Queries Page
  • 13 Jun 2022
  • 10 Minutes to read
  • Dark
    Light
  • PDF

Queries Page

  • Dark
    Light
  • PDF

Use the Queries page to manage the queries on your system. You can see a centralized summary of information about all the saved queries on the system. You can manage all the queries, and see who updated the query, when it was last used and more. In this way you can easily identify where queries are used and delete queries that are not used any longer,
To open the Queries page, click the Queries QueryIcon.png icon. You can also click Saved Queries on the top right corner above the query results table from any page where you create or save queries.

SavedQueries.png

The Queries page opens.

QueriesPAge

Queries can be stored in folders. The folders pane is shown at the left side of the page. Your system comes with some ready-made folders, and a Predefined Queries folder which contains the system queries. As you create queries on the system, you can add them to existing folders or create new folders. The total number of saved queries is displayed on the top left side of the table:

TotalNoOfSavedQueries.png

A link to Query History is displayed at the top of the page. Click Query History to see information about queries run on the system.

The following information is displayed on the Queries page.

  • Name - The name of the saved query.
    Module - The system modules on which the query runs, Devices, Users, Vulnerabilities, Adapter Fetch or Activity Logs.
  • Tags - The tags associated with the saved query, if these exist.
  • Access - The access permissions for the saved query.
    • Private - Only the user can view this saved query.
    • Public - All users can view this saved query. It can be used in all Dashboard, Enforcement Center, Reports and Query Wizard.
  • Used In - an icon shows the area of the application in which the Query is used. Mouse over to see more details. Click on an area of the application to open the query in the relevant place in the system. For example, in the Enforcement page, Dashboard etc. In this way, you can see where queries are used and decide whether you can delete them from the system, or what will be affected if you edit them.
Note:

Used In is only available for Administrators.

Querywithmouseover.png

  • Last Used by User – the last time the query was run by any user manually
  • Last Updated - The date and time the saved query was updated.
  • Updated By - The user who made the last update to the query.
    • The user name is displayed with a prefix:
      • Internal - A user who was defined internally in Axonius by one of the system admins.
      • SAML or LDAP - A user who logged in using the LDAP or SAML based login options.
    • If the user no longer exists in the system, the displayed user name is displayed with a “(deleted)” suffix.
    • Hover over the field to display the user's first and last name in addition to the user name, if this exists.
    • For predefined saved queries, that were preconfigured by Axonius, the Updated by value is Predefined.
    • Folder – the folder the query is stored in
  • Created by – the name of the user who created the query.
  • Folder Path – the path where the folder is stored. If the path is long, and not fully displayed, mouse over to see it.


When you click on a query the Saved Query drawer opens. Refer to Viewing and Editing Query Details to learn more about the Saved Query drawer,
You can select Run Query to run the query.

Search and Filter Saved Queries

You can filter the queries as follows:
QueryFilter.png

  • Query Name - Select one or more query names; the system returns all relevant queries.

  • Modules - Select one or more system modules on which the query runs, Devices, Users, Vulnerabilities, Activity logs, Fetch History; the system returns all relevant queries.

  • Tags - Select one or more tags from a list of all the tags associated with the saved queries to filter the display by tags. All saved queries tagged with at least one of the selected tags are displayed. Click Clear All to clear all selections.

  • Access - Select an access type to filter the display by access type. All queries with the selected Access Type are displayed. Click Clear All to clear all selections.

  • Created by - Select one or more users; the system returns all relevant queries.

  • Last run from date - Last run to date - Click the date range picker to filter the date queries were run by.

    • Select two dates to set the date range for which queries will be displayed.
    • To filter queries only for a specific date, select the same date twice.
    • Click Select Time in the date range picker to include specific times in the date range.
    • Click OK to set the date range filter

Click Reset to clear the search and filters.


Sorting Queries

You can sort queries to see where they are used. Click on the following column titles to sort by that title.

  • Name
  • Module
  • Tags
  • Access
  • Last Used by User
  • Last Updated
  • Updated by
  • Created by
  • Folder Path

Working with Folders

Once you start working with Axonius, you might find yourself creating large numbers of queries. You can organize your queries in folders to manage them and to easily find related queries.
The All Queries folder shows all queries in the system that you are authorized to see. Each query must be saved to a folder. Note that you cannot saved a query directly to the All Queries folder, only to a subfolder.
Query folders can either be public or private. The system comes with a set of predefined queries in the Predefined Queries folder. These queries cannot be edited or deleted from the system and you can't save new queries to the Predefined Queries folder. In addition, the Shared Queries and the My Private Queries folders are system folders. You can save queries to these folders and create new folders in the Shared Queries and the My Private Queries folders. These folders are set as default folders when you save a new query. You can create up to 5 levels of query folders.

