Manage Scheduled Queries - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Pro Administrator Guide

Product
Cortex XDR
License
Pro
Creation date
2023-07-31
Last date published
2023-11-28
Category
Administrator Guide

From the Scheduled Queries page, you can perform additional actions to manage your scheduled and reoccurring queries.

View Completed Queries

To view completed queries:

  1. Select InvestigationScheduled Queries.

  2. Locate the scheduled query for which you want to view previous executions.

    If necessary, use the Filter to reduce the number of queries returned.

  3. Right-click anywhere in the query row, select Show executed queries, and choose whether to open the query in the same tab or a new tab.

    Cortex XDR filters the queries on the Query Center and displays the results in a new window.

Edit the Query Frequency
  1. Select InvestigationScheduled Queries.

  2. Locate the scheduled query that you want to edit.

    If necessary, use the Filter to reduce the number of queries returned.

  3. Right-click anywhere in the query row and then select Edit.

  4. Adjust the schedule settings as needed, and then click OK.

Disable or Remove a Query

If you no longer need a query you can temporarily disable or permanently remove it.

  1. Select InvestigationScheduled Queries.

  2. Locate the scheduled query that you want to change.

    If necessary, use the Filter to reduce the number of queries returned.

  3. Right-click anywhere in the query row and then select Remove to permanently remove the scheduled query, or Disable to temporarily stop the query from running at the scheduled time. If you disable a query you can later return to the Scheduled Queries page and Enable it.

Rename a Scheduled Query
  1. Select InvestigationScheduled Queries.

  2. Locate the scheduled query that you want to change.

    If necessary, use the Filter to reduce the number of queries returned.

  3. Right-click anywhere in the query row and then select Rename.

  4. Edit the query name as desired, and then click OK.