Save a Query

You can identify security gaps by running and saving a query about your assets.

Axonius supports a varitey of asset management use cases, that can be implemented by running the right query.
Read about some common use cases are described in the Axonius documentation site, under the Using Axonius category in the Use Cases subcategory. Use the navigation tree and the search bar to explore the various use cases, that include, but are not limited to:

• Finding Endpoints Missing Agents
• Finding Endpoint Agents Not Functioning Correctly
• Finding Devices Not Being Scanned For Vulnerabilities
• Discovering Cloud Instances Not Being Scanned For Vulnerabilities
• Finding Unmanaged Devices
• Finding Rogue Devices On Privileged Networks

To Achieve this Milestone

Use the Query Wizard on the Devices page to create a query, then save it so you can easily access it in the future.

Create and Save a Query

To run and save a query:

1. Click the Assets icon and from the left-pane, select Devices
   

To create and run your own query:

1. From the Devices page, click Query Wizard on the top right corner above the Devices table.

2. The popup opens enables you to add filtering expressions upon different properties of devices. You can create multiple filter expressions and decide on the logical operators between them to create complex filtering conditions.

   For example, the expression below filters all devices which Windows is their operating system (OS: Type) and such devices were seen in Axonius in the last 7 days:

• The Query Wizard consists of following elements which requires the user input to create a filter expression:
  1. WHERE/WHERE NOT switch
  2. AND / OR/ AND NOT/ OR NOT switch
  3. NOT Flag
  4. Source drop-down
  5. Adapter drop-down
  6. Field drop-down
  7. Operator drop-down
  8. Value field
  9. Bracket controls

4. To run the query, click Search.
   To learn more about the Query Wizard and advanced querying, see Creating Queries with the Query Wizard.
5. To change the displayed columns, click Edit Columns on the right side of the page just above the table. Notice you can pick any field from any adapter by selecting it on the top left selection. You can also narrow down the list of properties by typing into the search bar:
   

6. To save a new unsaved query, click Save As next to the query name. The Save as dialog opens, and you can set a name for the new saved query.

To learn more about working with saved queries, see Queries.

Modify an Existing Query

To modify a saved query:

1. Click (Queries icon). icon on the left navigation panel.
2. The Queries page opens, displaying all the saved queries. Filter by devices in the Modules drop-down to see queries for device entities.

3. Search for a query and click its record to review its details.
   

4. Click Run Query to execute it.

5. Modify the query. Use the Query Wizard to change the query expressions or click Edit Columns to edit the query table columns.

6. Rename or save the query:

   • Rename a saved query by a single click on the query name.
   • Save - Update the saved query you are working on.
   • Save as - Save the query results as a new saved query.

To learn more about working with saved queries, see Queries.
To learn more about the Query Wizard elements and advanced querying, see Creating Queries with the Query Wizard.