Creating a New Folder

  1. Mouse over a folder for which you have permissions. A 3 dot menu icon is displayed.

  2. Click on it, the Folder menu opens.
    NewFolderMenu

  3. Choose New Folder; a new folder called 'untitled folder' is created inside the folder you chose

  4. Click on the Folder menu again, and choose Rename to give a name to your folder.

Renaming Folders

Click on the Folder menu, and choose Rename to give a name to your folder.

Moving Folders

You can change the location of folders on the system, You can drag a folder to a different folder. Note that if you move a folder from a private folder to a public folder, then the folder and all the queries in it become public. You cannot move a public folder into a private folder.

Moving Queries

You can move queries from one folder to another.

Note the following:

  • You can only move queries which you have permissions to edit.
  • You can't move a public query to a private folder.
  • If you move a private query to a public folder, the query will become public.
  • You can only move queries with the same permissions (either public or private).
  • You can't move queries to the Predefined Queries folder.
  1. On the Queries page, select one or more queries. When at least one query is selected, the Actions button is displayed above the Saved Queries table.
  2. Click the Actions menu.
  3. From the Actions menu, select Move To Folder to move one or more queries to a different folder; a Folder List drop-down opens.

MoveQuery

  1. Use the vertical and horizontal scrolls to find the folders you want and click Move; the queries are moved to the appropriate folder.

Deleting Folders

You can click delete to delete a folder
If you delete a folder, this also deletes all the queries and folders in the folder. This is not reversible.

Saved Query Actions

Deleting Queries

To delete queries

  1. On the Queries page, select one or more queries. When at least one query is selected, the Actions button is displayed above the Saved Queries table.

QueryActionsDelete

  1. Select Delete to delete one or more queries.

Or delete queries from the Saved Queries drawer.

Tagging One or More Queries

You can add tags to one or more queries. You can't tag predefined queries, only queries created by users.

  1. On the Queries page, select one or more queries. When at least one query is selected, the Actions button is displayed above the Saved Queries table.

  2. Select Tag to tag one or more queries; the Tag Saved Queries dialog opens.
    TagSavedQuereis.png

  3. Choose a tag from the drop down list of tags available in the system, or start typing to add a new tag. The list of tags used in queries is the same across the whole system. When you add a new tag, click Add New to add the tag to the system.

CreateNewTag.png

  1. Click Save.

Moving to a Folder

You can move one or more queries to a different folder.

Moving Queries

Editing the Query Column Display

Your system comes with a set of pre-defined columns in each asset table which determine which columns are displayed on the asset page and asset list view. The column view is set on each asset page separately and displays columns appropriate for that asset.

You can edit the columns displayed for a group of queries. Note that you can also edit the query column display for a single query, from the relevant asset page. Refer to Changing Columns Displayed.

  1. Select one or more queries, they should be queries on the same module.
    QueryActionMenu

  2. From the Action menu choose Edit Query Column Display; the Edit Columns dialog opens.

EditColumnsQueries

  1. Select fields you want to add and click Add
  2. Or select fields you want to remove from the display and click Remove. Edit columns overrides the existing columns displayed in these queries and any data refinements set for the columns, and sets a new columns display.

The columns you chose are now saved as part of the queries you selected. The Query drawer displays the columns that are displayed as part of the saved query.

Viewing and Editing Query Details

Use Saved Query drawer to view query details, edit them, and perform actions on the query.

On the Queries page, click a saved query record to view its details; the Saved Query drawer opens. When you open a query saved in AQL format it is displayed in the Query Wizard in AQL format.
You can view and edit the following saved query details:

Click EditQueryicon.png to edit the following query details

  • Name
  • Description (optional, limited to 300 characters)
  • Tags
  • Always keep Cached
  • View the following saved query details:
    • Query Wizard expressions
    • Last updated
    • Updated by

In addition, you can perform the following actions:

  • Click RunQueryButton.png Run Query to run the query and display the results in the Devices / Users page.

  • Click ButQueryHistory to open the query history runs of this query in the Query History page.

  • Click CopyQueryLink.png Copy Query Link to copy the link to the query and share it with others.

  • Click CopyEnforcementLink.png New Enforcement to create a new enforcement set using the saved query as a trigger. The Enforcement Set Configuration page opens. You can create a new enforcement set for the selected query that is already automatically configured as part of the enforcement set trigger. For more details, see Creating new Enforcement Sets.
    You can add a new enforcement to a single query one at a time.

  • Click Set Public.png Set access to public on private saved queries to set the access to public. Changing the access of a saved query to public will make it publicly available to all users and cannot be reset to private.

  • Keep saved query always cached - The Keep always cached checkbox lets you keep a saved query always cached.

    • If enabled, the saved query will always be cached. The saved query will be executed and cached each TTL interval defined in Cache Settings.
    • If disabled, the saved query will not be always cached.
    • This checkbox is only visible when Caching is enabled in the system.
  • Click DeleteQuery.png Delete to delete the saved query.

QueryDrawer



First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.