining multiple expressions with a combination of "OR" and "AND" operands between them, usage of parentheses impacts the query definition.

In some complex expressions, multiple parentheses may be required. To increase/decrease the number of parentheses, click the up/down arrows in the Parentheses Control.

When you use OR NOT and AND NO, use of parenthesis is mandatory. You have to close the brackets, otherwise the expression will not work.

You can configure the Query Wizard to display the columns on the Query Results table. Learn about Working with Columns and Rows in the Query Wizard.

Expression Indicative Error

When an error occurs for a given expression, an indicative text referring to that error appears in red in the bottom of the Query Wizard. Use it to correct the expression.
For example, missing right bracket:

Running the Query

When you complete a filter expression, the contents of the asset table are refreshed with the results of your query. When you finish building the query expression, click Search. The final query expression is displayed in the Query Filter Bar.

Click Clear to clear all expressions in the wizard, which also clears the saved query, when used, refreshes the asset table and displays all existing devices.

You can always toggle back to the Query Wizard, change and refine the query, and create a multi-filter expression, by adding AND/OR operators between them:

• To add a new expression, click
• To remove an expression, click
• To reorder the expressions, hover over the expression to use the drag and drop functionality

For each added or removed expression the Asset table results are dynamically updated.

Once you create a query you can save it for future use. Learn more about Saved Queries.

Saving Queries

After you create a new query, or update an existing one, select Save As to save the query and add it to the Saved Queries list for future and advanced use. Saved queries are also used in Enforcement Sets, Dashboard Charts, Reports and more.

Using a Saved Query as a Filtering Condition in Query Wizard Expressions

You can use a saved query to create complex queries based on pre-defined queries. You can either use a pre-defined query, or a query created by you or another user. You can only select saved queries whose access is not private.

Updating Query Details

Once you configure filters or a Search and saved them as a query, Update Details is available as a drop-down from Save As.
Click Update Details to change any other query details, such as the name, description, tags and folder where it is saved.

Advanced Querying

Free Text Search in Table

The search bar lets you search free text and filter on assets with or without a predefined 'search by' option. By typing the required search text and pressing Enter, the results filter all entities in the table that contain the given text in any properties.

The available search options are:

• Free text search - Axonius runs the following search logic on the specified search value:
  • 'Case sensitive exact match' search in any of the selected columns.
  • 'Case insensitive exact match/ start with' search in the following columns for Devices and Users:
    • Devices page: Host Name, Network Interfaces: MAC, Device Manufacturer Serial, Last Used Users.
    • Users page: User Name, Email.

• Predefined 'search by' option
  • Click the search bar dropdown button or press the down arrow key to select one of the predefined 'search by' options:
    • Host Name - to run 'contains' search on 'Host Name' only.
    • Last Used Users - to run 'contains' search on 'Last Used Users'.
    • IP Address - to run 'contains' search on 'Network Interfaces: IPs'.
    • Installed Software Name - to run 'contains' search on 'Installed Software: Software Name'.
  • Each 'search by' option consists of a different set of columns, that can be personalized and saved as the user's search default view. For more details, see Editing Table Columns.

All searches are tracked and stored. Click the search bar drop-down button or press the down arrow key to browse the search History and the recent Saved Queries that were run.