Manage Scheduled Queries - Administrator Guide - Cortex XDR - Cortex XSIAM - Cortex - Security Operations

Select Investigation → Scheduled Queries.

Locate the scheduled query for which you want to view previous executions.

If necessary, use the Filter to reduce the number of queries returned.

Right-click anywhere in the query row, select Show executed queries, and choose whether to open the query in the same tab or a new tab.

Cortex XDR filters the queries on the Query Center and displays the results in a new window.

Select Investigation → Scheduled Queries.

Locate the scheduled query that you want to edit.

If necessary, use the Filter to reduce the number of queries returned.

Right-click anywhere in the query row and then select Edit.

Adjust the schedule settings as needed, and then click OK.

Select Investigation → Scheduled Queries.

Locate the scheduled query that you want to change.

If necessary, use the Filter to reduce the number of queries returned.

Right-click anywhere in the query row and then select Remove to permanently remove the scheduled query, or Disable to temporarily stop the query from running at the scheduled time. If you disable a query you can later return to the Scheduled Queries page and Enable it.

Select Investigation → Scheduled Queries.

Locate the scheduled query that you want to change.

If necessary, use the Filter to reduce the number of queries returned.

Right-click anywhere in the query row and then select Rename.

Edit the query name as desired, and then click OK.