Reuse and manage saved queries

Saving useful search queries is a time-saving practice, especially if you or your team are following a set of investigation SOPs or playbooks. A saved query is private and can be used only by you, unless you decide to share it.

To save a search query:

1. Follow this procedure to create the search query.

2. Once done, click Save this query from the upper part of the page.
   

3. In the Save Query dialog box, name your search query. It’s recommended that you enter a description to help you remember the purpose of this query in the future.
   

4. Under the Time Range field, determine select Last X (relative) to if you want the query to always run on the specific selected dates and times, check the Save time range as exact dates checkbox. Otherwise, a relative time range will be used (last 3 hours, last 12 hours, last 3 days, etc).

5. Click Save.

To save time and increase efficiency, instead of constantly building the same queries, you can load an existing saved query from the query library. This can be a query you created and saved or a query shared with you by a team member.

The query does not run automatically when selected, but rather loads on the search screen and requires you to fill in missing values and hit the Run query button.

To use a saved search query from the library:

1. Navigate to Investigation > Search.
   

2. Click Saved queries to open the query library.
   

3. Locate the query you want to use and then click Select to load it onto the query section.
   

4. Complete the missing values in the query and then click Run query.
   

Saved queries can be refined and updated, even when shared with others. You can edit the query details, the query itself, or both.

To edit a saved query:

1. Navigate to Investigation > Search.
   

2. Click Saved queries to open the query library.
   

3. Locate the query you want to update and then click Select to load it onto the query section.
   

4. Make changes to your query and then click Save changes from the upper part of the page.

💡 Tip

To edit only the query details (name, description, etc.), hover over the query in the library, click the options icon and then click Edit Details.

If you are using a saved query and want to make changes to it without running over the existing settings, you can duplicate it and save it as a new query. This is also useful when you don’t have permissions to edit a query shared by a team member but want to use its settings.

To duplicate a saved query:

1. Navigate to Investigation > Search.
   

2. Click Saved queries to open the query library.
   

3. Locate the query you want to update and then click Select to load it onto the query section.
   

4. Make changes to your query and then click Save as new from the upper part of the page.

5. In the Save Query dialog box, name your search query. It’s recommended that you enter a description to help you remember the purpose of this query in the future.
   

6. If you want the query to run on the relative time frame selected in the query settings, select the relative option from the Time range field. Select the exact dates option if you want the query to run on exact dates and times.

7. Click Save.

You can delete only saved queries created by you, even if they are shared with others.

To delete a saved query:

1. Navigate to Investigation > Search.
   

2. Click Saved queries to open the query library.
   

3. Locate the query you want to delete, click the options icon and then click Delete.
   

After creating a saved query, you can share it with your team members and allow them to use it. You can also unshare it to prevent anyone else from seeing or using your query.

To share/unshare query:

1. Navigate to Investigation > Search.
   

2. Click Saved queries to open the query library.
   

3. Locate the query you want to share, and click the icon to share it with others. To unshare an already shared query, click .

⚠️ Attention

When you unshare a query that was created by someone else it will immediately be removed from your view and will only be available to the query creator.