Manage Your Queries - Administrator Guide - Cortex XDR - Cortex XSIAM - Cortex - Security Operations

Select Investigation → Query Center.

Identify the query by looking in the Query Description column.

The Query Description column displays the parameter that were defined for a query. If necessary, use the Filter to reduce the number of queries that Cortex XDR displays.

Queries that were created from a Query Builder template are prefixed with the template name.

Right-click anywhere in the query row, select Show results, and choose whether to open the query in the same tab or a new tab.

(Optional) If you want to refine your results, you can modify a query from the query results.

(Optional) If desired, Export to file to export the results to a tab-separated values (TSV) file.

(Optional) Perform additional investigation on the alerts.

From the right-click pivot menu:

Create a query based on an existing query.

1. Select Investigation → Query Center.

2. Right-click anywhere in the query and then select Save as a new query.

3. If desired, enter a descriptive name to identify the query.

4. Then modify the search parameters as desired.

5. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Modify an existing query from the Query Center.

1. Select Investigation → Query Center.

2. Right-click anywhere in the query and then Edit a query.

3. Modify the search parameters as desired.

4. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Modify a query from the query results.

1. View the Results of a Query.

2. At the top of the query, click the pencil icon to the right of the query parameters.

   Cortex XDR opens the query settings page.

3. Modify the search parameters as desired.

4. Choose when to run the query.

   Select the calendar icon to schedule a query to run on or before a specific date or Run to run the query immediately and view the results in the Query Center.

   While the query is running, you can always navigate away from the page and a notification is sent when the query completes. You can also Cancel the query or run a new query, where you have the option to Run only new query (cancel previous) or Run both queries.

Rerun a query immediately.

1. Select Investigation → Query Center.

2. Right-click anywhere in the query and then select Rerun Query.

   Cortex XDR initiates the query immediately.

Schedule a query to run:

1. Select Investigation → Query Center.

2. Right-click anywhere in the query and then select Schedule.

3. Choose the desired schedule option and the date and time the query should run:

   • Run one time query on a specific date

   • Run query by date and time—Schedule a reoccurring query at a frequency of your choice.

4. Click OK to schedule the query.

   Cortex XDR creates a new query and schedules it to run on or by the selected date and time.

5. View the status of the scheduled query on the Scheduled Queries page.

   At any time, you can view or make changes to the query on the Scheduled Queries page. For example, you can edit the frequency, view when the query will next run, or disable the query.

Select Investigation → Query Center.

Right-click anywhere in the query and then select Rename.

Enter the new query name and click OK.