Bookmark filter queries

Use the Bookmarking feature in Xprotect to save complex filter queries, especially those you run periodically. Booking a filter query is similar to saving URLs as Bookmarks on Web browsers. In this case, the filter query is saved as a 'Saved Query'. When you want to rerun the same query, you load the Saved Query.

In Xprotect, the two types of Bookmarks/Saved Queries you can save are:

  • Public - these queries are available for all the users who log into the tenant.

  • Private - these queries are available only for the user who created the Bookmark.

You can make a Public query Private or vice-versa by editing a Saved Query.

Save a query as a Bookmark/Saved Query

  1. Go to the page to which the query is related.

  2. Enter the query in the Filter field/area.

    To see how to construct filter queries in Xprotect, see Filter data in Xprotect for more details.

  3. Click the Saved Queries icon.

  4. Enter a name for the Bookmark.

  5. Enter a suitable description.

  6. Select Public or Private.

  7. Click Save.

Load Saved Queries

If you load a Saved query on an irrelevant page (for example, a Host query on an Alerts page), the query loads, but the page is not filtered, and you will not see any results.

  1. Go to the page that is relevant to the query.

  2. Click the Saved Queries icon.

  3. Click Load (next to the query you want to run).

    Complex queries may take a few seconds to load and filter the page.

Modify saved queries

Modify saved queries when you want to make a Private query Public or vice-versa or when you want to change the operators in the query.

  • If you change the operators of a Saved Query, click the Saved Queries icon and click Update (next to the query you modified).

Next steps

  • Load saved queries or construct new queries to filter data in Xprotect. See Filter data in Xprotect for more details.

Did this answer your question? Thanks for the feedback There was a problem submitting your feedback. Please try again later.